Privacy Policy

Le Patro Designs (“we”, “us”) is a design and technology studio led by Patrobas Nyamawi. We design brands, print, websites, video, advertising, IT systems, and apps.

Working location: Makongeni, Thika, Kenya
Legal address: Chigato 58, Mazeras, 80114, Kenya

For personal data we decide the purpose of, we are the data controller under Kenya’s Data Protection Act, 2019. When we build or host a system for a client, the client is usually the controller and we process data on their instructions.

This website is published at lepatrodesigns.vercel.app. Questions about privacy go to lepatrodesigns@gmail.com or +254 708 065 328.

This policy applies when you:

• visit this website or any page on it, including the client area;
• send an enquiry by form, email, phone, or WhatsApp;
• see or click an advertisement we serve, design, or connect;
• use an app we publish, or a web version of that app;
• use an app, website, or system we develop for you or for a client, where that product connects back to this studio or to our advertising account.

Social networks, WhatsApp, Google, app stores, and advertising platforms have their own policies. Those apply as soon as you leave our pages or open their products.

Information you give us. Quote and enquiry forms ask for your name, email, phone number (with country code), the service you want, and any message you add. The same details may arrive by email, phone, or WhatsApp. Client-desk registration asks for your name, company or brand, phone, and email. After we open a desk, we also store a password that you or we set. Project messages, files, quotes, and invoices are stored against that account.

Information collected while you use the site. Our host may log the IP address, browser type, device type, referring page, and the pages requested. We use that to keep the site online and to investigate abuse. A signed login cookie keeps you signed in to the client desk or admin. Gallery pages may store a shuffle order in your browser so the layout stays stable on that device. That value stays on your device; we do not receive it as an account.

Information from ads and apps. If you arrive from an advertisement, the ad platform already holds a record of that click under its own policy. If you then send a form or open WhatsApp, we receive what you choose to send. Apps we publish can collect the information described in the app section below, including advertising identifiers when Google ads are shown.

We do not ask you to create an account just to browse the public site, and we do not sell personal information.

The studio website and the apps we publish are authorised to show Google ads through one publisher account: pub-2150069713797449. That link is public in two files on this site:

• ads.txt authorises Google as a direct seller of advertising on this website.
• app-ads.txt authorises the same Google account as a direct seller inside apps whose store listing names this website as the developer site. That is the connection between our app development and our ads account.

Both files name google.com as a direct partner, with Google’s certification authority ID f08c47fec0942fa0. When an ad is served, Google and its advertising partners may use cookies, mobile advertising IDs, IP address, and similar technologies to show an ad, limit how often you see it, measure whether it was viewed or clicked, and detect invalid traffic. Depending on your settings, ads may be personalised from activity on this site, in our apps, and on other sites and apps that use Google advertising.

Google’s use of information from sites and apps that use its services is described at How Google uses information from sites or apps that use our services, advertising technologies, and the Google Privacy Policy.

You can control personalised ads in Google Ad Settings. Industry opt-out pages include aboutads.info and, in Europe, Your Online Choices. On Android, you can reset or delete the advertising ID in system settings. Opting out of personalised ads does not turn ads off; it changes how they are chosen.

We also design online ads and connect them to landing pages, forms, WhatsApp, and client systems such as a CRM. For a client campaign, the client usually owns the ad account (for example Meta, Google, YouTube, TikTok, X, or LinkedIn). That platform collects device, account, and interaction data before you reach the page. We receive the enquiry you submit, and we may see campaign results the platform reports, such as which ad led to a visit or a message. We use that to judge the campaign. We do not build a separate profile of you to sell to other advertisers.

Apps we publish. Apps are published under the Le Patro Designs name, and others are still on the way. Al-Quran (com.lepatrodesigns.alquran) is on Google Play now. A published app uses the same Google publisher account as this website through app-ads.txt.

Apps and systems we build for clients. A client project can include a mobile app, a website, a client login, forms, notifications, analytics the client asked for, payments such as M-Pesa, and hosting. Those products may connect to each other and to third-party services so an enquiry, a file, or a payment reaches the right place. End users of a client’s product should read that client’s privacy notice. We handle their data only to build, host, support, or hand over the product, and we do not use it to advertise our own studio or to feed our Google ads account unless the client has agreed that their app is published by us and listed against this website.

If we publish an app under the Le Patro Designs name, this policy and app-ads.txt apply. If a client publishes an app under their own developer account, their ads file and their privacy policy apply, and we still follow the project agreement for any data we process.

The client area is for people who work with the studio. Registration is reviewed by us before a login is opened. Once active, the desk can hold your profile, project status, messages, delivery files, quotes, and invoices. Passwords are stored as a hash, not as plain text. A session cookie named lp_session keeps you signed in for up to 14 days. It is HTTP-only, limited to this site, and marked secure on the live site.

You can update your name, company, phone, and password from the account page while signed in. To close a desk, email us. We may keep invoices and project records we need for tax, disputes, or an unfinished job.

• Login cookie. lp_session, only after you sign in. It expires after 14 days or when you sign out.
• Browser storage. A key such as le-patro.shuffle remembers which gallery items are showing. It identifies a layout, not you.
• Advertising cookies and IDs. Set by Google when an ad is shown on this site or in an app covered by app-ads.txt, as described above. We do not run a separate analytics product on the public site.

You can block cookies in your browser. Blocking the login cookie means the client desk will not stay signed in. Blocking advertising cookies limits personalised ads.

We use personal data to:

• reply to enquiries and prepare quotes;
• deliver design, websites, ads, IT work, and apps, and keep project records;
• run the client desk, including files, messages, and invoices;
• show, measure, and protect advertising on this site and in our apps;
• connect an ad, a landing page, a form, or an app to the result the campaign was built for;
• keep the site and our systems secure, and meet tax and legal duties in Kenya.

The legal grounds we rely on are your consent (for example an optional enquiry), a contract or steps before a contract (a quote or a project), our legitimate interests in running and securing the studio and understanding which ads work, and a legal duty where one applies. You can withdraw consent where processing is based on consent, without affecting work we have already done on a contract.

We share personal data only as needed for the purposes above:

• Google. Gmail delivers enquiry email. Google Drive stores portfolio images that this site displays, so a request for an image may reach Google. Google advertising, under publisher pub-2150069713797449, serves and measures ads on the website and in connected apps. Google Play handles app installs we list there.
• FormSubmit. If Gmail delivery fails, the enquiry form is sent through FormSubmit to our inbox. FormSubmit processes the name, email, phone, service, and message for that delivery.
• Hosting and database. The site is hosted on Vercel. The client desk is stored in a database (Turso, or a studio database on the host). Those providers process data to run the service.
• WhatsApp and social platforms. The WhatsApp button and social links open Meta (WhatsApp, Instagram, Facebook), TikTok, X, YouTube, or LinkedIn. From that point the conversation or profile is on their service. We see messages you send us.
• Advertising and client tools. For a client campaign or build, data can pass through the ad platform, landing page, form, WhatsApp, CRM, or payment provider the project uses, including M-Pesa where payments are part of the build.
• Law and protection. We may disclose information if required by Kenyan law, a regulator, or a court, or to protect the studio, a client, or another person from harm or fraud.

We do not sell, rent, or trade personal information.

We work from Kenya. Hosting, email, advertising, and app-store providers process data in Kenya and in other countries, including the United States. Where personal data leaves Kenya, we use providers that offer a service we can hold to account, and we share only what the task needs. Kenya’s Data Protection Act allows transfers with appropriate safeguards.

Enquiry messages stay in our email while we are replying and for as long as the related project file is still useful. Client-desk profiles, files, and messages stay while the account is active. Billing records are kept for the period Kenyan tax and accounting rules require. Host logs follow the host’s retention. Advertising records held by Google follow Google’s retention. When a client project ends, we hand over or delete project data as the agreement says, except records we must keep.

The live site is served over HTTPS. Client passwords are hashed. The session cookie is not readable by page scripts. Access to the client desk is limited to the account holder and the studio. No method of transmission or storage is perfectly secure. If you believe an account has been misused, email us and change the password from the account page.

Under Kenya’s Data Protection Act, 2019 you can ask to be told how your data is used, to receive a copy of it, to correct data that is wrong, to object to processing, and to ask us to delete data that is false, misleading, or no longer needed for the purpose we held it. You can withdraw consent where processing is based on consent. You can also complain to the Office of the Data Protection Commissioner (odpc.go.ke).

Email lepatrodesigns@gmail.com with the request and enough detail for us to find the record (for example the email on the enquiry or the client desk). We may need to confirm you are the person the data is about. Some records, such as invoices, cannot be deleted while the law says we must keep them. If your data sits in a client’s product, we will direct you to that client or help them respond.

This website and the client desk are for adults and businesses. We do not knowingly collect personal data from children through the site. If you believe we have collected a child’s data through the website without a parent’s involvement, contact us and we will delete it.

We will update this page when our practices change, including if we add an advertising partner or publish another app against the same developer site. The date at the top is the latest update. The new text applies from the day it is posted.

Le Patro Designs
Working location: Makongeni, Thika, Kenya
Legal address: Chigato 58, Mazeras, 80114, Kenya
lepatrodesigns@gmail.com
+254 708 065 328
WhatsApp