Privacy Policy

Hekitari Smart Farm Manager is operated by Hekitari Ltd, a company registered in Rwanda. We build digital tools that help Rwandan farmers manage their agricultural operations through satellite field monitoring, weather intelligence, AI crop disease detection, and an AI farming assistant.

We collect only the data necessary to provide the features of the app. We do not collect data we do not need.

Data You Provide Directly

• Full name and contact details provided during account registration.
• Email address and password for your Hekitari account.
• UPI number (Ubutaka Parcel Identifier) — your Rwandan land parcel identifier, used to link your fields to satellite monitoring and weather features.
• Farm details including farm name, location, crop types, and field size.
• Crop records, planting dates, and seasonal data you enter manually.
• Photos of crops, leaves, or stems you submit for AI disease detection.
• Questions and messages you send to the AI Farming Assistant.

Data Collected Automatically

• Precise GPS location — used to link your device to your registered land parcel and to provide location-relevant weather and satellite data.
• Device information including device model, operating system version, and unique device identifiers.
• App usage data including features used, screens viewed, session duration, and interaction patterns — used to improve the app.
• Crash reports and error logs — collected automatically when the app encounters an issue.
• Network information including connection type (WiFi or mobile data) — used to optimize performance under low connectivity.

Data from Third-Party Sources

• Satellite imagery and vegetation health data from our satellite data provider, linked to your registered UPI parcel.
• Weather data from our weather intelligence provider, localized to your farm's GPS coordinates.

We do not purchase or obtain personal data about you from data brokers or marketing platforms.

We use your data strictly to provide and improve the Hekitari SFM app. We do not use your data for advertising.

We process your personal data based on the following legal grounds under Rwanda's Data Protection Law (Law No. 058/2021) and applicable international frameworks:

• Contract performance — processing necessary to provide the services you signed up for (account creation, field monitoring, disease detection, weather alerts).
• Legitimate interests — app improvement, crash analysis, and security monitoring, where these do not override your rights.
• Legal obligation — where we are required to process data to comply with Rwandan law or a lawful order.
• Consent — for any processing not covered above, we will ask for your explicit consent and you may withdraw it at any time.

We never sell your personal data. We never share your data with advertisers or marketing platforms.

Technology Service Providers

• Satellite imagery providers — receive your UPI and GPS coordinates to retrieve field health data for your parcel only.
• Weather data providers — receive your GPS coordinates to return localized forecasts.
• Cloud hosting providers — store your app data on secure servers. Our primary hosting infrastructure is global, with data processed in data centers that meet international security standards.
• AI and machine learning providers — process crop photos you submit for disease detection. Photos are processed and not retained beyond the analysis.

Agronomists

If you choose to connect with a registered agronomist through the app, your farm profile and crop details are shared with that agronomist to enable them to provide relevant advice. This sharing only occurs when you initiate the connection.

Legal and Regulatory Authorities

We may share data with Rwandan regulatory authorities, law enforcement, or courts where required by law or a lawful order. We will notify you unless prohibited by law from doing so.

Business Transfers

If Hekitari Ltd is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you in advance and ensure the receiving party upholds the same privacy standards.

Hekitari Ltd is based in Rwanda. Our infrastructure uses global cloud services, which means your data may be processed on servers located outside Rwanda, including in the European Union, United States, or other regions.

When your data is transferred internationally, we ensure it is protected by:

• Using cloud providers that comply with internationally recognised security standards (ISO 27001, SOC 2).
• Contractual safeguards (Data Processing Agreements) with all third-party providers.
• Ensuring any transfer is consistent with Rwanda's Data Protection Law requirements for cross-border data transfers.

You may contact us at info@hekitari.com to request information about the specific countries where your data may be processed.

When you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required by law to retain it.

Under Rwanda's Data Protection Law (Law No. 058/2021) and applicable international frameworks, you have the following rights:

• Right to access — request a copy of the personal data we hold about you.
• Right to correction — request that we correct inaccurate or incomplete data.
• Right to deletion — request that we delete your personal data, subject to legal retention requirements.
• Right to restrict processing — request that we limit how we use your data in certain circumstances.
• Right to data portability — request your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us at info@hekitari.com. We will respond within 30 days at no charge.

We take data security seriously. The measures we have in place include:

• Encryption in transit — all data transmitted between your device and our servers is encrypted using TLS (Transport Layer Security).
• Encryption at rest — personal data stored on our servers is encrypted at rest.
• Access controls — only authorised Hekitari team members can access personal data, and only where necessary for their role.
• Penetration testing — we conduct security testing before major releases.
• Incident response — we have a documented process for responding to data breaches, including notifying affected users and the relevant authority within the timeframes required by law.

No system is completely secure. If you believe your account has been compromised, contact us immediately at info@hekitari.com.

Hekitari SFM is not intended for use by children under the age of 16. We do not knowingly collect personal data from children. If we become aware that a child under 16 has provided us with personal data, we will delete it promptly. If you believe a child has registered, please contact us at info@hekitari.com.

Hekitari SFM requests the following device permissions. You may manage these at any time in your device settings. Denying a permission will disable the related feature but will not prevent you from using the rest of the app.

We use analytics tools to understand how the app is used, identify bugs, and improve performance. This data is aggregated and does not identify you personally. We do not use advertising trackers or cross-app tracking. We do not share analytics data with third parties for their own commercial purposes.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the app and by email at least 14 days before the changes take effect. The updated policy will always be available at sfm-privacy.hekitari.com. Continued use of the app after the effective date constitutes acceptance of the updated policy.

If you have any questions, concerns, or requests regarding your personal data or this Privacy Policy, please contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with the Rwanda Utilities Regulatory Authority (RURA), which oversees data protection in Rwanda, or the relevant data protection authority in your country.

Need help with the app? Visit our Support page.