Privacy Policy

Who is responsible

Alafi Jonathan decides what personal data is collected and why. That makes him the data controller under Uganda’s Data Protection and Privacy Act 2019.

Email jonathanalafi@gmail.com, or call +256 790 928 942.

What we collect, and why

Nothing, to look. You can read every page without an account, a name or an email address. There is no sign-up for visitors.

A like. When you like a piece, the count on that piece goes up by one. Your browser remembers which pieces you have liked, in its own storage, so the same piece cannot be liked twice. That memory stays on your device; we do not receive your name with a like.

A comment. The name you type, or “Guest” if you leave it blank, what you write, and the time. Comments are public.

An anonymous session. To write a like or a comment, your browser is given an anonymous identifier by Firebase, the Google service that stores the gallery’s data. It is a random string, not your name. It is attached to the comments you post so that, if he has to, the artist can remove everything one person wrote at once.

Technical. Ordinary server logs, meaning your IP address, the pages you fetched and the time, kept by the server that hosts the site as every web server does. Your browser also keeps a copy of the site’s colours and settings so pages do not flash while loading.

The owner’s account. The dashboard the artist uses to manage the gallery has one kind of account: his. Visitors never create one.

We do not collect anything for advertising, we run no analytics, and we do not build profiles of visitors.

Cookies

The site sets no cookies of its own. It uses your browser’s local storage for the things above: which pieces you have liked, the anonymous session, and a cached copy of the site’s settings. Clearing your browser’s site data removes all of it. The only visible effect is that you could like a piece a second time.

Who else sees your information

Everyone, for comments. A comment is displayed under the work to anyone who opens the page. Do not write anything in one that you would not want public.

The artist. Sees every like count and every comment, and can delete comments.

Firebase, run by Google. Stores the like counts, comments and anonymous sessions on our behalf, and does not use them for its own purposes.

Cloudinary. Hosts the image files for work the artist has uploaded. When such an image loads, Cloudinary receives your IP address, because that is how a browser fetches a file.

Google Fonts and cdnjs. The typefaces and one animation script load from these services, and each receives your IP address when a page loads. None of them is told your name, your comments, or what you looked at.

The host. The site is served from a server operated for us. Its logs are described above.

We do not sell personal data and we do not share it for advertising. There is no advertising on Alafi Art Work.

How long we keep things

Like counts: for as long as the piece is on the site. They contain nothing about you.

Comments: until the artist removes them or you ask us to.

The anonymous session: it lives in your browser until you clear your site data. On our side it stays attached to your comments for as long as they exist.

Server logs: a short time, for keeping the site running, then discarded.

Your rights

Under the Data Protection and Privacy Act 2019 you may ask to see the personal data we hold about you, ask us to correct it, ask us to delete it, object to how it is used, and complain to the Personal Data Protection Office.

Email jonathanalafi@gmail.com and we will respond. One honest limit: a comment carries no email address, so to delete yours we may need you to tell us which it is, and roughly when you posted it, before we can find it.

Children

Anyone can look at the gallery. Comments are public, so please do not leave one that includes a child’s name, school or anything else that identifies them. We do not knowingly keep personal data from children, and we will remove a comment from a child on request.

Where your data is held

Firebase and Cloudinary operate outside Uganda, so like counts, comments and uploaded images are stored on servers abroad. The Act places conditions on transferring personal data out of Uganda.

Changes

If this policy changes in a way that affects you, we will say so on this page rather than quietly changing the date at the top.