At BilakidAI Labs, we help organisations adopt artificial intelligence in a useful and responsible way. That standard starts with how we handle your own data.
This policy explains, in plain language, what personal data we collect through bilakidai.tech, why, on what legal basis, how long we keep it, who we share it with and how to exercise your rights. It is drawn up in accordance with Senegalese Law No. 2008-12 of 25 January 2008 on the protection of personal data and its implementing Decree No. 2008-721. For visitors located in the European Union, it also takes into account the General Data Protection Regulation (GDPR).
This English version is provided for convenience. In case of discrepancy, the French version prevails.
01Data controller
The controller of your personal data is:
- BILAKID AI, sole proprietorship, trading as BilakidAI Labs
- Trade register (RCCM): SN.DKR.2026.A.37127
- NINEA: 013417044
- Head office: Yoff, Quartier Ouest Foire, Xandar Extension, Dakar, Senegal
- Contact for any question about your data: bilakid.ai0@gmail.com
One address covers every request: it is read by the person in charge of data protection within our team.
02Scope of this policy
This policy covers the data collected when you browse bilakidai.tech (in French or English), fill in our contact form, write to the email address shown on the site, or interact with our Instagram account @mhkim.jb (comments and direct messages).
It does not cover data we process while carrying out an assignment for a client (for example the data used in an automation project or an AI agent). That processing is governed case by case by the contract or data processing agreement signed with the client.
03The data we collect
We follow a data minimisation principle: we only collect what we actually use. The site has no user accounts, no online payments and no advertising.
1. Data you send us through the contact form
- Identity and contact details: full name, email address;
- Professional information: role in the company, company name and website;
- Information that helps us understand your project: company size, annual revenue range, intended budget, services you are interested in;
- The content of your message;
- The language of the page you write from (French or English).
All of these fields are needed for us to understand your needs and suggest the right support. Revenue and budget ranges are deliberately broad: we never ask for exact figures. Please do not include sensitive information in your message (health, opinions, bank details, etc.): we do not need it at this stage.
2. Data contained in emails you send us
If you write to us directly, we receive your email address, your name as it appears in your mailbox, the content of your message and any attachments.
3. Audience measurement data
Unless you have opted out, we use Google Analytics 4 to understand how the site is used: pages viewed, visit duration, traffic source (search engine, social network, direct link), device type, browser, operating system, language, and approximate country and city derived from the IP address. This data is tied to a random identifier stored in a cookie, not to your name or email address. Google Analytics 4 does not log IP addresses. We have turned off Google signals and ad personalisation: this data is used for audience measurement only.
4. Technical connection data
Like any website, our host automatically receives some technical data in order to serve pages and protect the service: IP address, date and time of the request, requested page, browser and operating system (user agent), referring site.
04Why we use it, and on what legal basis
Each processing operation has a specific purpose and an identified legal basis:
- Purpose
- Answering your contact request, talking with you and preparing a proposal
- Data involved
- Contact form data, emails
- Legal basis
- Steps taken at your request before entering into a contract; otherwise your consent, given by writing to us
- Purpose
- Following up on the business relationship with prospects and clients
- Data involved
- Contact details, professional information, history of exchanges
- Legal basis
- Our legitimate interest in developing and following up our business; performance of the contract for clients
- Purpose
- Measuring and improving the site’s audience
- Data involved
- Audience measurement data
- Legal basis
- Our legitimate interest in understanding how the site is used, with a simple and immediate right to object (see Cookies)
- Purpose
- Running and securing the site, fighting spam and abuse
- Data involved
- Technical connection data, form anti-spam field
- Legal basis
- Our legitimate interest in keeping the service secure and available
- Purpose
- Meeting our legal obligations (accounting, tax, requests from authorities) and defending legal claims
- Data involved
- Client data, supporting documents
- Legal basis
- Legal obligation; legitimate interest in defending our rights
| Purpose | Data involved | Legal basis |
|---|---|---|
| Answering your contact request, talking with you and preparing a proposal | Contact form data, emails | Steps taken at your request before entering into a contract; otherwise your consent, given by writing to us |
| Following up on the business relationship with prospects and clients | Contact details, professional information, history of exchanges | Our legitimate interest in developing and following up our business; performance of the contract for clients |
| Measuring and improving the site’s audience | Audience measurement data | Our legitimate interest in understanding how the site is used, with a simple and immediate right to object (see Cookies) |
| Running and securing the site, fighting spam and abuse | Technical connection data, form anti-spam field | Our legitimate interest in keeping the service secure and available |
| Meeting our legal obligations (accounting, tax, requests from authorities) and defending legal claims | Client data, supporting documents | Legal obligation; legitimate interest in defending our rights |
We do not sell or rent your data, and we do not use it for marketing on behalf of third parties. We make no decision with legal effects on you based solely on automated processing, including profiling.
05Artificial intelligence and your data
Because AI is our business, we make clear commitments:
- No model training: the data you send us through this site is never used to train or fine-tune an artificial intelligence model, whether ours or a third party’s.
- No automated decisions: every contact request is read and handled by a member of our team.
- Controlled tools: if we use an AI tool to help prepare a reply or a proposal, we only enter the information strictly needed, and only into professional services whose terms rule out reusing your data for training.
06Instagram interactions
When you comment on a post of our Instagram account @mhkim.jb or send us a direct message, we receive through Meta’s official API:
- your Instagram user ID and username;
- the text of your comment or message;
- the date of the exchange;
- whether you follow our account;
- your phone number, only if you write it yourself in a message.
Why. To send you the resource you requested, reply to your messages, send you one follow-up if you did not reply, and keep track of our conversations with contacts.
Where it is stored. In a private Google Sheets spreadsheet, processed through the n8n automation tool. We do not sell your data or share it with third parties other than technical providers (Meta, Google, n8n).
Retention. We keep this data for a maximum of 24 months, or until you ask us to delete it.
Your rights. You can ask to access, correct or delete your data at any time (see Deleting your data).
07How long we keep it
We keep your data only for as long as the purpose it was collected for requires:
- Data
- Contact requests and exchanges with a prospect
- Retention period
- 3 years from our last exchange, then deleted or anonymised
- Data
- Client data
- Retention period
- For the whole contractual relationship, then archived for the applicable limitation periods
- Data
- Accounting records (invoices, contracts linked to billing)
- Retention period
- 10 years, as required by OHADA accounting law
- Data
- Audience measurement data (Google Analytics)
- Retention period
- 14 months at most; cookies expire after 2 years at the latest
- Data
- Technical connection data
- Retention period
- A limited period set by our host for security and troubleshooting
- Data
- Requests to exercise your rights
- Retention period
- Long enough to handle the request, then as long as needed to prove we answered it
| Data | Retention period |
|---|---|
| Contact requests and exchanges with a prospect | 3 years from our last exchange, then deleted or anonymised |
| Client data | For the whole contractual relationship, then archived for the applicable limitation periods |
| Accounting records (invoices, contracts linked to billing) | 10 years, as required by OHADA accounting law |
| Audience measurement data (Google Analytics) | 14 months at most; cookies expire after 2 years at the latest |
| Technical connection data | A limited period set by our host for security and troubleshooting |
| Requests to exercise your rights | Long enough to handle the request, then as long as needed to prove we answered it |
Messages flagged as spam by our anti-abuse filter are deleted without being used.
08Who has access to your data
Within BilakidAI Labs, only the team members who need your data to handle your request can access it. We also rely on a few technical providers (processors), who act solely on our instructions:
- Provider
- Netlify, Inc.
- Role
- Website hosting; receiving and storing messages sent through the contact form; spam filtering
- Location
- United States
- Provider
- Google (Google Analytics)
- Role
- Audience measurement
- Location
- United States and European Union (Google Ireland Limited for visitors in the European Economic Area)
- Provider
- Google (Gmail)
- Role
- Receiving and sending the emails we exchange with you
- Location
- United States
- Provider
- Meta Platforms (Instagram)
- Role
- Delivering Instagram comments and messages through Meta’s official API
- Location
- United States and European Union
- Provider
- Google (Google Sheets)
- Role
- Storing Instagram exchanges in a private spreadsheet
- Location
- United States
- Provider
- n8n
- Role
- Automating the handling of Instagram exchanges
- Location
- European Union (Germany)
| Provider | Role | Location |
|---|---|---|
| Netlify, Inc. | Website hosting; receiving and storing messages sent through the contact form; spam filtering | United States |
| Google (Google Analytics) | Audience measurement | United States and European Union (Google Ireland Limited for visitors in the European Economic Area) |
| Google (Gmail) | Receiving and sending the emails we exchange with you | United States |
| Meta Platforms (Instagram) | Delivering Instagram comments and messages through Meta’s official API | United States and European Union |
| Google (Google Sheets) | Storing Instagram exchanges in a private spreadsheet | United States |
| n8n | Automating the handling of Instagram exchanges | European Union (Germany) |
Your data may also be disclosed where the law requires it, to an authorised judicial or administrative authority, and only within that scope.
09Transfers outside Senegal
Some of our providers are located outside Senegal, notably in the United States. Law No. 2008-12 only allows such transfers to countries or organisations offering an adequate level of protection. We ensure this by choosing established providers bound by contractual data protection commitments, in particular the standard contractual clauses adopted by the European Commission and, where applicable, their certification under the EU–US Data Privacy Framework.
You can obtain information about the safeguards covering these transfers by writing to bilakid.ai0@gmail.com.
11Security
We apply appropriate technical and organisational measures to protect your data:
- encryption of all communication with the site (HTTPS);
- access to messages and tools limited to the people who need it, with protected accounts;
- anti-spam protection on the contact form;
- providers that apply recognised security standards;
- regular deletion of data that has reached the end of its retention period.
No system is infallible. If a data breach is likely to put you at risk, we commit to notifying the Senegalese Personal Data Protection Commission and, where the situation calls for it, informing you without undue delay.
12Your rights
You have the following rights over your data:
- Right to information: knowing how your data is used. That is what this policy is for.
- Right of access: confirmation that we process your data, and a copy of it.
- Right to rectification: having inaccurate or incomplete data corrected or completed.
- Right to erasure: having your data deleted, unless the law requires us to keep it.
- Right to object: objecting to processing on legitimate grounds, and to direct marketing at any time without giving a reason.
- Right to withdraw consent at any time where processing is based on it, without affecting what was done before.
- For people covered by the GDPR: right to restriction of processing and right to data portability for the data you provided to us.
13How to exercise your rights
Write to us at bilakid.ai0@gmail.com, stating which right you wish to exercise. We reply within one month at most. This period may be extended by two months for complex requests, in which case we will let you know. Exercising your rights is free of charge.
To protect your data, we may ask you to confirm your identity, for example by writing from the email address you used to contact us. We only ask for an identity document if there is reasonable doubt, and delete it as soon as the check is done.
Lodging a complaint
If, after contacting us, you believe your rights have not been respected, you can refer the matter to the Senegalese Personal Data Protection Commission (CDP): www.cdp.sn.
If you live in the European Union, you can also contact the data protection authority of your country, for example the CNIL in France.
14Deleting your data
To delete your data, email bilakid.ai0@gmail.com with the subject “Data deletion” and your Instagram username. We erase your data within 30 days and confirm it to you by message.
15Minors
Our site and services are intended for professionals and organisations. They are not aimed at minors and we do not knowingly collect their data. If you believe a minor has sent us data, write to us and we will delete it.
16Links to other sites
The site links to our LinkedIn, Instagram, X and YouTube pages. These are plain links: no plugin from these networks is embedded in our pages, so no data is sent to them unless you click. Once on these platforms, their own privacy policies apply.
17Changes to this policy
We may update this policy to reflect changes in our practices, our providers or the law. The date of the last update is shown at the top of this page. If we make a significant change, we will flag it visibly on the site.
18Contact us
For any question about this policy or your data: bilakid.ai0@gmail.com, BILAKID AI (BilakidAI Labs), Yoff, Quartier Ouest Foire, Xandar Extension, Dakar, Senegal.