MCAT is operated by Carbon Architecture Advisory Services (CAAS), Nairobi, Kenya. Last updated 5 October 2026.
What we collect. Your name, email address, organisation (optional) and project type when you start an assessment; the project details you enter in the intake form; the text of any documents you upload for pre-fill; your assessment results; and payment status for paid reports. We also keep a technical record of your session, including when this window loses focus while a report is on screen, so that report access can be traced.
How we use it. To verify your email, run your assessment, deliver and unlock your report, process payment, protect the report and methodology library from copying, and respond to your questions. We do not sell your data and we do not use your project details for advertising.
Document upload. Files you upload are read in your browser. The extracted text is sent to our server and to the AI service we use to propose form answers, used to pre-fill the form, and kept as a fail-safe backup with your account record. You confirm every critical field before anything is scored. Do not upload documents you are not entitled to share.
Who processes your data for us. We share only what each provider needs to do its job: our hosting provider (Render), our email delivery provider (Resend), Paystack for payments (card, mobile money and bank details go to Paystack and are never stored by us), Anthropic (Claude) for document pre-fill, and Google Fonts and cdnjs, which receive your IP address when the page loads fonts and scripts. These providers act on our instructions. We disclose data to authorities only where the law requires it.
What stays in your browser. We store a project ID, a session token and your name and email in your browser's local storage so a reload does not lose your project or a payment you have made. Clearing site data removes them.
How long we keep it. We keep assessment records and lead details for as long as needed to provide the service and meet legal and accounting obligations, then delete or anonymise them. We keep a record of your data for three years as a fail-safe, then delete or anonymise it. The full Privacy Policy has the details.
Your rights. Under the Kenya Data Protection Act, 2019 you can ask to see, correct or delete your personal data, object to its use, or withdraw consent. Email karen.too@carbonarchitectureadvisoryservices.com and we will respond within 21 days. You may also complain to the Office of the Data Protection Commissioner.
Security. Data is sent over HTTPS and access to stored records is restricted to authorised CAAS staff. No online service is completely secure, so we cannot guarantee absolute security.
Changes. We will post any change here and update the date above.