Ownserva legal and accessibility readiness review
Reviewed 21 October 2026 (Africa/Nairobi). This is an engineering readiness record, not legal advice, a certification or a finding that every EU/US/global requirement is met. Applicability depends on actual processing, customers, turnover, contractual roles and countries. Ownserva is not ready to be represented as fully legally compliant.
Operator facts supplied by the owner
- Ownserva LTD, Kenya; consumers and businesses, global target market.
- Postal address supplied: 720-01000, Thika, Kenya.
- Public domain: ownserva.com.
- Privacy: [email protected]. Support: [email protected].
- Company registration number, tax registrations, street/service address requirements, EU representative, DPO arrangements, hosting regions, provider contracts and operating policies remain unverified. The address is reproduced as supplied; no street address or registration number has been invented. Mailboxes/domain ownership and delivery were not tested.
These details appear on the public legal/contact pages even before policies are published and prefill the platform administrator's editor. Policy publication requires the operator to complete and review the actual arrangements. Public text is rendered as text, not executable HTML.
Implemented controls
Apply 016_legal_privacy.sql, after all earlier migrations, with a migration administrator. Deploy dashboard, API and worker together. Existing populated databases are not upgraded by Compose initialization.
| Area | Implemented | Limits and required action |
|---|---|---|
| Notices | Public privacy, terms, cookies, privacy choices, operator information, accessibility, provider, refund and withdrawal pages; links throughout the site | Policies remain visibly unpublished until approved content is provided. The editor does not write or legally validate the business's policies. |
| Policy evidence | Immutable content versions, administrator-only publication, public version download and version-specific policy viewing | Publication is operator approval, not certification. Archive links use ?version=HASH; downloadable JSON is at /api/legal/version/HASH. Retain legally necessary contract evidence under the approved schedule. |
| Registration | Production email/OAuth account creation requires published terms; explicit unchecked service-terms acceptance; privacy notice is separate | OAuth registration uses a hashed, single-use fifteen-minute browser proof and a Secure/HttpOnly/Host-prefixed cookie in production. Existing users can sign in; new OAuth accounts must use Register. No marketing subscription is inferred. |
| Checkout | Recurring consent and terms acceptance are separate, unchecked controls; current policy version, price, currency and consent evidence captured; server and database gate live payment creation | Tax calculation, jurisdiction evidence, legally compliant tax invoices, renewal/price-change reminders and legal approval of consumer terms remain launch work. Existing hosted checkouts created before this upgrade need review; this change does not remotely cancel them. |
| Cancellation/withdrawal | Existing provider-verified renewal cancellation; public withdrawal form with no login/reason requirement; timestamped receipt download and email acknowledgment attempt | A request is received even if mail fails. It does not itself stop renewal, execute a refund or decide eligibility. Monitor failed acknowledgments and complete statutory confirmation, cancellation/refund and response obligations promptly. |
| Data rights | Public access, deletion, correction, restriction, objection, opt-out, appeal and accessibility request intake without login; mailbox verification; private administrator review queue | Mailbox verification is not blanket identity verification or authorization to disclose/delete. Operators must verify proportionately, respond, fulfill requests, notify recipients where required, and record reasons/appeal routes. Status changes do not send replies or perform those actions. |
| Export/deletion | A fresh session/email-bound security proof is required for a JSON account export. Existing account deletion revokes access and pseudonymizes the profile | Export excludes other people's data, secrets and application databases. It is not a complete subject-access response for every processor/controller. Account deletion does not erase all tenant, transaction, audit, request or backup data. |
| Storage/tracking | No analytics/ad tracking SDK added; cookie inventory; optional tracking stays absent; privacy choices and opt-out/objection channel | No decorative “accept all” banner. Audit the deployed ingress, scripts and providers; optional tracking must not be introduced without the applicable consent/opt-out mechanisms, including GPC/UOOM handling where required. |
| Minimization | Worker removes expired sessions, email proofs, account challenges, OAuth linking/registration proofs and invitations; expires pending authenticator seeds and request verification tokens | Request records, financial/audit data and backups are not automatically erased. Define and implement justified retention/deletion/hold rules across all copies and providers before claiming compliance. |
| Accessibility | Skip links, focus indication, correct sign-in H1, distinct page titles, reduced motion, improved contrast, modal keyboard containment/Escape/focus restoration | Automated tests are limited. Manual screen-reader, zoom/reflow, keyboard, error recovery and hosted checkout tests are still required. No complete WCAG conformance assertion is published. |
| Browser protection | Same-origin mutation checks, limited input, no-store responses for sensitive data, CSP that excludes third-party scripts/connections, restrictive browser permissions and HTTPS HSTS when configured | The current Next.js static rendering requires inline scripts/styles; this is not a nonce-based strict CSP. HTTPS, production cookies, TLS renewal, access control, backups and incident operations require deployment validation. |
The request queue has a two-day internal triage target, measured from initial submission, including unverified mailboxes. It is not a legal deadline or a promise that all rights are fulfilled in two days. Kenya's access requirement is shorter than the GDPR's usual one-month response period; review every applicable request deadline and do not wait for the reminder. Withdrawal refunds and urgent incidents require separate handling.
Before commercial/global launch
- Have qualified counsel assess EU/EEA GDPR/ePrivacy, national consumer law, applicable EAA requirements, US federal and state privacy/automatic-renewal/consumer laws, and Kenya DPA/ODPC registration and regulations. Global targeting also requires a country-by-country launch decision; the UK and other non-EU European countries have separate regimes.
- Publish verified company/service details, approved terms, lawful processing bases, retention periods/criteria, data sources, rights/complaints information, actual providers, data locations and transfer safeguards. Assess EU representative/DPO requirements. Execute controller/processor agreements and appropriate international-transfer arrangements; merely naming a contract or storing data in a region is insufficient.
- Resolve VAT/sales tax, buyer-location evidence, price/tax presentation, invoices, applicable renewal/price-change reminders, withdrawal and refund handling. The software has no universal tax or consumer-law engine. Do not waive digital-service withdrawal rights through a generic checkbox or assume infrastructure subscriptions are one-off downloadable content.
- Staff and test rights, accessibility and consumer-support channels. Verify both supplied mailboxes, monitor the administrator queue daily, arrange durable confirmations/replies, apply the correct statutory deadlines, preserve original receipt time and honor valid withdrawal notifications even when a verification email fails. Add escalation/notifications to the operator's monitored support system; this build has a queue, not a staffed support service.
- Inventory and implement retention/erasure across PostgreSQL, customer servers, gateway/provider logs, registrar records, restores and backups. Apply justified legal holds and explain exceptions; do not promise immediate deletion of all records. Test restrictions/objections and opt-outs across downstream systems and authorized-agent requests/appeals where applicable.
- Commission manual accessibility and deployed security testing. Include all dashboard flows and payment/OAuth providers. Verify emergency access, compromise response, breach assessment/notification, encryption-key recovery, processor incident arrangements and recovery drills. Automated tests do not establish ADA, EAA, GDPR security or PCI compliance.
- Assess hosting/relay classification and any DSA, US DMCA/safe-harbor, illegal-content notices, abuse handling, statements of reasons and law-enforcement procedures. The privacy queue is not a complete hosting moderation/legal-notice program. Also assess children's privacy/age-related duties, AI-related roles, sanctions/export controls, sector-specific data and any relevant cloud/cybersecurity duties. These were not resolved by changes to the website.
Operating the editor and queue
Sign in as a platform super_admin and open Account Settings. Operator legal information accepts the identity, privacy/terms, retention, transfers, providers, refunds, withdrawal, accessibility and tax sections. Complete each section, confirm actual operational/legal review and publish. The API validates required fields/addresses and snapshots a content hash. It cannot determine whether a policy is lawful or true. No legal documents have been approved or published by this development task.
The adjacent request queue lists the 200 most recent requests with mailbox/acknowledgment state, initial time and triage target. Operate an external monitored case process and database reporting for larger volumes; do not rely on that limited screen as a complete backlog. Record the actual reply and decision, not merely a status label. Do not put passwords, passport images or private privileged advice in public policy content. Notes are internal review records; assess any applicable access rights before responding to a subject-access request.
The public request API rate-limits five submissions per email per fifteen minutes plus a global bucket. Alternative published email contacts remain available if the form is unavailable or limited. Verification links last twenty-four hours and do not postpone initial receipt. No identity documents are collected by the public form. No purchase, refund, external legal notice, production deployment or real email was sent by these checks.
Current primary references
- EDPB: individuals' rights and handling requests covers transparency, rights, response handling and proportionate identity checks.
- Kenya ODPC: Data Protection (General) Regulations, including regulation 9's seven-day access requirement; ODPC laws.
- California Attorney General: CCPA, including applicability, rights and opt-out signals. It is not a substitute for assessing other states.
- FTC: subscription practices/ROSCA. The FTC's March 2026 notice describes renewed rulemaking and the vacated 2024 rule; this review does not present the 2024 “click-to-cancel” rule as currently effective.
- European Commission: online consumer protection and withdrawal function and Your Europe: distance contracts.
- European Commission: strictly necessary storage/consent principles.
- DOJ: web accessibility guidance, European Accessibility Act, and W3C WCAG 2.2. A private Kenyan business should not assume US public-sector Title II rules are its complete applicable standard.
- European Commission: DSA hosting/platform distinctions and international-transfer SCC guidance.
Law and guidance can change. Recheck applicability and current rules with counsel before launch and after material changes.
22 October site update
Migration 017 adds optional first-party session/page-view analytics, contact intake and encrypted OAuth configuration. The cookie banner offers essential-only and optional analytics choices with equal prominence, defaults optional analytics off, and honors GPC and Do Not Track. No visit is recorded until opt-in. See platform administration for retained fields and cleanup. This supersedes earlier statements that no analytics feature exists; policy publication still requires the operator review above.