Legal Document

Acceptable Use Policy

Last Updated: 10 June 2026

Violations of this policy may result in immediate account termination and may be reported to law enforcement authorities.

1. Purpose

This Acceptable Use Policy ("AUP") defines the rules for lawful and appropriate use of the Akubrecah platform. It applies to all users, visitors, and account holders. This AUP supplements and is incorporated into our Terms of Service.

2. Permitted Use

You may use Akubrecah solely to:

  • Retrieve your own KRA PIN Certificate or Tax Compliance Certificate, using your own National ID or KRA PIN
  • Submit a Change of Particulars request to KRA using your own credentials, on your own behalf
  • Access information about KRA compliance services provided on this platform
  • Manage your own Akubrecah user account

3. Prohibited Use

The following activities are strictly prohibited and may result in immediate account suspension, legal action, or reporting to relevant Kenyan authorities:

3.1

Unauthorised Access to Third-Party Data

  • Submitting another person's National ID, KRA PIN, or personal details without their explicit written consent
  • Retrieving KRA certificates or information belonging to another individual, company, or entity
  • Impersonating another taxpayer or creating accounts under false identities

Applicable law: Computer Misuse and Cybercrimes Act, 2018 — Sections 22, 23 (Unauthorised access, interception)

3.2

Fraud & Misrepresentation

  • Providing false, inaccurate, or misleading personal information
  • Using forged or altered identification documents
  • Submitting fraudulent Change of Particulars requests
  • Using this service to generate false or misleading tax compliance documents

Applicable law: Penal Code (Cap. 63) — Forgery, fraud offences

3.3

Automated & Bulk Abuse

  • Using bots, scripts, crawlers, or automated tools to interact with the Service
  • Bulk retrieval of KRA data for any commercial data harvesting purpose
  • Reverse engineering, decompiling, or scraping the platform
  • Circumventing rate limits, CAPTCHAs, or security controls

Applicable law: Computer Misuse and Cybercrimes Act, 2018 — Section 16 (Illegal interception)

3.4

Commercial Resale & Unauthorised Distribution

  • Reselling access to the Akubrecah platform without written authorisation
  • Offering KRA certificate retrieval services to third parties using your Akubrecah account
  • Distributing, selling, or sharing KRA data retrieved through this Service to any third party

Applicable law: Terms of Service, Section 6 (Intellectual Property)

3.5

Platform Interference

  • Attempting to overload, crash, or disrupt the Service through denial-of-service attacks
  • Uploading malicious files, malware, or code through any upload feature
  • Exploiting security vulnerabilities without responsible disclosure
  • Injecting false data into the Service to generate inaccurate documents

Applicable law: Computer Misuse and Cybercrimes Act, 2018 — Sections 14, 15

3.6

Identity & Credential Abuse

  • Sharing your Akubrecah login credentials with others
  • Creating multiple accounts to circumvent restrictions or bans
  • Using another person's account without their authorisation

Applicable law: Data Protection Act, 2019 — Data subject rights

4. Consequences of Violation

If we determine, in our sole discretion, that you have violated this AUP, we may:

  • Immediately suspend or permanently terminate your account without notice
  • Cancel any pending service requests without refund
  • Report the violation to the relevant law enforcement authorities in Kenya
  • Refer the matter to the Office of the Data Protection Commissioner (ODPC) where data protection violations are involved
  • Pursue civil or criminal legal remedies available under Kenyan law
  • Preserve and disclose any data required for law enforcement investigations

5. Reporting Violations

If you become aware of any misuse of the Akubrecah platform, or if you believe your personal KRA data has been accessed without your consent through this Service, please report it immediately to:

6. Responsible Disclosure

If you discover a security vulnerability in our platform, we ask that you report it to us responsibly at [email protected] before public disclosure. We commit to acknowledging your report within 48 hours and resolving confirmed vulnerabilities promptly. We will not take legal action against good-faith security researchers who follow responsible disclosure.

7. Updates to this Policy

We reserve the right to update this AUP at any time. Changes are effective when posted. Continued use of the Service constitutes acceptance of the updated AUP.

8. Contact