Last updated: [ September 23, 2026 ]
This page explains what personal information I collect, why, and what you can do about it. It’s written to be read rather than survived. If anything is unclear, ask me and I’ll explain it properly.
Who is responsible
I am — Alistair Gould, based in Nairobi, Kenya. I’m the data controller for the information described here, which means I decide what is collected and why, and I’m accountable for it.
Reach me about anything on this page at [ info(at)alistairgould.com ].
What this covers
This policy covers this website and the digital products I build, including The Full Picture. Each section below says which one it applies to.
It does not cover my advisory clients. That work is governed by the engagement terms you sign with me, and the two are deliberately kept apart — see Keeping things separate.
If any of these products later becomes its own entity, I’ll publish a separate policy for it and tell you before anything changes.
1 · Visiting this website
The site records standard server logs, which may include your IP address, browser type and the pages you viewed. This is used to keep the site working and secure, and nothing else. I rely on my legitimate interest in running a functioning website.
2 · Contacting me
If you email me or use a contact form, I keep the message and your contact details so I can reply and keep a record of the conversation.
3 · Unstructured Notes
My newsletter runs on Substack. If you subscribe, Substack holds your email address and reading activity under its own privacy policy as well as this one. You can unsubscribe from any issue.
4 · The Full Picture waitlist
The form collects your first name and email address, and your answers about how many institutions hold your money, what kinds of assets you own, whether you’ve tried tracking them before and what went wrong, where you and your money are based, and how you’d like to be involved.
I use this to decide what to build first, to work out who to invite to early sessions, and to contact you about The Full Picture. Nothing else.
I rely on your consent, given by ticking the box on the form. You can withdraw it at any time by emailing me, and I’ll delete your responses.
5 · The Full Picture spreadsheet
The spreadsheet lives in your own Google account. I don’t receive it, can’t see it, and have no access to anything you put in it unless you deliberately share it with me. Filling it in sends me nothing.
6 · The Full Picture app
The app is not yet available and does not currently collect anything. People trying the prototype are not submitting financial information to me.
Before the app collects any information, I’ll update this section and tell anyone already on the waitlist what it says. It will set out what the app stores, what stays on your device, where anything held on a server sits, and who can reach it — and until it does, nothing is being collected.
Two commitments I can make now, because they’re design decisions rather than open questions:
Passwords are never stored. If you give the app a password to open a protected statement, it’s used once to open that file and then discarded. The systems that store your information never receive it.
No one reads your individual entries. Your holdings aren’t reviewed, browsed or looked through by me or anyone working with me. If you ask for help with something and give permission, that’s the only circumstance in which a person looks at your information, and only for as long as it takes.
Sensitive information
Kenyan law treats some information as sensitive, and that includes property details. Because The Full Picture is about everything you own, some of what you tell me — whether you own land or property, and eventually what it’s worth — falls into that category.
I rely on your consent for this, and only your consent. You can withdraw it at any time by emailing me. Withdrawing doesn’t undo what was lawfully done beforehand, but it stops anything further and I’ll delete what I hold.
Who else can see your information
I do not sell your information. I do not share it with fund managers, banks, brokers, insurers, or anyone else who might want to sell you something.
A small number of service providers process information on my behalf, under contract and only on my instructions:
- Tally — hosts the waitlist form and stores responses
- Google — email and documents
- Substack — the newsletter, if you subscribe
- Host Africa — hosts this site
I’ll add the app’s providers to this list before it launches. I may also disclose information where the law requires it.
Keeping things separate
I’m an independent financial adviser, and that’s a different business with its own records and its own terms.
Joining the waitlist, subscribing to the newsletter or using The Full Picture does not make you an advisory client, does not put you on a prospect list, and will not be used to market advisory services to you. Information from these products is kept apart from my advisory client records.
Understanding the market
I may use information about what people hold in aggregated and statistical form — for example, which kinds of products are commonly held and how those choices are spread — to understand what’s missing from the market and what should be built.
Three limits on that, which I’ll hold to:
- Direct identifiers are removed first. Nothing produced this way names you or points to you.
- Only group figures are ever produced or used, never individual records.
- No figure is ever produced from a group small enough to identify someone within it. Kenya’s market is small, and a combination of unusual details can identify a person even without a name — so a minimum group size applies.
This is never sold. Your individual information is never shown to anyone outside the service providers listed above without your explicit permission.
Where your information is held
Some of the services above store information outside Kenya, including in the European Union and the United States. Where sensitive information is transferred outside Kenya, I do so on the basis of your consent and only with providers who apply recognised protections.
How long I keep it
- Waitlist — until The Full Picture launches and for [ 12 ] months after, or until you ask me to delete it, whichever comes first
- Newsletter — until you unsubscribe
- Emails and enquiries — [ 24 ] months after our last exchange, unless there’s a reason to keep them longer
- Website logs — [ 12 ] months
- App — to be set out in section 6 before the app collects anything
Your rights
Under the Data Protection Act, 2019, you have the right to:
- be told how your information is being used — which is what this page is for
- get a copy of what I hold about you
- have anything inaccurate corrected
- have your information deleted
- object to how it’s used, or ask me to restrict it
- receive your information in a portable format and take it elsewhere
- withdraw your consent at any time
Email [ info(at)alistairgould.com ] to exercise any of these. I’ll respond within 30 days, at no charge.
If you’re unhappy with how I’ve handled something, you can complain to the Office of the Data Protection Commissioner at odpc.go.ke.
Keeping it safe
I use reasonable technical and organisational measures to protect your information, including encrypted storage and restricted access. No system is perfectly secure, but if a breach occurs that puts you at risk, I’ll notify you and the Office of the Data Protection Commissioner as the law requires.
Children
None of this is intended for anyone under 18, and I don’t knowingly collect information from children.
Changes
If this policy changes in a way that materially affects you, I’ll tell you by email rather than quietly updating this page.