Privacy Policy

This policy explains what personal data the Yangu platform collects, why, and the rights you have under the Kenya Data Protection Act, 2019. The data controller is [company name not configured], [company address not configured]. For contact-list data uploaded by a customer, that customer is the controller and we act as their processor.

Data we collect

• Visitor phone numbers — the MSISDN you enter on the demo (/try) or access-recovery (/access) forms, used to send the SMS you asked for. Demo submissions also store a hashed IP address and campaign-attribution parameters for rate-limiting and funnel reporting.
• Contact-list data — names and MSISDNs of message recipients uploaded by customers or operators, or pasted into a campaign.
• Message content and delivery records — the bodies sent through the rail and per-recipient delivery status.
• Payment data — the M-Pesa phone number, amount and transaction reference (M-Pesa receipt number) returned by Safaricom's Daraja confirmation callbacks. We never see your M-Pesa PIN.
• Opt-out records — suppressed MSISDNs, the source of the opt-out and the reason, kept so suppression is honoured.

How we use it

To deliver the SMS messages requested through the platform, run prepaid billing and issue receipts, enforce opt-outs, rate-limit the public demo and recovery pages, and provide support. We do not sell personal data and we do not use it for third-party advertising.

Who we share it with

SMS providers and mobile networks that carry the messages, Safaricom (M-Pesa/Daraja) for payment collection, and our hosting providers — only as needed to run the service. Phone numbers shown on public delivery-report pages are masked.

Retention

We keep account, message and payment records while an account is active and afterwards as required for tax, audit and dispute purposes. Opt-out records are retained so the suppression stays honoured.

Your rights

Under the Kenya Data Protection Act, 2019 you may request access to, correction or deletion of your personal data, object to or restrict its processing, and opt out of marketing messages — every campaign message carries a working opt-out link. To exercise any right, contact us at [contact email not configured]. You may also lodge a complaint with the Office of the Data Protection Commissioner.

Changes

We may re-issue this document; the version and effective date appear at the top of the page.