SalamaTalk Privacy Policy
Last updated: 7 October 2026
1. Data We Collect
Organization registration: Legal name, contact person, email, billing phone, company code prefix, password hash.
Billing: Payment gateway tokens (transaction references), plan selection, subscription dates.
Usage logs: Login timestamps, IP addresses, API calls (for security & abuse prevention).
Report metadata (NOT content): Tracking ID, category, priority, status, timestamps, escalation stage. Report content is encrypted and never accessible to SalamaTalk.
2. Data We Do NOT Collect
- Reporter identity (name, contact, IP) — reports are anonymous by design and the application does not store the reporter's IP address (infrastructure providers may transiently process IP addresses in security logs)
- Decrypted report content — split-knowledge encryption prevents this
- Biometric, location, or device fingerprinting data
3. How We Use Data
- Provide the reporting platform, billing, and support
- Security monitoring, fraud/abuse prevention
- Legal compliance (tax, audit, lawful requests)
- Product improvement (aggregated, anonymized metrics only)
4. Data Sharing
We do not sell personal data. We share only with:
- Payment processors (Paystack, SasaPay) for transactions
- Cloud infrastructure (Supabase/PostgreSQL) for encrypted storage
- AI drafting providers (Google, Groq, OpenRouter) — report content is sent to these APIs solely to draft acknowledgment and triage replies for your administrators, processed under each provider's API data policies
- Legal authorities when compelled by valid court order (we cannot decrypt reports)
5. Data Retention
- Organization account: retained while the account is active, and afterwards only as long as required for legal/tax obligations
- Encrypted reports: retained for the life of your organization's account; deleted on your organization's request or when the account is closed
- Usage logs: 12 months
- Closed accounts: core data purged within 30 days of a verified closure request (encrypted reports per your organization's instruction)
6. Your Rights
Under applicable law (Kenya Data Protection Act, GDPR where applicable), you may request: access, rectification, erasure, restriction, portability, or objection. Contact: privacy@safespeak.io
7. Security
AES-256-GCM encryption for reports with split-knowledge keys, TLS in transit, bcrypt password hashing, rate limiting, audit logging, account lockout, and continuous automated security testing.
8. International Transfers
Data is stored on Supabase (AWS EU-West-1) and the application is served from Render (US). Cross-border transfers are protected by standard contractual clauses or applicable adequacy decisions.
9. Children
Service is not directed to children under 18. We do not knowingly collect children's data.
10. Changes
30 days' notice via email/in-app. Continued use = acceptance.
11. Contact
DPO: privacy@safespeak.io | Legal: legal@safespeak.io