SalamaTalk Terms of Service

Last updated: 7 October 2026 · open full page

1. Service Description

SalamaTalk provides an anonymous, encrypted reporting channel for employees and stakeholders to submit workplace concerns. SalamaTalk is a technology platform only — it does not investigate, adjudicate, or guarantee any outcome regarding submitted reports.

2. No Legal Advice / No Attorney-Client Relationship

SalamaTalk is not a law firm and does not provide legal advice. Using SalamaTalk does not create an attorney-client relationship. Reports submitted through SalamaTalk are not privileged communications. For legal matters, consult a qualified attorney in your jurisdiction.

3. Anonymous Reporting & Encryption

Reports are encrypted with AES-256-GCM using split-knowledge keys. SalamaTalk cannot decrypt report content. Only your organization's authorized administrators (who hold the decryption keys) can view report content. SalamaTalk never stores plaintext report content on its own systems.

4. Your Responsibilities

• You must be 18 years or older to register an organization.
• You are responsible for compliance with all applicable laws in your jurisdiction (labor, privacy, whistleblower, data protection).
• You must designate and maintain authorized administrators who can access decrypted reports.
• You must not use SalamaTalk for fraudulent, defamatory, or malicious reports.
• You must keep your Company Code and administrator credentials confidential.

5. SalamaTalk's Responsibilities

• Provide the encrypted reporting platform with commercially reasonable uptime.
• Maintain encryption standards and security patches.
• Not access, sell, or share decrypted report content.
• Process personal data per the Privacy Policy.

6. Subscriptions & Payments

Plans are priced in Kenyan Shillings (KES) and billed in advance for the selected cycle. Payments are processed by our payment gateway (M-Pesa Daraja); its terms apply to each transaction. Subscriptions renew at the end of each paid cycle until cancelled. Failed or reversed payments may suspend the account after notice. Fees are exclusive of applicable taxes. Refunds are provided where required by law or at our reasonable discretion — contact legal@safespeak.io.

7. Disclaimer of Warranties

SalamaTalk is provided "AS IS" and "AS AVAILABLE" without warranties of any kind: express, implied, statutory, including merchantability, fitness for a particular purpose, non-infringement, or uninterrupted/error-free operation.

8. Limitation of Liability

To the maximum extent permitted by law, SalamaTalk and its affiliates shall not be liable for any indirect, incidental, special, consequential, or punitive damages, or any loss of profits, data, use, goodwill, or other intangible losses. Total liability shall not exceed the fees paid by you in the 12 months preceding the claim.

9. Indemnification

You agree to indemnify, defend, and hold harmless SalamaTalk from any claims, damages, losses, or expenses (including legal fees) arising from your use of the service, violation of these Terms, or violation of any law.

10. Termination

Either party may terminate this agreement with 30 days' written notice. SalamaTalk may suspend access immediately for non-payment, breach of Terms, or legal requirement. Upon termination, encrypted reports remain accessible to your administrators for 90 days.

11. Dispute Resolution & Governing Law

These Terms are governed by the laws of Kenya. Any dispute shall be resolved by binding arbitration in Nairobi under the Arbitration Act, 1995, in English. Each party bears its own costs; the loser pays the arbitrator's fees. Class actions and jury trials are waived.

12. Data Protection & Privacy

See our Privacy Policy for how we handle personal data (contact info, billing, usage logs). Report content is encrypted and not accessible to us.

13. Changes to Terms

We may update these Terms with 30 days' notice via email or in-app banner. Continued use constitutes acceptance.

14. Severability

If any provision is unenforceable, the remainder remains in effect.

15. Contact

Questions: legal@safespeak.io

SalamaTalk Privacy Policy

Last updated: 7 October 2026 · open full page

1. Data We Collect

Organization registration: Legal name, contact person, email, billing phone, company code prefix, password hash.

Billing: Payment gateway tokens (transaction references), plan selection, subscription dates.

Usage logs: Login timestamps, IP addresses, API calls (for security & abuse prevention).

Report metadata (NOT content): Tracking ID, category, priority, status, timestamps, escalation stage. Report content is encrypted and never accessible to SalamaTalk.

2. Data We Do NOT Collect

• Reporter identity (name, contact, IP) — reports are anonymous by design and the application does not store the reporter's IP address (infrastructure providers may transiently process IP addresses in security logs)
• Decrypted report content — split-knowledge encryption prevents this
• Biometric, location, or device fingerprinting data

3. How We Use Data

• Provide the reporting platform, billing, and support
• Security monitoring, fraud/abuse prevention
• Legal compliance (tax, audit, lawful requests)
• Product improvement (aggregated, anonymized metrics only)

4. Data Sharing

We do not sell personal data. We share only with:

• Payment processors (Paystack, SasaPay) for transactions
• Cloud infrastructure (Supabase/PostgreSQL) for encrypted storage
• AI drafting providers (Google, Groq, OpenRouter) — report content is sent to these APIs solely to draft acknowledgment and triage replies for your administrators, processed under each provider's API data policies
• Legal authorities when compelled by valid court order (we cannot decrypt reports)

5. Data Retention

• Organization account: retained while the account is active, and afterwards only as long as required for legal/tax obligations
• Encrypted reports: retained for the life of your organization's account; deleted on your organization's request or when the account is closed
• Usage logs: 12 months
• Closed accounts: core data purged within 30 days of a verified closure request (encrypted reports per your organization's instruction)

6. Your Rights

Under applicable law (Kenya Data Protection Act, GDPR where applicable), you may request: access, rectification, erasure, restriction, portability, or objection. Contact: privacy@safespeak.io

7. Security

AES-256-GCM encryption for reports with split-knowledge keys, TLS in transit, bcrypt password hashing, rate limiting, audit logging, account lockout, and continuous automated security testing.

8. International Transfers

Data is stored on Supabase (AWS EU-West-1) and the application is served from Render (US). Cross-border transfers are protected by standard contractual clauses or applicable adequacy decisions.

9. Children

Service is not directed to children under 18. We do not knowingly collect children's data.

10. Changes

30 days' notice via email/in-app. Continued use = acceptance.

11. Contact

DPO: privacy@safespeak.io | Legal: legal@safespeak.io