1. Information we collect
We collect the following types of information:
- Account information: your name, business name, email address, phone number and password when you create a workspace or join a team.
- Customer data you manage: contacts, messages, emails, SMS, tickets, orders, files and notes exchanged through chat.or.ke.
- Usage and device data: pages visited, features used, IP address, browser type and logs that help us run and secure the service.
- Billing information: your wallet balance, invoices and M-Pesa payment details such as phone number and receipt number.
- Enquiries: details you send through our contact form or by email.
2. How we use information
We use personal data to:
- provide, maintain and improve chat.or.ke, including delivering your WhatsApp, email and SMS messages;
- secure accounts, prevent abuse and investigate incidents;
- bill you and send account, service and security notices;
- respond to enquiries and provide support;
- send product news where you have agreed to receive it, with an easy way to opt out.
3. Your customers' data
When you use chat.or.ke to communicate with your own customers, you are the data controller for their personal data and chat.or.ke acts as your data processor. We process that data only on your instructions and to provide the service.
You are responsible for having a lawful basis to contact your customers, including consent for marketing messages, and for honouring opt-out requests. chat.or.ke includes opt-out and suppression tools to help you do this.
4. Facebook and Instagram
If you connect a Facebook Page or Instagram professional account, you sign in with Facebook and choose which Pages to connect. We then store, encrypted, an access token for each Page so we can receive and send its Messenger and Instagram messages and comments. We store your app-scoped Facebook user ID so we can act on Meta's deauthorization and data deletion requests. We never see your Facebook password.
Messages, comments and the sender's public name, username and profile picture are stored in your workspace's inbox like any other conversation, and are kept until you delete them or close your workspace. The raw notifications Meta sends us are deleted after 14 days.
You can disconnect a Page at any time from Channels, or remove our app in your Facebook settings. To delete the data we hold about your Facebook login, remove the app in Facebook (Settings → Business integrations) and choose to send a deletion request: we delete the access tokens and raw notifications for the Pages you connected and give you a confirmation code to check the status. A customer who wants their messages deleted should ask the business they messaged, which can delete the conversation or contact.
5. AI features
If you turn on AI features, relevant message content and your knowledge base are sent to our AI service providers to generate suggested or automatic replies. You can switch AI features off at any time.
6. Sharing information
We do not sell personal data. We only share it with:
- service providers that help us run chat.or.ke, such as Meta (WhatsApp Business Platform), SMS and email providers, hosting and AI providers;
- authorities, where the law requires it or to protect the rights and safety of our users and the public;
- a buyer or successor if chat.or.ke is involved in a merger or acquisition, in which case we will tell you.
7. International transfers
Some of our service providers process data outside Kenya. Where this happens, we take steps to make sure the data stays protected as required by the Data Protection Act, 2019.
8. How long we keep data
We keep account and customer data while your workspace is active. When you close your workspace we delete or anonymise your data within a reasonable period, except records we must keep by law, such as invoices.
9. Security
We protect data with encrypted connections, encrypted storage of sensitive credentials, role-based access controls and isolation between workspaces. No system is perfectly secure, so please use a strong password and keep it private.
10. Your rights
Under the Data Protection Act, 2019 you have the right to be informed about how your data is used, to access it, to have it corrected or deleted, to object to certain processing and to data portability.
To exercise these rights, contact us using the details below. If your data is held by a business that uses chat.or.ke, please contact that business first. You can also complain to the Office of the Data Protection Commissioner (ODPC).
11. Cookies
We use essential cookies to keep you signed in and to protect forms from abuse. We also use analytics cookies (Google Analytics) to understand how our website is used. You can block or delete cookies in your browser settings.
12. Changes to this policy
We may update this policy from time to time. When we do, we change the "last updated" date and notify workspace owners of significant changes.
13. Contact us
For privacy questions or requests, email us at hello@chat.or.ke.