Privacy policy

Who we are

Tumatext Limited (“Tumatext”, “we”) is a Kenyan software company. We run this website and three products: TumaEmail, TumaChat and TumaInvite. We follow Kenya’s Data Protection Act, 2019 and, where it applies to people in the European Union, the General Data Protection Regulation (GDPR).

Questions or requests about your personal data: [email protected], +254 185 087 294, or Delta Riverside Office Park, Block 2, 3rd Floor, Riverside Drive, Nairobi, Kenya.

This website

• No cookies, no analytics, no advertising. The site loads nothing from other companies: no tracking scripts, no web fonts, no embedded content.
• One setting in your browser. If you choose light or dark with the switch at the foot of the page, your choice is kept in your own browser (local storage) so the next page looks the same. It never reaches us.
• Server logs. Like every web server, ours records each request — the page, the time, your IP address and your browser’s name — to keep the site running and secure. These logs are kept for a short time and used for nothing else.
• If you write to us. When you email, call or message us, we use what you send only to answer you and, if you become a client, to serve you.
• The contact form. Your name, email address and message are sent to us by email (through Amazon SES) and go to our inbox; the website itself keeps no copy, and its logs never record what you wrote.

Our products: whose data it is

Our clients — businesses and organisations — use our products to email their contacts, talk to their customers on WhatsApp and Telegram, and invite guests to their events. The contacts, customers and guests are our clients’: each client decides whom it contacts and why, and is the data controller for them. We are the data processor: we hold and handle that data only to provide the product, on the client’s instructions, and never use it for our own purposes, sell it or show it to other clients.

For the people who sign in to our products (our clients’ users), and for visitors to this site, we are the data controller.

If you received an email, a message or an invitation from one of our clients, the quickest way to exercise your rights is to ask that client. You can also ask us, and we will pass your request on and help them answer it.

What the products keep

• Our clients’ users: name, email address and mobile number, a password stored only as a one-way hash, their two-step verification settings, and a record of what each user did, with the IP address and browser it was done from, so that every change can be traced.
• TumaEmail: each client’s contacts (email address, names and any fields the client adds), their lists, the emails sent, and for each email what happened to it: delivered, bounced, complained, unsubscribed, opened or clicked (see open and click tracking).
• TumaChat: the WhatsApp or Telegram conversations between a client and its customers — the phone number or Telegram account, the profile name, and the messages, pictures, files and locations they exchange — so the client’s team can answer them.
• TumaInvite: the guests a client invites — names, mobile numbers and email addresses — their answers (RSVPs), and whether they asked not to be contacted again.

None of our products takes or keeps card or other payment details.

Email open and click tracking (TumaEmail)

TumaEmail tells our clients how their emails did: how many were delivered, opened and clicked. Like most email platforms, it does this as follows.

• Opens: each email carries a tiny invisible image. When your email program shows the pictures in the email, it fetches that image, and the email is counted as opened. Many email programs fetch pictures automatically, or block them, so opens are an estimate.
• Clicks: the links in an email pass through a tracking address first, which records the click and then takes you straight to the page the link names.
• Who does it: both are done by Amazon Web Services’ email service (Amazon SES), which sends the emails for us, and reported back to TumaEmail.

What is recorded for an open or a click: which email it was, the time, for a click the link, and the country it came from. The country is looked up on our own server from the IP address that Amazon reports; the IP address itself is not stored, and nor is your device or email program.

What it is used for: only the sending client’s reports — which campaigns were read, which links were followed, and the countries emails were opened in. It is not used to build profiles, combined with other clients’ data or shared with anyone else.

Your choices:

• Every email has an unsubscribe link (and the one-click unsubscribe that email programs show). Unsubscribing stops that sender’s emails to you, and is kept even if your contact details are later deleted, so that you are not emailed again by mistake.
• Turning off pictures in your email program stops opens being recorded. Clicks are recorded whenever a link is followed.
• To have your tracking records or your contact details deleted, ask the sender, or write to us at [email protected].

The sender’s responsibility: each client chooses whom it emails and must have a lawful basis for it under the law that applies to its recipients — such as consent where the law requires it, including for tracking under the EU’s ePrivacy rules — and must explain this to them. Our terms of use require it.

Why we use it

• To provide the products our clients have asked for (our contract with them), and to carry out their instructions for their contacts, customers and guests.
• To keep the products secure and working: sign-in protection, audit trails, error records (our legitimate interest in running a safe service).
• To answer you when you contact us, and to meet our legal obligations.

We do not sell personal data, and do not use it for advertising.

Who else handles it

We use a small number of service providers, each only for the part of the service it provides:

• DigitalOcean — the servers and databases the products run on.
• Amazon Web Services (Amazon SES and SNS) — sending emails, and reporting what happened to them.
• Meta (WhatsApp Business Platform) and Telegram — carrying TumaChat and TumaInvite messages, under their own terms and privacy policies.
• Anthropic — in some products, an AI check of a message template or a photo a user chooses to read; it is sent only what that check needs.
• Let’s Encrypt — the certificates that secure every connection.

We may also disclose personal data where the law requires it.

Where it is kept

Our servers and databases are hosted by DigitalOcean in New York, in the United States, and emails are sent through Amazon Web Services. This means personal data is transferred outside Kenya. We do this with providers that protect it with strong safeguards (encrypted connections, access control, and their own data protection commitments), as Kenya’s Data Protection Act and the GDPR require.

How long we keep it

• Client data (contacts, conversations, guests, email records) is kept while the client’s account is active, and clients can delete it in the product at any time. TumaChat conversations are set to be kept for 12 months.
• Unsubscribes and opt-outs are kept as long as the sender’s account, so the choice is respected.
• Server and application logs are kept for 14 days.
• Backups are replaced on a rolling basis: the most recent ones are kept, older ones deleted.
• Audit trails of what users did in an account are kept with the account.

How we protect it

• Every connection is encrypted (HTTPS); the databases are reached only over encrypted connections.
• Every user can protect their sign-in with two-step verification (an authenticator app, or codes by email). Passwords, and the tokens that keep you signed in, are stored only as one-way hashes; keys and secrets are encrypted.
• Each client’s data is kept apart from every other client’s.
• The monitoring we use to keep the products running has personal details (names, addresses, numbers, message contents) removed before it is stored.
• Every release is tested before it reaches our clients, and the data is backed up before every change.

Your rights

Under Kenya’s Data Protection Act (and the GDPR where it applies) you have the right to:

• be told what personal data we hold about you, and get a copy;
• have it corrected, or deleted;
• object to its use, or ask for it to be restricted;
• take it elsewhere (data portability), where the law gives that right;
• withdraw consent you gave, at any time.

Write to [email protected]. We may ask you to confirm who you are. Where the data belongs to one of our clients, we pass the request to them and help them answer it. If you are not satisfied, you can complain to Kenya’s Office of the Data Protection Commissioner (odpc.go.ke), or in the EU, to your country’s data protection authority.

Changes to this policy

When what we collect or how we use it changes, we update this page and the date at the top. For a significant change, we tell our clients before it takes effect.