Privacy Policy

1. Introduction

This Privacy Policy explains how Alxtexh Enterprise ("CommsGrid", "we", "us") collects, uses, stores and protects information when you use our SMS API, WhatsApp messaging, Android SMS gateway, and related dashboard and API services (the "Service").

By creating an account or using the Service, you agree to the collection and use of information as described here. If you do not agree, please do not use the Service.

2. Information We Collect

Account information: your name, email address, phone number, business/organisation name, and password (stored hashed, never in plain text).

Message data: the phone numbers you send to, message content, delivery status, timestamps, and channel (SMS, WhatsApp, Android gateway) for every message sent through your account - this is the data the Service exists to process, and it passes through our infrastructure and our carrier/API partners to be delivered.

Device and gateway data: for the Android SMS Gateway, the paired device’s identifier, connection status, battery level, and the SIM/number used for sending.

Payment data: when you buy SMS credits or device seats via M-Pesa, we receive and store the transaction reference, amount, and phone number used - we do not receive or store your M-Pesa PIN or full payment card details, since Safaricom/M-Pesa processes the payment directly.

API keys and integration data: keys you generate to access our API, and technical logs of API requests (endpoint, timestamp, response status) for debugging and abuse prevention.

Usage and log data: IP address, browser/device type, pages visited, and actions taken in the dashboard, collected automatically for security and to improve the Service.

3. Legal Basis for Processing

Under Kenya’s Data Protection Act, 2019, we only process your personal data where we have a lawful basis to do so: your consent (given when you create an account or send a message through the Service), performance of our contract with you (delivering the Service you’ve signed up for), or compliance with a legal obligation (such as a lawful request from a Kenyan regulator).

Account information (name, email, phone number) is mandatory - without it we cannot create your account or deliver messages on your behalf. Optional information, where collected, is clearly marked as such at the point of collection. Where processing is based on consent, you may withdraw that consent at any time by closing your account or contacting us, without affecting the lawfulness of processing carried out before withdrawal.

4. How We Use Your Information

• To deliver the messages you send through the Service, via Safaricom, Airtel, Telkom, Meta’s WhatsApp Cloud API, or your own paired Android device.
• To operate your account: authentication, billing, credit balance, and sender ID applications.
• To provide delivery reports and analytics inside your dashboard.
• To detect and prevent fraud, spam, and abuse of the Service.
• To communicate with you about your account, service changes, or support requests.
• To comply with legal obligations, including requests from Kenyan telecom regulators or law enforcement where legally required.

5. How We Share Information

We share the minimum necessary information with the following categories of third parties, only as needed to deliver the Service:

• Telecom carriers (Safaricom, Airtel, Telkom) and messaging platforms (Meta, for WhatsApp Business API) - to actually route and deliver your messages.
• Payment processors (Safaricom M-Pesa) - to process credit and device-seat purchases.
• Infrastructure providers (hosting, database, and email/SMS delivery infrastructure) that we use to run the Service, bound by confidentiality obligations.
• Law enforcement or regulators, only where required by Kenyan law or a valid legal process.

6. We Do Not Sell Your Data

We do not sell, rent, or trade your personal information or your message content to third parties for their own marketing purposes.

7. Data Retention

We keep data only as long as it is needed for the purpose it was collected for:

• Message content: retained only for as long as needed to deliver the message and generate delivery reports, then removed - not kept indefinitely.
• Message metadata (recipient, status, timestamp): retained for up to 13 months while your account is active, so you can review delivery history and reports, then periodically purged.
• Account and billing data: retained for as long as your account is active, and for up to 60 days after account closure to resolve billing disputes and meet tax/financial record-keeping obligations under Kenyan law.
• API request logs: retained for up to 90 days for debugging and abuse prevention, then deleted.

You may request earlier deletion of your account and associated data at any time by contacting us - see Section 14. Some data may be retained longer where required by Kenyan law (for example, financial records) or to resolve an active dispute.

8. Data Security

We use industry-standard measures to protect your information, including encryption in transit (TLS), hashed passwords, and access controls limiting who inside CommsGrid can view account and message data. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. International Data Transfers

Your data is primarily stored and processed on servers located in, or serving, Kenya. Where a channel you use requires it - for example, WhatsApp messages routed through Meta’s WhatsApp Cloud API - a limited set of data (message content and recipient number) is transferred to and processed by Meta Platforms, Inc. under its own privacy terms.

Where personal data is transferred outside Kenya, we take steps consistent with the Data Protection Act, 2019 to ensure it receives an adequate level of protection, including relying on the receiving party’s own data protection commitments and, where applicable, standard contractual safeguards.

10. Your Rights Under Kenyan Law

As a data controller and processor, we handle your personal data in accordance with the Data Protection Act, 2019. Under the Act, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your data, subject to legal retention requirements.
• Object to, or restrict, certain processing of your data.
• Request a copy of your data in a portable, machine-readable format.
• Withdraw consent at any time, for processing that relies on consent.
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya, either directly or after raising it with us first.

To exercise any of these rights, contact us using the details in Section 14. We aim to respond to all data rights requests within a reasonable time, and in any event within 30 days. If you are not satisfied with our response, you may lodge a complaint with the ODPC at complaints@odpc.go.ke or through odpc.go.ke.

11. Cookies

We use essential cookies to keep you signed in and remember your theme preference. We do not use third-party advertising or tracking cookies.

12. Children’s Privacy

The Service is intended for businesses and individuals aged 18 and over. We do not knowingly collect information from children.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated "Last updated" date.

14. Contact Us

For any questions about this Privacy Policy or to exercise your data rights, contact us at support@paygrid.co.ke, via WhatsApp at +254 708 588 464, or at our office: Technology Park, Nairobi, Kenya.

Office of the Data Protection Commissioner (ODPC), Kenya - the independent regulator for data protection complaints: complaints@odpc.go.ke, odpc.go.ke.