LEGAL / PRIVACY

Privacy Policy

Effective date: 27/09/2026

Last updated: 27/09/2026

Nexus WhatsApp Gateway ("we," "us," "the Platform") is operated by Zamvi Technologies Limited ("the Company"). This policy explains what information the Platform processes, why it is processed, and how to make a privacy request.

This policy covers two different kinds of people:

• Business users: owners, administrators, and members who register for or use a Business account, dashboard, API, or connected application.
• Business contacts and message recipients: people whose contact details or communications are submitted to, sent through, or received by the Platform. The Business that collected their information generally decides why it is used; Section 4 explains this relationship.

1. Information We Collect

1.1 Account and application information

When a Business signs up, we store its business name and the owner user's email address and password hash. We also process account roles, signup and account status, email-verification status, login timestamps, and the IP address recorded at login. A platform-managed billing application additionally collects the applicant's name, email, phone number, organization name, WhatsApp display name, country, business category, intended use, expected volume, and additional information the applicant submits.

1.2 Authentication and integration credentials

• Business and connected-application API keys are stored as one-way SHA-256 hashes with a searchable prefix. The full key is shown only at issuance or confirmation and cannot be retrieved from its hash.
• Dashboard sessions use a signed, httpOnly session cookie that expires after seven days. It is marked Secure in production and uses SameSite=Lax. The Platform does not currently use this cookie for advertising or cross-site tracking.
• For WhatsApp connections, we store the WABA ID, phone number ID, and Business Integration System User access token returned by Meta Embedded Signup. Self-managed businesses may also enter an existing token. The token is encrypted at rest using AES-256-GCM and is not returned to the dashboard.
• Webhook signing secrets are encrypted at rest. Email-verification and API-key confirmation tokens are stored as hashes; a newly generated API key awaiting confirmation is temporarily encrypted so it can be delivered.

1.3 Billing information

For Zamvi charges, we store wallet balances, transaction amounts, references, statuses, subscription details, and related billing records in KES. Paystack processes card and M-Pesa payments. When a user submits a Paystack authorization code for a card payment or subscription, the application forwards it to Paystack to initiate the charge; the code is not intentionally stored in our database. We do not receive or store full card numbers or M-Pesa PINs. Meta separately handles WhatsApp delivery billing on the Business's WABA; payment details for that billing are not entered into the Platform.

1.4 Business contacts and message data

When a Business uses the Platform, we process information it submits or that providers return, including:

• Contact phone numbers, optional display names and metadata, opt-in/opt-out status and timestamps, the consent source recorded by the Business, and the time of the most recent inbound message.
• Inbound and outbound message text, phone numbers, message type, template and variable data, timestamps, provider message IDs, delivery/read/failure status, and provider error information.
• Templates and their names, language, category, content, components, approval status, and submission errors.
• Campaign names, channel, message content, selected recipients, template variables, progress, delivery state, and campaign error information.
• Media identifiers, content types, sizes, and temporary storage URLs. Media files are held in a private Supabase Storage bucket only to support WhatsApp processing and are exposed through signed download URLs that expire after 24 hours. Outbound media copies are scheduled for deletion once 72 hours have elapsed after registration with Meta by default; inbound media copies are scheduled after 14 days. Cleanup runs periodically, so object removal may occur shortly after the configured threshold. Message records retain the message type, MIME type, size, and provider media ID after the stored file is deleted. Connected applications should download inbound media promptly and retain their own copy for long-term access.

We do not independently verify that a contact actually consented. The Platform checks that a contact is recorded as opted in before an outbound send, but the Business is responsible for that record and its evidence.

1.5 Activity, technical, and diagnostic data

We store audit and integration-health events such as message queued/sent/delivered/failed, connection failures, webhook delivery outcomes, billing adjustments, and campaign events. Depending on the event, these records may include business and contact identifiers, recipient numbers, provider message IDs, timestamps, failure details, or administrative notes. Application and hosting logs may include IP addresses, request metadata, errors, and portions of queued job data; queued message data can include recipient numbers and message content. Redis is used for rate limits and short-lived webhook deduplication records. No separate advertising analytics or cross-site tracking service is implemented in the current application.

2. How We Use Information

• Create and secure accounts, authenticate dashboard and API access, verify email addresses, and issue and manage API keys.
• Store contacts, templates, campaigns, media, and message records; queue sends; communicate with Meta and Africa's Talking; process provider webhooks; and deliver events to applications a Business has connected.
• Apply opt-in, opt-out, WhatsApp customer-service-window, rate-limit, wallet, and payment checks implemented by the Platform.
• Process Zamvi subscription and wallet payments, reconcile provider confirmations, and send account, security, application, payment, and operational emails.
• Maintain audit trails, diagnose delivery and integration failures, protect the service, respond to support requests, and meet legal obligations.

We do not sell personal information or use message content to serve advertising. We use email for service communications such as verification, welcome messages, security alerts, payment notices, account updates, and application messages.

3. Who We Share Information With

We disclose information to service providers as needed to operate the Platform, to recipients a Business chooses, or as required for safety, legal, or business operations. Depending on the feature used, recipients include:

Meta and Africa's Talking process data under their own terms and privacy notices. A Business is responsible for webhook destinations it configures and for providing any notices or permissions required before those destinations receive personal data. We do not share personal information with providers for their independent marketing purposes.

4. If You Are an End Customer of One of Our Business Users

If a Business uses Nexus WhatsApp Gateway to message you, the Business generally decides why your information is collected and how it is used. For that contact and message processing, the Business is generally the data controller and we process information to provide the Platform on its instructions. The Company separately acts as a controller for its own account, security, and billing records. The exact legal roles depend on the processing and applicable law.

• The Business is responsible for having a lawful basis and your genuine consent before messaging you.
• Requests to access, correct, delete, or object to processing of information collected by a Business, or to withdraw consent, should generally be directed to that Business. If you contact us, we may need to identify and involve the relevant Business to respond.
• The Platform blocks outbound sends when the contact is not recorded as opted in and automatically records supported inbound opt-out keywords, including STOP-style words. A Business remains responsible for honoring all opt-outs and requests the software does not automatically recognize.
• Meta and Africa's Talking may also process message information under their own terms. Contact the Business and, where appropriate, the relevant provider about its independent processing.

5. International Data Transfers

Our application and providers may store or process personal information in Kenya or other countries, depending on the deployment and each provider's service configuration. Cross-border processing may be subject to Kenya's Data Protection Act, 2019 and other applicable law.

6. Data Retention

The gateway's private media bucket has automatic deletion windows: outbound stored copies are scheduled for deletion once 72 hours have elapsed after Meta registration by default, and inbound stored copies after 14 days. The cleanup job runs periodically, so object removal may occur shortly after the configured threshold. These windows can be configured by the service operator. Signed media download URLs expire after 24 hours. After object deletion, the associated Message record retains message type, MIME type, size, Meta media ID, and a media-expired timestamp; its media URL is cleared. Connected applications are responsible for retaining their own downloaded media copies. These media windows do not apply to Business accounts, contacts, messages, templates, campaigns, billing records, audit records, provider logs, backups, or queued jobs, which may have separate retention periods or provider settings. Redis webhook-deduplication keys expire after 24 hours.

You may contact us to request account closure or deletion. There is no self-service Business-account deletion control in the current application. We will verify and assess a request, including legal obligations, the Business's responsibilities toward its contacts, records needed for billing/security/disputes, technical capability, and data held by providers or already delivered to connected applications.

7. Security

• Passwords and API keys are stored as one-way hashes. Meta access tokens and connected-app webhook secrets are encrypted at rest using AES-256-GCM.
• Dashboard sessions are signed, use an httpOnly cookie, and expire after seven days. API and administrative actions require the applicable session or API key and role.
• Provider API calls and registered outbound webhooks use HTTPS. Meta webhook requests are checked using Meta's signature. Africa's Talking callbacks use a configured shared query-string secret because that integration does not receive a signed-payload header.
• Access controls, tenant scoping, validation, audit events, and delivery safeguards are used as part of the application. No method of transmission or storage is completely secure.

We cannot guarantee absolute security. If we become aware of a personal-data breach, we will assess and respond to it and provide notifications to affected people or regulators where required by applicable law.

8. Your Rights

Subject to applicable law, including Kenya's Data Protection Act, 2019, individuals may have the right to:

• Be informed about and access personal information.
• Request correction or deletion, subject to applicable exceptions.
• Object to or request restriction of certain processing and, where applicable, withdraw consent.
• Complain to Kenya's Office of the Data Protection Commissioner or another competent authority.

For information processed on behalf of a Business, contact that Business first. For account information we control or to contact us about a request, use Section 11. We may ask for information needed to verify identity and route the request correctly.

9. Children's Privacy

The Platform is intended for business use and is not designed for children to hold accounts. Businesses must not use it to process children's information unless they have a lawful basis and have met applicable notice, consent, and safeguarding requirements. We do not knowingly invite children to create accounts.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date above, and for material changes, we will make reasonable efforts to notify active Business accounts.

11. Contact Us

For privacy questions, account-data requests, or to contact the Company, use the following details:

Email: [email protected]
WhatsApp: +254718131239
Address: Nairobi, Kenya