Privacy Policy
TumaChat for WhatsApp (wa.tumatext.co.ke) — last updated 20 October 2026
This policy explains what personal data Tumatext Limited (“Tumatext”, “we”) processes through TumaChat for WhatsApp, a business messaging platform built on the WhatsApp Business Platform (Cloud API) of Meta Platforms, Inc., why we process it, who receives it, how long we keep it and how you can have it deleted.
1. Who we are
Tumatext Limited, a company registered in Kenya, runs TumaChat for WhatsApp. For anything about this policy or your data, write to [email protected].
We act in two roles:
- as a data processor for the businesses that use our platform (our “clients”, such as event organisers): we send and receive WhatsApp messages on their WhatsApp numbers, on their instructions;
- as a data controller for the accounts of the people who sign in to our dashboard, and for the security of the platform.
If a business messaged you through our platform, that business is responsible for having your number and for messaging you. You can contact it, or us, about your data.
2. What data we process
| Whose | What | Where it comes from |
|---|---|---|
| People who message, or are messaged by, our clients on WhatsApp | WhatsApp number and profile name; the content of messages both ways (text, images, video, audio, documents, locations, contacts, reactions, button replies such as “Attending” / “Not attending”); message ids, times and delivery and read statuses; for invitations, the details the client supplied (such as name, event, date and venue) and the answer given | The client (the guest's number and invitation details), the person themselves (their messages) and Meta (the WhatsApp webhook: profile name, statuses) |
| Our clients' WhatsApp Business accounts | WhatsApp Business Account and phone number ids, display number and verified name, quality rating, message templates and their approval status, and the access token and app secret used to reach Meta's API | The client and Meta |
| Dashboard users (our staff and our clients' admins) | Name, username, email address, a hashed password, two-step verification settings, sign-in sessions and the IP addresses and times of requests | The user and their browser |
We do not collect payment details, and we do not use cookies or trackers for advertising.
3. Why we process it
- To send the messages our clients ask us to send (such as event invitations) and the replies to messages people send them, through the WhatsApp Business Platform.
- To show each client a log of the conversations on their own number, with delivery and read statuses.
- To pass a guest's answer to an invitation back to the client's own system.
- To create and manage our clients' message templates and to keep their WhatsApp numbers connected.
- To keep the platform secure, to prevent abuse and to fix faults.
We process the data to perform our contract with our clients and on their instructions, and in our legitimate interest in a secure service. We do not sell personal data, use it for advertising or profiling, or use WhatsApp data for any purpose other than providing the service to the client it belongs to.
4. Who receives it
- The client business the conversation belongs to: each client's admin sees only their own number's messages.
- Meta Platforms / WhatsApp, which delivers the messages. Meta's own handling is described in the WhatsApp Business Policy and WhatsApp Privacy Policy.
- Our service providers, under contract and only to provide the service: DigitalOcean, LLC (servers and managed database) and Amazon Web Services (sending email to dashboard users, such as sign-in codes; no WhatsApp content).
- Authorities, only when Kenyan law requires it; we check that each request is lawful and disclose no more than it requires.
5. Where it is stored and how it is protected
The platform and its database run in DigitalOcean's New York data centre (NYC3, United States). Data sent outside Kenya is protected by our providers' contractual and security commitments, as the Data Protection Act, 2019 requires.
All connections are encrypted (TLS), including those to the database. Access tokens and app secrets are encrypted at rest (AES-256-GCM). Passwords are hashed, sessions and API keys are stored only as hashes, two-step verification is available, and every request is checked so that each client can reach only its own data. Every webhook from Meta is checked against the sending app's signature.
6. How long we keep it
- Messages, media, delivery statuses and invitations: 12 months from when they were sent or received, after which they are deleted automatically. A contact (number and profile name) is deleted once nothing of theirs is left.
- Request and application logs: up to 14 days.
- Database backups: overwritten in the normal course, within weeks.
- Client and dashboard user accounts: while the client uses the service; deleted on request when it ends.
7. Your rights, and how to have your data deleted
Under Kenya's Data Protection Act, 2019 (and the GDPR, where it applies) you may ask to see the personal data we hold about you, to have it corrected or deleted, to object to or restrict its processing, and to receive a copy.
To have your data deleted, follow the steps on our data deletion page, or write to [email protected] from, or naming, the WhatsApp number concerned. We reply within 7 days and complete deletion within 30 days. Deleting your data on our platform does not delete messages already delivered to your phone, or what Meta keeps under its own policies.
You can also stop all messages from a business by blocking its number in WhatsApp.
If you are not satisfied with our answer, you may complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).
8. Children
The platform is for businesses. We do not knowingly collect data about children under 13 other than as a recipient a client has chosen to message.
9. Changes
We will post any change to this policy on this page, with a new date at the top. The use of the service itself is governed by our Terms of Service.