Privacy Policy

Who we are and our role

SautiDesk provides customer service software for businesses in Kenya and the region. Our customers are businesses that use SautiDesk to handle calls, WhatsApp, SMS, email and web chat with their own customers.

For information about the people who use our website and sign in to the product, SautiDesk is the data controller. For the conversations and customer records a business handles inside SautiDesk, the business is the data controller and SautiDesk acts as its data processor, acting on that business's instructions.

Information we collect

We collect the following kinds of information.

• Account information. Your name, work email address, phone number, business name, role and the settings you choose when you sign up or are invited to a workspace.
• Billing information. Plan, invoicing details and payment status. Card and mobile money details are handled by our payment partners and are not stored by us in full.
• Customer conversation data. Messages, call records, recordings or transcripts where enabled, attachments, contact details and notes that a business and its customers create while using SautiDesk.
• Usage information. How you use our website and the product, such as pages viewed, screens opened, features used, device and browser type, approximate location and log data. See "Analytics and session recordings" below.
• Messages to us. What you send when you contact support or fill in a form on our website.

How we use information

We use personal data to:

• provide, run and support SautiDesk, including routing conversations to the right person;
• create and manage accounts, bill for plans and send service notices;
• keep the service secure, prevent abuse and fix problems;
• understand how the product is used so we can improve it;
• respond to your questions and, where you agree, send product news you can opt out of at any time; and
• meet our legal obligations.

We process customer conversation data only to deliver the service to the business that owns it. We do not sell personal data, and we do not use a business's customer conversations to advertise to anyone.

Why we are allowed to use it

We rely on the following grounds: performing our contract with you or your business, our legitimate interests in running and improving a secure service, your consent where we ask for it (for example, optional marketing), and compliance with the law. Where a business is the controller of customer conversation data, that business is responsible for having a lawful basis and for telling its own customers how their data is handled.

Who we share it with

We share personal data only as needed to run SautiDesk:

• Service providers that help us deliver the service, such as hosting, messaging and call connectivity, email delivery, payments, analytics (Google Analytics), session recording (Microsoft Clarity) and customer support tools. They may only use the data to provide their service to us and are bound by confidentiality and data protection obligations.
• Your business and its team members, according to the permissions set in your workspace.
• Authorities, where the law requires it or to protect rights, safety and security.
• A successor, if SautiDesk is involved in a merger, acquisition or sale of assets, with notice to you.

International transfers

Some of our service providers may process data outside Kenya. When that happens, we take steps to make sure the data stays protected and that the transfer is consistent with the Kenya Data Protection Act, 2019 and related regulations.

How long we keep data

We keep account information while your account is active and for a reasonable period afterwards to meet legal, tax and dispute-resolution needs. Customer conversation data is stored for as long as the business that owns it uses SautiDesk, or as set by the retention settings it chooses.

When a business closes its workspace, we delete or anonymise its data within a reasonable period, except where we must keep certain records by law. Backups are overwritten on a regular cycle.

How we protect data

We use technical and organisational measures designed to protect personal data, including encryption of data in transit, access controls based on role, and restricted internal access. No system is completely secure, so we also ask you to use strong passwords and to keep your sign-in details private. If a breach affects your personal data, we will notify the people and authorities we are required to notify, within the time the law sets.

Your rights

Under the Kenya Data Protection Act, 2019 you have the right to:

• be told how your personal data is used;
• access the personal data we hold about you;
• object to certain uses, including direct marketing;
• ask us to correct data that is wrong or out of date;
• ask us to delete data we no longer need; and
• receive a copy of your data in a portable format where it applies.

If your data sits in a business's SautiDesk workspace, for example because you called or messaged that business, please contact the business first, because it controls that data. We will help it respond to your request. You can also lodge a complaint with the Office of the Data Protection Commissioner in Kenya.

Cookies and similar technologies

Our website and apps use cookies and similar tools to keep you signed in, remember your preferences and understand how the service is used. You can control cookies through your browser settings. Blocking some cookies may stop parts of the service from working properly.

Analytics and session recordings

On our websites. We use Google Analytics and Microsoft Clarity on sautidesk.com to understand how the site is used. Google Analytics counts visits and pages. Clarity records screen sessions and builds heatmaps, so we can see where visitors click, scroll or get stuck.

Inside SautiDesk. When you use the SautiDesk console and admin, we record product usage events and send them to Google Analytics. These include which screen you opened, which buttons you used, and actions such as a ticket being created, assigned or transferred. We count notes and messages, and these events never include what they say. Each event carries a pseudonymous identifier for you and an identifier for your workspace. These identifiers are random codes. They are not your name, email or phone number, but they can be linked back to you within our systems, so we treat them as personal data.

Session recordings in our apps. We also use Microsoft Clarity inside the SautiDesk console and admin. Clarity records what is shown on screen during a session, so session recordings may capture what is displayed, including customer and contact details such as names, phone numbers and message text. We use these recordings only to find and fix usability problems.

What our Google Analytics events never include. The usage events we send to Google Analytics do not include message contents, call audio, names, email addresses or phone numbers.

Why we do this. To understand which parts of SautiDesk are useful, find problems and improve the product. We do not sell this data.

How long we keep it. Google Analytics keeps event data for 2 months and user-level data for 14 months.

Your location. When you visit sautidesk.com, our server passes your IP address and browser details to Google so it can work out your approximate location.

Providers outside Kenya. Google and Microsoft may process this data outside Kenya. See "International transfers".

Your choices. To object to this use of your data, or to use any of your other rights, email privacy@sautidesk.com.

Children

SautiDesk is built for businesses and is not directed at children. We do not knowingly collect personal data from children through our own website or sign-up. If you believe a child has given us data, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. When we make a significant change, we will update the date at the top of this page and, where appropriate, tell account owners by email or in the product.

Contact us

For questions about this policy, or to use your rights under the Kenya Data Protection Act, 2019 (access, correction, deletion, objection, portability), email privacy@sautidesk.com. You can also reach us through our contact page, and you can complain to the Office of the Data Protection Commissioner of Kenya.