Legal
Privacy notice
Last updated: 12 October 2026
This notice explains how Sauti ("Sauti", "we") handles personal data. Sauti provides a campaign communication and operations platform to political campaigns and organisations in Kenya ("campaigns").
Two different roles
| Whose data | Our role | Who decides how it is used |
|---|---|---|
| Supporters and other people campaigns contact | Data processor | The campaign that contacted you is the data controller |
| Campaign staff accounts, website visitors, customers and our own suppliers | Data controller | Sauti |
If a campaign contacted you through Sauti, the campaign is responsible for having a lawful reason to do so. You can contact the campaign directly or contact us, and we will help.
If a campaign contacted you through Sauti
What we process on the campaign's behalf: your name, phone number and/or email or chat identifier, the area you are associated with (county to polling station), language preference, tags and custom fields the campaign uses, messages sent to and received from you, your opt-out choices, and, where the campaign uses them, survey answers, event attendance, donations and stated gender and age.
How we protect it: contact details are encrypted with a key unique to each campaign's organisation. Campaign staff only see masked values. Only isolated sending, calling and audited reveal services can decrypt them.
Your choices: reply STOP, ACHA or SITAKI to stop messages from that campaign. Report an unwanted message on our complaint page; a complaint stops messages to you from every campaign on Sauti.
What we never do: we do not sell personal data, we do not use it for our own marketing, and we do not profile or score you.
Data we control
- Campaign staff accounts: name, sign-in email or username, phone (optional), role, sign-in records and audit trail of actions.
- Customers: organisation details, billing and payment records.
- Website visitors: basic technical logs needed to run and secure the website. We do not use advertising trackers.
We use this data to provide and secure the service, meet legal obligations (including tax and campaign-finance record keeping) and communicate with customers.
Where data is stored
Personal data is hosted with reputable cloud and data-centre providers, with encrypted backups. Where data is stored or processed outside Kenya, we do so only as the Data Protection Act, 2019 allows, with appropriate safeguards in place.
How long we keep it
Supporter records are deleted or anonymised 90 days after the campaign ends, unless a longer period is documented and lawful. Message logs are kept for 12 months after the campaign ends, consent and opt-out records for 5 years, audit logs for 5 years and financial records for 7 years. One-way suppression hashes are kept indefinitely so that opt-outs keep being honoured.
Your rights
Under the Data Protection Act, 2019 you may request access to your personal data, correction, deletion, or object to its processing, among other rights. Contact us at privacy@sauti.cloud. We will verify your identity and respond within the legal time limits. You may also complain to the Office of the Data Protection Commissioner.
Security incidents
If a breach affects personal data, we notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, notify affected campaigns, and notify affected people where required.
Contact
Privacy questions: privacy@sauti.cloud. General enquiries: hello@sauti.cloud.
We may update this notice; the date above shows the latest version.