Privacy Policy

Who we are

Messo is an SMS workspace operated by Arumik Technologies. This policy explains how we handle personal data when you use messo.co.ke, the Messo app at app.messo.co.ke, payment and receipt pages at pay.messo.co.ke, or when you talk to us by phone, email, or WhatsApp.

For questions about this policy, a complaint, or a problem with your account, email [email protected]. For anything else, email [email protected] or call +254-706-318-783 or +254-783-181-403.

The short version

Businesses use Messo to send SMS, keep contacts, record payments and balances, and connect a Sender ID. We process account and billing data so we can run that service. When a business uploads contacts or sends messages, that business decides why the data is used. We process it on their instructions so the messages, receipts, and records can be delivered.

Information we collect

Depending on how you use Messo, we collect:

• Account details. Business or organisation name, industry, phone number, and email address when you register. We send a one-time code to verify the phone number and email. You may later add a contact name, address, recovery phone, recovery email, or profile image.
• Sign-in data. A token stored in your browser so you can stay signed in, and records of sign-in and verification attempts.
• Contacts and messages. Phone numbers, names, groups, message text, templates, and delivery results that a customer stores or sends through Messo.
• Payments and balances. M-Pesa top-ups for SMS credits, including the amount, the phone number used to pay, and the M-Pesa transaction code. If a business connects a Till or Paybill, we receive callback details such as the payer phone number, amount, account reference, and transaction code so we can send a receipt, update a balance, or award loyalty points.
• Payment links and receipts. If someone pays through a Messo payment link, we collect the phone number and amount they submit to start the M-Pesa prompt. A receipt page may show the payer name, phone number, amount, M-Pesa code, and the organisation that was paid.
• Sender ID documents. Registration or incorporation papers and authorisation letters a customer sends us so a mobile network can approve a Sender ID.
• Support messages. What you send us by email, phone, or WhatsApp.
• Technical data. Browser type, approximate location derived from an IP address, pages visited on our sites, and error logs. On messo.co.ke we also store your light or dark theme choice in the browser.

How we use information

We use personal data to:

• Create and secure accounts, including one-time verification codes.
• Send SMS across Safaricom, Airtel, Telkom, and Equitel, and show delivery history.
• Sell and track SMS credits, and apply the rate that matches a top-up.
• Send M-Pesa receipts, apply payments to recorded balances, and run loyalty points when a customer turns those features on.
• Review Sender ID applications and pass the required documents to the networks.
• Answer support requests and tell you about the service you are using.
• Protect Messo against fraud, abuse, and unauthorised access.
• Measure visits to our marketing site that come from our ads.
• Meet legal, tax, and accounting duties.

We do not sell personal data. We do not use a customer’s contact list to advertise other businesses.

Who we share it with

We share personal data only as far as we need to run Messo:

• Mobile networks and messaging providers receive the destination number, Sender ID, and message content so the SMS can be delivered.
• Safaricom (M-Pesa) processes credit top-ups and Till or Paybill payments. We receive the payment result from their callbacks.
• The business using Messo can see the contacts, messages, payments, and receipts in their own workspace.
• WhatsApp (Meta) carries messages when you contact us on WhatsApp.
• Google may receive a visit identifier when someone lands on messo.co.ke from our advertising, through the Google tag on that site.
• Infrastructure providers host the application, store backups, and send service email. They may only use the data to provide those services to us.
• Authorities when Kenyan law, a court, or a competent regulator requires it.

Customers, contacts, and people who receive SMS

If you received an SMS, a receipt, or a payment prompt from a school, church, landlord, shop, or other organisation using Messo, that organisation decided to contact you and is responsible for having a lawful reason to do so. Contact them first if you want to stop messages, correct a balance, or ask what they hold about you.

You can also write to [email protected]. Tell us the phone number that received the message and, if you have it, the Sender ID. We will help where we control the data, and we will point you to the business where they do.

Businesses that use Messo must only upload contacts and send messages when they have a lawful basis under the Data Protection Act, 2019, and must honour opt-out requests they receive.

Cookies and browser storage

Messo keeps a sign-in token in the browser so you do not have to log in on every visit. The marketing site stores your theme preference locally. We use a Google advertising tag on messo.co.ke, which may set a cookie to measure ad visits. You can block cookies in your browser. Blocking them does not stop you creating an account, but the site may forget your theme, and we will be less able to tell which ads were used.

How long we keep information

We keep account, message, and payment records for as long as the account is open, so the workspace history stays available. SMS credits themselves do not expire. After an account is closed, we delete or de-identify personal data within a reasonable time, except records we must keep for tax, accounting, fraud prevention, or a legal claim. Sender ID documents are kept while the Sender ID is active and for as long as the network or the law requires.

Security

We protect organisation data with access controls and encrypted transmission, including on M-Pesa callback webhooks. No online service is perfectly secure. Sign-in uses a one-time code sent to your phone and email, so keep those under your control, and tell us straight away at [email protected] if you think someone else has used your account.

Your rights

Under the Data Protection Act, 2019, you can ask us to confirm whether we hold your personal data, to give you a copy, to correct it, to delete it, or to stop a particular use, where the Act gives you that right. Email [email protected] with the phone number or email on the account. We may need to confirm it is you before we act.

We may refuse a request where the law requires us to keep the record, where another person’s rights are involved, or where the request is manifestly unfounded. If you are not satisfied, you can lodge a complaint with the Office of the Data Protection Commissioner in Kenya.

Children

Messo accounts are for businesses and organisations. Do not register if you are under 18. A school or other customer may include a learner’s name on a fee receipt or reminder. That customer is responsible for having a lawful basis to use a child’s information.

Where data is processed

We operate from Kenya and work with providers that may process data in other countries, for example to host the service or measure advertising. Where that happens, we take steps appropriate to the transfer, including contracts that limit how the provider may use the data.

Changes

If we change this policy, we will post the new version on this page and update the date at the top. Continued use of Messo after that date means the new policy applies.

Contact

Arumik Technologies
Customer care: [email protected]
General: [email protected]
Phone: +254-706-318-783
WhatsApp: +254-783-181-403