Privacy Policy · SwalaSMS

Last updated: 6 September 2026
Version: 2026-09-06

This policy explains how SwalaSMS (“we”, “us”) handles personal data when you use our website, our web portal, our mobile app and our SMS API (together, the “Service”). It applies to everyone who holds a SwalaSMS account and to the people whose numbers our customers message.

Who is responsible

SwalaSMS is the data controller for account data, meaning the information you give us to open and run an account.

For the contact lists and message content you upload, you are the controller and we are your processor: they are your data, we hold and transmit them on your instructions, and we do not decide what you send or who you send it to.

As controller, the legal duties owed to your recipients are yours, not ours. You are responsible for having a lawful basis to hold and message every number you upload, for obtaining and being able to evidence consent, for giving recipients the notice the law requires, and for answering any request or complaint they make about your messages. We act only on your instructions, and we are not liable for your failure to meet those duties. If a recipient contacts us about messages you sent, we will refer them to you and may pass on your account contact details for that purpose.

We process personal data in line with the Personal Data Protection Act and the other laws of the United Republic of Tanzania that apply to us as a communications provider.

What we collect

Account data

Your name, business name, email address, phone number and country.
Your password, stored only as a one-way hash, which we cannot read.
Sign-in activity: date, time, IP address, device and browser, so you can spot a session you do not recognise.
Billing records: credit purchases, payment references and invoices.

Data you upload

Contacts: names, phone numbers, and any optional fields you add such as email address, company or a date used by an automation.
Message content, sender IDs, schedules and campaign names.
Delivery reports returned by the mobile operators, including the delivery status and time for each message.

Technical data

Server logs of API requests: endpoint, status, timestamp and the account that made the call.
Cookies strictly necessary to keep you signed in and to protect forms from abuse. We do not use advertising cookies.

Google user data

Importing contacts from Google is optional. Nothing below happens unless you choose Import from Google Contacts and approve the request on Google's own screen.

What we ask for

We request one Google permission: https://www.googleapis.com/auth/contacts.readonly. It allows us to read your Google contacts and nothing else. We cannot create, change or delete anything in your Google account, and we do not request access to Gmail, Drive, Calendar or any other Google service.

What we do with it

We read your contacts' names, phone numbers, email addresses and organisation, and show them to you so you can choose which ones to import.
Only the contacts you select are copied into the SwalaSMS contact group you choose. Contacts you do not select are not stored.
Contacts without a phone number are never imported, because they cannot be sent an SMS.
The list we fetch to show you is held in a temporary cache for up to ten minutes so the page you are using does not have to reload it, and is then discarded.

Limited Use

SwalaSMS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We use Google user data only to provide the contact import feature you asked for.
We do not transfer or sell Google user data to third parties, except as necessary to provide the Service, comply with the law, or as part of a merger or acquisition of SwalaSMS.
We do not use Google user data for advertising, and we do not use it to train generalised or artificial intelligence models.
No human at SwalaSMS reads your Google user data, except with your explicit permission for a support request you raised, where it is necessary for security or to comply with the law, or after the data has been aggregated and anonymised.

Tokens and disconnecting

The access and refresh tokens Google issues are stored encrypted on our servers, are never sent to your browser or your phone, and are used only to read the contact list you asked for. You can disconnect a Google account at any time from Contacts in the portal or the app. Disconnecting revokes our access with Google and deletes the stored tokens immediately. You can also revoke it from your Google account permissions page. Contacts you already imported stay in your groups until you delete them; deleting them is the same as deleting any other contact.

How we use data

To deliver the Service: sending your messages, keeping your contact groups, showing delivery reports and maintaining your credit balance.
To keep accounts secure: detecting abuse, rate limiting, and letting you review your own sign-in activity.
To meet legal and regulatory duties, including the record-keeping the telecommunications regulator requires of an SMS provider.
To screen traffic for spam, fraud and prohibited content, automatically and by hand, and to investigate a suspected breach of our Terms of Service.
To support you when you contact us.

We rely on the performance of our contract with you to run the Service, on our legal obligations as a licensed sender for record-keeping and reporting, and on our legitimate interest in keeping the platform secure and free of abuse for the screening described above.

We do not sell personal data. We do not use your contacts or message content to advertise to you or to anybody else, and we do not use them to train artificial intelligence models.

Who we share it with

Mobile network operators and SMS aggregators, who deliver your messages. They receive the recipient number, the sender ID and the message content, because a message cannot be delivered without them.
Payment providers, who process your credit purchases. They receive what a payment needs and never your contact lists.
Hosting and infrastructure providers, who store the data on our behalf under contract.
Authorities, where the law or the regulator requires it, or where we report a suspected offence.
Professional advisers and insurers, where we need advice on or cover for a claim.
A buyer of our business, if we are sold or merged, under equivalent confidentiality terms.

Every processor we use is bound by contract to handle the data only on our instructions and to keep it secure. We remain answerable to you for what they do with it.

Where an account sends spam or unlawful content, we report it. That report goes to the Tanzania Communications Regulatory Authority, to the affected mobile network operators, and to the police or any other competent authority, and it includes the account holder's name and business details, the registered phone number and email address, the message content, the recipient numbers, the delivery logs and the IP addresses used. This is set out in our Terms of Service and is a condition of holding an account.

How long we keep it

Contacts and groups: until you delete them. Closing your account does not delete them — see below.
Messages and delivery reports: kept while your account is open so your reports remain complete, and retained afterwards only where record-keeping rules require it.
Sign-in and API logs: a rolling window, kept for security investigation.
Google tokens: until you disconnect the account, at which point they are revoked and deleted. Closing your account revokes them too.

Closing your account closes it; it does not erase what is in it. Your sign-in stops working immediately, every device is signed out, and the account disappears from the service. Behind that, your contacts, groups, templates, sender IDs, messages, credits and payment history are retained. Connected Google accounts are disconnected and the access we held is revoked with Google, though the record that the connection existed is kept.

We do this because we are answerable for the messages sent through us. If a network operator, the TCRA, a court or the police asks about traffic from a closed account, we have to be able to produce that account rather than a summary of it. Our lawful basis is that legal obligation as a sender, not your consent, which is why it applies after closure. A retained account is readable only by our administrators, and nobody can sign in to it.

If you want your data erased rather than retained, write to sms@swalatech.com from the address on the account. We will erase everything that is not held under a specific legal or tax obligation, and tell you what had to stay and why. See deleting your account for the full picture.

Security

Traffic to the portal, the app and the API is encrypted in transit with TLS.
Passwords are hashed, and sensitive credentials such as Google tokens and payment keys are encrypted at rest.
Access to production data is limited to the people who need it to run the Service.
Two-factor authentication is available on every account, and we recommend it.

No system is completely secure, and we cannot guarantee that data will never be accessed or disclosed in breach of our safeguards. You are responsible for keeping your own password, API keys and devices secure. If a breach affects your personal data and is likely to put your rights at risk, we will tell you and the regulator as the law requires.

Your rights

You can ask us to give you a copy of your personal data, correct it, or delete it. Most of it you can do yourself: contacts, groups and templates are editable in the portal and the app, and your profile is yours to change. For anything else, write to sms@swalatech.com and we will respond within thirty days. We may ask you to confirm your identity first, so that we do not disclose data to the wrong person, and we may decline a request that is unfounded or excessive, or where the law requires us to keep the data.

If you are not satisfied with how we have handled your data, you can complain to the Personal Data Protection Commission in Tanzania. We would rather you came to us first so we can put it right.

If you are one of our customers' recipients and want to stop receiving their messages, reply STOP to the message. That opt-out is recorded and applies to that sender immediately.

Children

The Service is for businesses. It is not directed at children, and we do not knowingly collect data from anybody under 18.

International transfers

Our infrastructure and some of our providers operate outside your country. Where data is transferred, we do so on the basis permitted by the Personal Data Protection Act, under contractual safeguards requiring the recipient to protect it to the standard described here, and we transfer no more than the Service needs.

Changes

We will update this page when the Service changes, and the date at the top will change with it. If a change materially affects how we handle your data, we will tell account holders by email.

Contact

SwalaSMS
Email: sms@swalatech.com
Phone: +255 748 859 172
Dar es Salaam, Tanzania