Data Protection Policy

Last reviewed: 15 November 2026

This page explains how SautiMetrics approaches its obligations under Kenya's Data Protection Act, 2019 ("the Act"). It complements our Privacy Policy, which describes what data we collect in more detail.

1. Our Role

SautiMetrics acts as a data controller for account data (names, emails, phone numbers of registered users) and vote metadata (hashed identifiers, optional demographic and regional fields). We act as a data processor on behalf of poll and survey creators for the responses their polls/surveys collect.

2. Lawful Basis for Processing

• Consent — voting in a poll, responding to a survey, or registering an account is a voluntary action; optional fields (gender, age group) are only recorded if you choose to provide them
• Contract — account and payment data is processed to provide the service you've signed up for (creating polls/surveys, subscription billing)
• Legitimate interest — hashed phone/device/IP fingerprints are processed to prevent duplicate voting and detect fraud, which protects the integrity of the results for everyone using the platform

3. Data Minimization

We hash phone numbers, device identifiers, and IP addresses used for vote deduplication rather than storing them in readable form, specifically to reduce the personal data we hold. Demographic fields (gender, age group) are optional. We do not collect data we don't have a concrete use for.

4. Third-Party Data Processors

We share data with the following processors, only as needed to run the platform:

• Safaricom (M-Pesa Daraja API) — processes payment transactions; receives your phone number and payment amount
• Africa's Talking — delivers OTP verification SMS messages; receives your phone number for delivery purposes only
• Our email provider — delivers account and notification emails

We do not sell, rent, or share your data with advertisers or data brokers.

5. Data Retention

Account data is retained while your account is active and deleted when you delete your account. OTP codes expire and are superseded shortly after issue. Hashed vote fingerprints are retained to preserve the integrity of poll results over time, in de-identified form.

6. Your Rights as a Data Subject

Under the Act, you may request access to, correction of, or deletion of your personal data. See the Privacy Policy for how to exercise these rights, including the self-service account deletion feature.

7. Contact

For data protection queries specifically, reach us at:

• info@sautimetrics.co.ke
• Chat on WhatsApp