Privacy Policy

This policy explains what Mesaj SME collects, why, and how it's handled. It applies to business account holders using the Service, and — separately, in the last section below — to the recipients of campaigns sent through it.

What we collect from you

• Account details: email address, and a hashed password (we never see or store it in plain text)
• Business details: business name, CAC registration number, sector, contact phone number
• Your CAC certificate (image or PDF), used specifically to support Sender ID approval with telecom carriers
• Payment activity via Paystack — we see transaction references and amounts, never your full card details
• Contact lists and phone numbers you upload for campaigns — this is data you provide about your own customers, which we process on your behalf (see below)
• Basic technical data if something goes wrong — error reports, browser/device type — used only for fixing bugs

Why we collect it

We use this information to:

• Create and run your account
• Submit and track Sender ID requests with telecom carriers
• Process wallet top-ups and campaign billing
• Send the SMS campaigns you compose to the numbers you provide
• Notify you by email about account activity — Sender ID status, campaign outcomes
• Investigate and fix technical problems
• Meet our own legal and regulatory obligations, including NCC compliance

Who we share it with

We share data with a small number of service providers who help us run the Service, each only for the specific purpose below:

• Supabase — hosts our database, authentication, and file storage (EU region)
• Paystack — processes wallet top-up payments
• Resend — delivers transactional emails (account and campaign notifications)
• Sentry — error monitoring, so we find and fix bugs quickly
• Our SMS gateway partner and the telecom carriers (MTN, Airtel, Glo, 9mobile) — necessary to actually deliver your campaigns and process Sender ID approval

We don't sell your data, or your customers' phone numbers, to anyone — including for advertising.

Your customers' phone numbers

When you upload a contact list, you remain the data controller for those numbers under the Nigeria Data Protection Act — you're responsible for having a lawful basis to hold and message them (see our Terms of Service). We act only as a processor: we use those numbers solely to send the campaign you submit, and don't use them for any other purpose.

How long we keep it

We keep account and campaign data for as long as your account is active, and for a reasonable period after closure to meet legal, accounting, or regulatory retention requirements. You can request deletion of your data at any time, subject to records we're legally required to retain (e.g. financial transaction records).

Your rights

Under the Nigeria Data Protection Act, you have the right to access the personal data we hold about you, request correction of inaccurate data, request deletion, and object to certain processing. To exercise any of these, contact us below.

Security

Your CAC documents are stored in a private file store that only our admin systems can access — never a public link. Database access is restricted by row-level security so that one business's data is never visible to another's. Passwords are hashed, never stored in plain text.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email or an in-app notice before they take effect.

Contact

Questions about this policy, or to exercise your data rights: support@mail.mesaj.cloud