Privacy
What JATA AFTERCALL stores, and why.
Plain-language description of the data the current application processes. Last updated 27 October 2026. This is a product disclosure, not a legal opinion; the owner should obtain a Kenyan-law review before treating it as a final statutory notice.
Information we process
Account data
Email address, optional name and phone number, a bcrypt password hash, role, session version and password-recovery metadata. Recovery tokens are stored only as SHA-256 digests and expire.
Business data
Business name, category, description, nominated phone and WhatsApp numbers, location or coordinates, opening hours, services, prices, offers, themes, media references and website content. You choose what is published on the public /b/<slug> page.
Payment data
Plan selection, amount in KES, Paystack reference, verification status and payment history are stored in our database. Paystack processes M-Pesa and card details; JATA AFTERCALL does not store card numbers, CVVs or M-Pesa PINs. Webhook signatures and transaction references are verified server-side.
Usage and analytics
Public page views and selected action clicks (WhatsApp, Call, Directions, Share, service clicks) are recorded against the business. Server logs and rate-limit counters may contain hashed network identifiers for abuse prevention.
AI conversations
Where AI Business Front Desk is enabled, customer questions and grounding data are processed to produce answers. An owner can request deletion of a customer's conversation history for their business through the authenticated privacy endpoint.
How data is used and shared
Data is used to create and publish your business page, operate paid features, verify payments, prevent abuse, provide support and meet record-keeping obligations. Payments go to Paystack; hosting is on Vercel; the PostgreSQL database is Neon. Media may be stored through a configured durable object-storage adapter — durable production storage is not active until the owner provisions it, and uploads fail closed rather than reporting false success.
We do not sell customer contact lists. Business-owner contact details are visible only on pages the owner publishes. Tenant isolation is enforced on the server for every business-owned resource.
Retention, security and your choices
- You can edit or clear business contact details, unpublish a page and update services and offers in the dashboard.
- Published content remains until you change or unpublish it. Payment and audit records are retained as financial and security evidence.
- Passwords are hashed, sessions are signed and revocable, sensitive endpoints are rate-limited, and audit metadata is redacted before storage.
- There is currently no self-service full account-deletion screen. A deletion request must be handled through the support channel once the owner configures one; do not assume an account has been erased because a page was unpublished.
- The installable app caches only public static assets. It does not copy your account, business, payment or AI data to the device cache.
For a data-access, correction or deletion request, use Contact & support. Kenyan data-protection obligations (including lawful basis, data-subject requests, cross-border transfer terms and breach notification) require a specialist review commissioned by the owner; passing a technical checklist does not establish legal compliance.