Privacy Policy · SwalaSMS

Last updated: 13 August 2026

This policy explains how SwalaSMS (“we”, “us”) handles personal data when you use our website, our web portal, our mobile app and our SMS API (together, the “Service”). It applies to everyone who holds a SwalaSMS account and to the people whose numbers our customers message.

Who is responsible

SwalaSMS is the data controller for account data — the information you give us to open and run an account.

For the contact lists and message content you upload, you are the controller and we are your processor: they are your data, we hold and transmit them on your instructions, and we do not decide what you send or who you send it to. You are responsible for having a lawful basis and the recipient's consent to message them.

What we collect

Account data

Your name, business name, email address, phone number and country.
Your password, stored only as a one-way hash — we cannot read it.
Sign-in activity: date, time, IP address, device and browser, so you can spot a session you do not recognise.
Billing records: credit purchases, payment references and invoices.

Data you upload

Contacts: names, phone numbers, and any optional fields you add such as email address, company or a date used by an automation.
Message content, sender IDs, schedules and campaign names.
Delivery reports returned by the mobile operators, including the delivery status and time for each message.

Technical data

Server logs of API requests: endpoint, status, timestamp and the account that made the call.
Cookies strictly necessary to keep you signed in and to protect forms from abuse. We do not use advertising cookies.

Google user data

Importing contacts from Google is optional. Nothing below happens unless you choose Import from Google Contacts and approve the request on Google's own screen.

What we ask for

We request one Google permission: https://www.googleapis.com/auth/contacts.readonly. It allows us to read your Google contacts and nothing else. We cannot create, change or delete anything in your Google account, and we do not request access to Gmail, Drive, Calendar or any other Google service.

What we do with it

We read your contacts' names, phone numbers, email addresses and organisation, and show them to you so you can choose which ones to import.
Only the contacts you select are copied into the SwalaSMS contact group you choose. Contacts you do not select are not stored.
Contacts without a phone number are never imported, because they cannot be sent an SMS.
The list we fetch to show you is held in a temporary cache for up to ten minutes so the page you are using does not have to reload it, and is then discarded.

Limited Use

SwalaSMS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We use Google user data only to provide the contact import feature you asked for.
We do not transfer or sell Google user data to third parties, except as necessary to provide the Service, comply with the law, or as part of a merger or acquisition of SwalaSMS.
We do not use Google user data for advertising, and we do not use it to train generalised or artificial intelligence models.
No human at SwalaSMS reads your Google user data, except with your explicit permission for a support request you raised, where it is necessary for security or to comply with the law, or after the data has been aggregated and anonymised.

Tokens and disconnecting

The access and refresh tokens Google issues are stored encrypted on our servers, are never sent to your browser or your phone, and are used only to read the contact list you asked for. You can disconnect a Google account at any time from Contacts in the portal or the app. Disconnecting revokes our access with Google and deletes the stored tokens immediately. You can also revoke it from your Google account permissions page. Contacts you already imported stay in your groups until you delete them; deleting them is the same as deleting any other contact.

How we use data

To deliver the Service: sending your messages, keeping your contact groups, showing delivery reports and maintaining your credit balance.
To keep accounts secure: detecting abuse, rate limiting, and letting you review your own sign-in activity.
To meet legal and regulatory duties, including the record-keeping the telecommunications regulator requires of an SMS provider.
To support you when you contact us.

We do not sell personal data. We do not use your contacts or message content to advertise to you or to anybody else, and we do not use them to train artificial intelligence models.

Who we share it with

Mobile network operators and SMS aggregators, who deliver your messages. They receive the recipient number, the sender ID and the message content, because a message cannot be delivered without them.
Payment providers, who process your credit purchases. They receive what a payment needs and never your contact lists.
Hosting and infrastructure providers, who store the data on our behalf under contract.
Authorities, where the law or the regulator requires it.

How long we keep it

Contacts and groups: until you delete them. Closing your account does not delete them — see below.
Messages and delivery reports: kept while your account is open so your reports remain complete, and retained afterwards only where record-keeping rules require it.
Sign-in and API logs: a rolling window, kept for security investigation.
Google tokens: until you disconnect the account, at which point they are revoked and deleted. Closing your account revokes them too.

Closing your account closes it; it does not erase what is in it. Your sign-in stops working immediately, every device is signed out, and the account disappears from the service. Behind that, your contacts, groups, templates, sender IDs, messages, credits and payment history are retained. Connected Google accounts are disconnected and the access we held is revoked with Google, though the record that the connection existed is kept.

We do this because we are answerable for the messages sent through us. If a network operator, the TCRA, a court or the police asks about traffic from a closed account, we have to be able to produce that account rather than a summary of it. Our lawful basis is that legal obligation as a sender, not your consent, which is why it applies after closure. A retained account is readable only by our administrators, and nobody can sign in to it.

If you want your data erased rather than retained, write to sms@swalatech.com from the address on the account. We will erase everything that is not held under a specific legal or tax obligation, and tell you what had to stay and why. See deleting your account for the full picture.

Security

Traffic to the portal, the app and the API is encrypted in transit with TLS.
Passwords are hashed, and sensitive credentials such as Google tokens and payment keys are encrypted at rest.
Access to production data is limited to the people who need it to run the Service.
Two-factor authentication is available on every account, and we recommend it.

Your rights

You can ask us to give you a copy of your personal data, correct it, or delete it. Most of it you can do yourself: contacts, groups and templates are editable in the portal and the app, and your profile is yours to change. For anything else, write to sms@swalatech.com and we will respond within thirty days.

If you are one of our customers' recipients and want to stop receiving their messages, reply STOP to the message. That opt-out is recorded and applies to that sender immediately.

Children

The Service is for businesses. It is not directed at children, and we do not knowingly collect data from anybody under 18.

International transfers

Our infrastructure and some of our providers operate outside your country. Where data is transferred, we take reasonable steps to ensure it is protected to the standard described here.

Changes

We will update this page when the Service changes, and the date at the top will change with it. If a change materially affects how we handle your data, we will tell account holders by email.

Contact

SwalaSMS
Email: sms@swalatech.com
Phone: +255 748 859 172
Dar es Salaam, Tanzania