UNCHORUNCHOR OS Privacy Notice
Version 2026-10-23. Effective 23 October 2026.
This notice explains what personal data SyncPesa Technologies Limited collects when you use UNCHOR OS, our websites, the Academy and our free tools; why we collect it; the legal basis; who receives it; how long we keep it; and your rights. It is written to meet the Kenya Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021, and the equivalent duties in other data-protection laws that apply to people we serve, such as the EU and UK General Data Protection Regulation.
1. Who we are
SyncPesa Technologies Limited is the data controller for the data in this notice.
Company registration: Company No. PVT-3B1MD9BO.
Address: Muli Mall Building, Biashara Street, P.O. Box 12-90200 Kitui, Kenya.
Contact for anything about personal data: the contact form at https://unchor.co.ke/contact (topic: Privacy and data protection).
When you run a network with UNCHOR OS, data about your own customers and staff belongs to you: you are its controller and we are your processor under the Data Processing Terms. If you are a customer of a Wi-Fi network that uses UNCHOR OS, the business that runs that network is responsible for your data; you can still contact us and we will pass your request to them and help them answer it.
2. What we collect, why, and the legal basis
| Data | Why we use it | Legal basis | Can you say no? |
|---|---|---|---|
| Account: name, email, password (stored only as a scrypt hash), 2-step sign-in secret (encrypted), language, country, time zone | Create and secure your account, sign you in, send service and security messages | Performance of our contract with you | No. Without it we cannot provide an account |
| Workspace and billing: business name, tax number if you give it, billing country, invoices, payments to us | Bill you, issue invoices, credit notes and receipts, keep financial records | Contract; legal obligation (tax record-keeping) | No |
| Network operation: gateway measurements, configuration, uptime checks, events, pseudonymous device identifiers (keyed hashes, never raw hardware addresses) | Run, diagnose, repair and protect your network | Contract | No, it is how the service works |
| Security records: sign-in times, network addresses, browser, the devices you have signed in from, a tamper-evident audit log | Detect and stop account takeover and abuse; keep a record of who changed what | Legitimate interests (security) | You may object, but we keep what security and the law require |
| Service improvement: de-identified records of what gateways measured, what UNCHOR OS recommended or did, and what happened next | Make diagnosis, repairs and advice better for everyone | Legitimate interests; statistical purposes | Yes. Turn off "Help UNCHOR get smarter" at sign-up or later. Records made while it is off are never used outside your workspace |
| Benchmarks: your figures inside anonymous totals shown only when at least five workspaces contribute | Show what works on similar networks | Legitimate interests; statistical purposes | Yes. Turn off "Compare with similar networks" |
| Network quality shared with partners: anonymous totals of link quality per country and internet provider, published only when at least five workspaces contribute and no single workspace makes up most of a total | Help internet providers find and fix problems that affect many networks, under the Partner Data Access Terms | Your consent | Yes. It is off unless you turn on "Share anonymous network quality with internet providers" |
| Payment health: counts of payment results per country, provider and method (never amounts, phone numbers or names) | Warn every operator when a payment rail is failing | Your consent | Yes. It is off unless you turn it on |
| Academy and community: progress, certificates, posts, replies, votes, session sign-ups and feedback | Teach, certify and run the community | Contract | You choose what you post. A public profile is optional |
| Learning research: community posts used to improve UNCHOR OS, only if you tick "Allow my posts to be used for learning" | Improve teaching and recommendations | Your consent | Yes. It is off unless you tick it, and you can withdraw it |
| Product news and offers by email | Tell you about new features and offers | Your consent | Yes. It is off unless you tick it. Every email has a one-click unsubscribe |
| Contact form, pilot and partner applications: name, email, organisation, country, your message | Answer you and consider your application | Steps you asked us to take before a contract; legitimate interests | Yes. Do not send the form, or ask us to delete it |
| Website visits: the page, the day, where the visit came from (a search engine, an invitation code, a campaign name) and the country chosen on the page | Count which pages and invitations help people | Legitimate interests | No identifier, cookie or device information is collected, so there is nothing to link to you |
We do not record the websites your customers visit, their DNS queries or the content of their traffic. We do not sell personal data. We do not make decisions that have legal or similarly significant effects on you by automated means alone. Our free tools (such as the message checker at /check) run in your browser and do not send what you type to us.
3. Where the data comes from
Most data comes from you, from the gateways you install, and from the people you invite. Payment providers you connect tell us the result of each payment. If someone invites you to a workspace, they give us your email address.
4. Who receives it
- Service providers who process data for us: hosting, email delivery, SMS delivery when you use SMS, and an AI model provider only when an optional AI feature is turned on and only for the data class that provider is allowed to receive (the Artificial Intelligence and Automation Policy explains this). Each processes data only on our instructions under a written contract.
- The current list of providers, with their regions, is in the app under Settings → Privacy & data → Who processes data.
- Payment providers you connect (such as Safaricom M-Pesa, Paystack, Pesapal, Flutterwave or Stripe) receive what they need to take a payment; their own terms apply.
- People in your workspace you invite see what their role allows.
- Approved data partners receive only anonymous totals, never personal data, under the Partner Data Access Terms.
- Authorities, only where a law or court order requires it, as the Government and Law Enforcement Request Policy explains.
- A buyer of our business, if UNCHOR OS is sold, under the same commitments as this notice. We will tell you before that happens.
5. Transfers between countries
Some providers process data outside the country where you are. We transfer personal data only with the safeguards the applicable law requires: to a country with adequate protection, under contractual clauses that bind the recipient to equivalent protection, or with your consent where the law allows it. You can ask the contact form at https://unchor.co.ke/contact (topic: Privacy and data protection) for a copy of the safeguards that apply.
6. How we protect it
Encryption in transit; encryption of payment credentials and other secrets; row-level isolation between workspaces enforced by the database; scrypt password hashes; 2-step sign-in; alerts when your account is used from a new device; a hash-chained, signed audit log; signed gateway releases; least-privilege access for our staff with time-limited elevation; and tested backups. The Security and Vulnerability Disclosure Policy has more detail. No system is perfectly secure, so we also plan for incidents (section 9).
7. How long we keep it
| Data | Kept for |
|---|---|
| Account data | While your account exists; deleted or anonymised within 14 days after the deletion grace period ends |
| Financial records (invoices, credit notes, receipts, payments) | The period tax law requires (in Kenya, 5 years after the end of the reporting period), then deleted |
| Network data about your customers | As you set per site (7 to 1,095 days); then network addresses and phone numbers are masked |
| Gateway metrics | 180 days |
| Link quality samples | 14 days |
| Security and audit records | As long as the workspace exists, because they prove what happened |
| Contact form and applications | 2 years after the last message, unless they lead to a contract |
| De-identified learning records and anonymous totals | While useful for improving UNCHOR OS; they contain no names, emails, phone numbers or device addresses |
8. Your rights
You have the right to be informed, to access your data, to correct it, to delete it, to restrict processing, to object to processing (including an absolute right to object to direct marketing), to receive your data in a portable format, to withdraw consent at any time (without affecting what was done before), and not to be subject to a decision based solely on automated processing.
You can do most of this yourself under Settings → Privacy & data: download your data, change your choices, or delete your account. For anything else, contact the contact form at https://unchor.co.ke/contact (topic: Privacy and data protection). We answer access requests within 7 days; correction, deletion and objection requests within 14 days; and portability requests within 30 days. We may ask you to confirm your identity first. Exercising your rights is free.
You may also complain to the data-protection authority. For SyncPesa Technologies Limited the lead authority is the Office of the Data Protection Commissioner (www.odpc.go.ke). If you live elsewhere you may complain to the authority in your own country.
9. If something goes wrong
If a breach of personal data creates a real risk of harm, we notify the data-protection authority within 72 hours of becoming aware of it and tell the people affected without undue delay, with what happened, what data was involved, what we have done and what they can do.
10. Children
UNCHOR OS accounts are for adults. Wi-Fi networks run with UNCHOR OS may be used by people of any age; their operators are responsible for following the rules on children's data in their country. If you believe a child has given us personal data, contact the contact form at https://unchor.co.ke/contact (topic: Privacy and data protection) and we will delete it.
11. Changes to this notice
We tell you about material changes in the app or by email before they take effect. The version, effective date and fingerprint of this notice are shown on it.