Privacy Policy

1. Who we are

This Privacy Policy explains how The Mikaka Group Limited (trading as “Mikaka” and “Mikaka Voice”; “we”, “us”, or “our”), a company based in Nairobi, Kenya, collects, uses, stores, and protects personal data when you visit our websites, create an account, or use our AI-powered call answering, outbound calling, WhatsApp messaging and calling, research interviewing, and demand-intelligence services (together, the “Services”).

We provide the Services to businesses (our “customers”) who use Mikaka to answer and place calls and messages with their own customers. For personal data we process on a customer’s behalf — including data about the people who call, message, or are contacted by that business — the customer is the data controller and Mikaka acts as a data processor. For account, billing, and website data, Mikaka is the data controller.

This Policy forms part of, and should be read together with, our Terms of Service. We process personal data in accordance with the Kenya Data Protection Act, 2019 and, where applicable, other data-protection laws of the jurisdictions in which we operate.

2. Who this policy covers

This Policy applies to:

• Customers and their team members — businesses that sign up for Mikaka and the users they invite to their workspace.
• Callers, message senders, and recipients — people who call, message (including on WhatsApp), or are contacted by a phone number or WhatsApp Business account operated through the Services, including people who receive research or survey calls.
• Website visitors — people who browse our websites or contact us.

3. Information we collect

We collect information you provide directly, information we receive from third parties (including Meta and our customers), and information collected automatically when you use the Services.

3.1 Account and workspace information

• Name, email address, and password (or Google account details if you sign in with Google).
• Company or organisation name, industry, and workspace settings.
• Team member roles and permissions.
• Business contact details you add to your workspace (names, phone numbers, email addresses).

3.2 Call and communication data

• Call records — caller and recipient phone numbers, the number dialled, call direction, start and end times, duration, and call outcome.
• Transcripts — a written transcript of conversations with our AI agents. Call audio is processed in real time to generate the transcript and operate the AI agent; we do not retain raw audio recordings of calls by default.
• Conversation insights — summaries, topics, sentiment, and key details (such as a caller’s stated name or request) extracted from transcripts to provide analytics to our customers.
• SMS messages — the content and recipient numbers of text messages sent through the Services.

3.3 WhatsApp Business Platform and Meta data

When a customer connects a WhatsApp Business account and enables WhatsApp messaging or calling, we access and process information through Meta’s WhatsApp Business Platform and Cloud API on that customer’s behalf, including:

• The WhatsApp phone number and WhatsApp profile name of the people who message or call the business.
• The content and media of WhatsApp messages exchanged with the business, and message metadata (timestamps, message and conversation identifiers, delivery and read status).
• Opt-in and consent status, and — for the WhatsApp Business Calling API — call-permission status, call identifiers, timestamps, duration, and call audio and transcripts where a call is answered by an AI agent.
• The business’s WhatsApp Business Account and phone-number configuration needed to operate the connection.

3.4 Research and survey data

• Responses given during AI-conducted research interviews and surveys, together with a record of the consent given at the start of the interview. Research calls begin with a disclosure that the call is conducted by an AI interviewer, and participation is voluntary.

3.5 Knowledge base content

• Documents, FAQs, policies, and other content customers upload so their AI agents can answer questions accurately. Customers are responsible for ensuring they have the right to upload this content.

3.6 Billing and payment information

• Plan details, wallet balance, and transaction history. Card and mobile-money payments are processed by a third-party payment provider; we do not store full card numbers or mobile-money PINs on our systems.

3.7 Technical and usage information

• Log data such as IP addresses, browser type, device information, and pages visited.
• Audit logs of actions taken within a workspace (who did what, and when).
• Security-event data used to detect fraud, abuse, and attacks on our infrastructure.

4. How we use information and why

We use personal data to:

• Provide, operate, and maintain the Services, including answering and placing calls and messages with AI agents across voice, SMS, and WhatsApp.
• Transcribe calls and generate summaries, insights, and analytics for our customers.
• Carry out actions a caller or customer requests — such as sending a confirmation message, booking an appointment, updating a connected CRM, creating a support ticket, or transferring a call to a human.
• Set up and manage accounts, workspaces, phone numbers, and WhatsApp Business connections.
• Process payments, manage wallets, and bill for usage.
• Respond to enquiries and provide customer support.
• Monitor, secure, and improve the Services, including detecting fraud and abuse.
• Send service updates and, with your consent, marketing communications.
• Comply with legal obligations, including lawful requests from regulators and law enforcement.

AI processing. Conversations with our AI agents are processed by our third-party speech and large-language-model providers to understand speech, generate responses, and extract insights. We do not permit our AI providers to use your conversation data to train their general-purpose models.

Limited use. We use each category of data only for the purposes described above and compatible purposes. We do not use data obtained through Meta’s APIs for unrelated products, advertising, or profiling — see Section 5.

5. WhatsApp & Meta Platform data — limited use

Our access to and use of information received through the WhatsApp Business Platform and Meta’s Cloud API (“Platform Data”) complies with Meta’s Platform Terms, Developer Policies, and the WhatsApp Business Messaging Policy. Specifically:

• We use Platform Data only to provide, operate, and improve the WhatsApp messaging and calling features a customer has chosen — for example, answering an inbound WhatsApp call or message, sending a permitted reply, or completing a requested action.
• We do not sell, license, rent, or purchase Platform Data, and we do not transfer it to data brokers, ad networks, or monetisation platforms.
• We do not use Platform Data for advertising, cross-context tracking, or to build or augment profiles for ad targeting, and we do not combine it with data from other sources for unrelated purposes.
• We keep the Platform Data of each customer separated from that of other customers (tenant isolation) and use it only to provide the Services to that customer.
• We require our service providers and sub-processors that handle Platform Data to be bound by equivalent restrictions.

Opt-in, messaging, and calling permission

• Messaging occurs on a lawful, opted-in basis. Our customers are responsible for obtaining the opt-in that the WhatsApp Business Messaging Policy and applicable law require, and we support honouring opt-outs (for example, when a person asks to stop receiving messages).
• Business-initiated calls on WhatsApp are placed only where the customer (the business) has obtained the required call permission from the person, consistent with Meta’s WhatsApp Business Calling requirements. User-initiated calls reach the business when a person chooses to call it.
• Recording and transcription of WhatsApp calls occur only where participants are informed and consent as required — see Section 6.

WhatsApp messages and calls are end-to-end encrypted in transit on WhatsApp’s infrastructure. Once content is delivered to Mikaka’s systems to operate the AI agent (for example, for transcription and reply generation), it is handled under the safeguards described in this Policy.

6. Recording, transcription & AI notice

Calls and messages handled by the Services are answered or placed by an AI agent and are transcribed in order to provide the Services. Our customers are responsible for providing any notice to, and obtaining any consent from, the people they interact with that applicable law requires — including disclosure that communications are handled by an automated system and may be transcribed. Research and survey calls placed through the Services include a consent disclosure at the start of the call.

7. Legal bases and consent

Where we act as a data controller, we rely on the following legal bases under the Kenya Data Protection Act, 2019 (and the corresponding bases under the EU/UK GDPR where those laws apply):

• Contract — to provide the Services you or your organisation have signed up for.
• Consent — for marketing communications, research-interview participation, and where else consent is required.
• Legitimate interests — to secure and improve the Services, prevent fraud and abuse, and operate our business.
• Legal obligation — to meet tax, accounting, telecommunications, and other regulatory requirements.

Where we process data on a customer’s behalf as a processor, that customer is responsible for establishing the lawful basis and the necessary consents for contacting and recording the people it interacts with.

8. How we share information

We do not sell personal data. We share it only with service providers (sub-processors) that help us deliver the Services, with our customers (for data processed on their behalf), and where required by law. We share data with the following categories of sub-processor:

• Meta Platforms / WhatsApp — the WhatsApp Business Platform, used to send and receive WhatsApp messages and calls.
• Cloud hosting and database providers — to run the Services and store data securely.
• Real-time voice and telephony providers — to carry, connect, and route calls.
• Speech-to-text and AI (large-language-model) providers — to transcribe conversations and generate AI responses and insights.
• Telecommunications and connectivity providers — to provision phone numbers and deliver calls and messages.
• Payment processors — to take payment and manage billing.
• Security, monitoring, and error-reporting providers — to keep the Services reliable and secure.
• Integration partners you connect — such as your CRM, email, or calendar provider, where you enable those integrations for your workspace.

We select sub-processors that commit to protecting personal data, and we contractually bind them to use it only to provide services to us. A current list of the specific sub-processors we use is available to business customers on request and under our Data Processing Agreement. We do not transfer Platform Data to data brokers or ad networks. We may also disclose information if required to do so by law, court order, or a competent authority, or in connection with a merger, acquisition, or sale of assets (in which case we will notify affected users).

9. International data transfers

Some of our sub-processors store or process data outside Kenya, including in the United States and the European Union. Where personal data is transferred outside Kenya (or, where the GDPR applies, outside the EEA/UK), we take steps to ensure it receives an adequate level of protection consistent with the Kenya Data Protection Act, 2019, including contractual safeguards such as standard contractual clauses with our sub-processors.

10. Data retention

• Account data — retained while your account is active and for a reasonable period afterwards to handle disputes and legal obligations.
• Call records, transcripts, and WhatsApp/Platform data — retained while the customer’s workspace is active, or until the customer deletes them, so customers can access their history and analytics. Platform Data is deleted when it is no longer needed for the purpose it was collected, on the customer’s instruction, or on request.
• Billing records — retained as required by tax and accounting law.
• Security and audit logs — retained for as long as needed to investigate and prevent abuse.

When a customer closes their workspace, we delete or anonymise the associated personal data within a reasonable period (ordinarily within 90 days), except where the law requires us to keep it longer.

11. Data security

We implement administrative, physical, and technical measures to protect personal data appropriate to its sensitivity, including encryption in transit and at rest, access controls and role-based permissions, tenant-level data isolation, audit logging, and continuous monitoring for suspicious activity. No system is completely secure; we encourage you to use a strong, unique password and to contact us immediately if you suspect unauthorised access to your account.

12. Your rights and how to request data deletion

Subject to applicable law, you have the right to: be informed about how your personal data is used; access the data we hold about you; correct inaccurate or incomplete data; request deletion of your data; object to or restrict certain processing; withdraw consent at any time where processing is based on consent; and receive a copy of your data in a portable format.

Requesting deletion of your data

Anyone — including a person whose WhatsApp, call, or message data we process on behalf of one of our customers — may request deletion of their personal data by emailing info@mikaka.io with the subject line “Data deletion request”. Please include enough detail for us to locate your data (for example, the phone number or WhatsApp number involved and the business you interacted with).

We will acknowledge your request, verify it, and delete the relevant personal data — including instructing our sub-processors to delete it — promptly and ordinarily within 30 days, unless we are legally required to retain it. Where the data was collected on behalf of one of our customers (who is the data controller for that data), we will refer your request to that customer and assist them in responding. If we cannot fulfil a request, we will tell you why.

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya, or with your local supervisory authority where the GDPR applies.

13. Children’s privacy

The Services are intended for business use and are not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the “Last updated” date above. For material changes, we will notify registered users by email or through the Services.

15. Contact us

If you have questions about this Privacy Policy or how we handle your data, or to exercise any of your rights, contact us at info@mikaka.io.

The Mikaka Group Limited · Nairobi, Kenya · Data protection: info@mikaka.io