1 Who we are
OmniHub is a multi-channel communications and payments platform that enables businesses to send and receive messages across SMS, WhatsApp, Email, USSD, RCS, Telegram, and other channels, manage a unified inbox, run campaigns, and process payments such as M-PESA. OmniHub is operated by Paradox Interactive Ltd ("Paradox", "OmniHub", "we", "us", or "our"), a company registered in Kenya, with its registered office at Haven Court, Suite C3, Westlands, Nairobi.
This Privacy Policy applies to our website, web dashboard, mobile and desktop applications, APIs, and related services (together, the "Services").
2 Scope & our role
We handle personal data in two distinct capacities:
- As a data controller — for the personal data of our own account holders (the businesses and individuals who register for and administer OmniHub) and visitors to our website. This policy governs that data.
- As a data processor — for the personal data that our business customers transmit, store, or process through the Services about their own contacts and end users (for example, recipient phone numbers and message content). In that case, our business customer is the data controller, their own privacy notice governs that data, and we process it only on their documented instructions under our agreement with them.
If you are an end user who received a message sent through OmniHub by one of our business customers, please contact that business directly with privacy questions; they determine how your data is used.
3 Information we collect
Account and business information
Name, email address, phone number, business name, role, billing and tax details, and the business-verification or "know your customer" information required to onboard you and your senders (including WhatsApp Business Account details).
Authentication data
Login credentials (stored only as salted hashes), two-factor authentication settings, and session and security logs.
Communications data processed on behalf of customers
Where you use OmniHub to send or receive messages, we process recipient identifiers (such as phone numbers and channel handles), message content and templates, delivery and read receipts, conversation history, and related metadata across the channels you use.
WhatsApp Business data
WhatsApp Business Account (WABA) identifiers, phone number IDs, message templates, business profile information, and message delivery data, processed through the WhatsApp Business Platform and subject to Meta's terms (see Section 6).
Payment data
Transaction references, amounts, and status for payments processed through providers such as Safaricom M-PESA. We do not collect or store full card numbers, PINs, or M-PESA credentials.
Technical and usage data
IP address, device and browser information, access times, API usage and request logs, and similar diagnostic data automatically collected when you use the Services.
Support communications
Records of your correspondence with our support and sales teams.
4 How we use information
- To provide, operate, maintain, and secure the Services;
- To route, send, receive, and deliver messages across the channels you use, and to report delivery status;
- To onboard WhatsApp senders and facilitate your use of the WhatsApp Business Platform;
- To process payments and reconcile transactions;
- To authenticate users, manage accounts, and handle billing;
- To provide customer support and respond to enquiries;
- To detect, prevent, and investigate fraud, abuse, and security incidents;
- To analyse usage and improve and develop the Services;
- To comply with legal, regulatory, and contractual obligations;
- To send service-related and, where permitted, marketing communications.
5 Legal bases
Where the Kenya Data Protection Act, 2019, the GDPR, or other applicable law requires a legal basis for processing, we rely on one or more of the following: performance of a contract with you; our legitimate interests in operating and improving a secure, reliable platform (balanced against your rights); your consent where required, such as for certain marketing; and compliance with a legal obligation. You may withdraw consent at any time where consent is the basis for processing.
6 WhatsApp & Meta platform data
OmniHub is a Meta Tech Provider that enables business customers to use the WhatsApp Business Platform. When you send or receive WhatsApp messages through OmniHub, the message content and related data are transmitted to and processed by Meta Platforms in order to deliver those messages, and such processing is also governed by the WhatsApp Business Terms and Meta's privacy practices.
We use WhatsApp data solely to provide and support the messaging Services you have requested. We do not use WhatsApp message content for our own advertising, and we do not sell it. Your use of WhatsApp through OmniHub is additionally subject to Meta's applicable policies.
8 International transfers
The Services rely on infrastructure and partners that may process data outside Kenya, including in regions operated by Meta, Google Cloud, and Amazon Web Services. Where personal data is transferred across borders, we take steps to ensure an adequate level of protection consistent with the Kenya Data Protection Act, 2019 and other applicable laws, including contractual safeguards with our providers.
9 Data retention
We retain account and business data for as long as your account is active and for a reasonable period afterwards to meet legal, tax, accounting, and operational requirements. Communications data processed on behalf of a business customer is retained according to that customer's instructions and our agreement with them. Diagnostic and security logs are retained for limited periods. When data is no longer needed, we delete or anonymise it.
10 Security
We use technical and organisational measures to protect personal data, including encryption in transit, access controls, hashed credentials, network protections, and monitoring. No method of transmission or storage is completely secure, so while we work to protect your data we cannot guarantee absolute security. If we become aware of a personal data breach, we will act in accordance with applicable breach-notification requirements.
11 Your rights
Subject to applicable law, including the Kenya Data Protection Act, 2019 and the GDPR where it applies, you may have the right to access your personal data; to request correction or deletion; to restrict or object to certain processing; to data portability; and to withdraw consent. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (Kenya) or another competent supervisory authority.
To exercise these rights, contact us using the details in Section 15. Where the data relates to messages or contacts controlled by one of our business customers, we will direct your request to that customer (the controller) and assist them in responding.
13 Children's privacy
The Services are intended for businesses and are not directed to children under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us so we can take appropriate action.
14 Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version on this page with a revised "Last updated" date, and where changes are material we will provide additional notice as required by law. Your continued use of the Services after an update constitutes acceptance of the revised policy.
15 Contact us
For privacy questions or to exercise your rights, contact:
Paradox Interactive Ltd
Data Protection Contact: [Data Protection Officer name]
Email: privacy@paradox.co.ke
Address: Haven Court, Suite C3, Westlands, Nairobi
Website: omni.paradox.co.ke