Privacy policy

Last updated:

At Dehash It, protecting personal information is fundamental to how we operate. We recognize the importance of privacy, transparency, and responsible data processing in delivering secure and reliable digital services.

Dehash It’s parent company, Hydrolife Tech, is registered with Kenya's Office of the Data Protection Commissioner (ODPC) as both a Data Controller and a Data Processor, in accordance with the Data Protection Act, 2019, and applicable regulations.

We are committed to processing personal data lawfully, fairly, transparently, and securely while respecting the rights of individuals and the legitimate needs of businesses using our services.

This Privacy Policy explains how Dehash It ("we," "us," or "our") collects, uses, processes, stores, shares, and protects personal information when you visit our website, create an account, access our APIs, make payments, or otherwise interact with our platform.

Depending on the nature of the processing activity, we may act as a Data Controller, determining the purposes and means of processing personal data, or as a Data Processor, handling personal data on behalf of customers in accordance with applicable legal and contractual obligations.

By accessing or using our services, you acknowledge the data practices described in this Policy.

Information we collect

We collect and process information reasonably necessary to deliver our services, maintain platform security, manage customer accounts, administer billing, and meet applicable legal obligations.

When you register for an account, we may collect your email address, name where provided, authentication information, and other details necessary to establish and manage your account.

We use this information to authenticate users, provide access to services, communicate important account information, and respond to support requests.

When you interact with our platform or APIs, we collect relevant operational information, including request activity, timestamps, service usage, transaction outcomes, and associated billing information.

This information supports service delivery, usage monitoring, billing accuracy, technical troubleshooting, fraud prevention, and platform reliability.

We seek to limit the collection and retention of personal data to what is necessary for legitimate operational purposes.

When you make payments or purchase service credits, we process information relevant to the transaction, which may include payment references, transaction amounts, payment-related contact information, and billing history.

This information is used to administer payments, maintain accurate financial records, resolve transaction disputes, and comply with applicable accounting, taxation, and regulatory obligations.

When you contact our support team, we may collect and retain the information you provide, including correspondence and relevant account details, to respond to inquiries and resolve reported issues.

How we use personal information

We process personal information for specified, legitimate purposes connected to operating and improving our services.

These purposes include:

  • Providing, maintaining, and supporting our website, platform, and APIs.
  • Creating, authenticating, and administering customer accounts.
  • Processing authorized service requests and managing API access.
  • Maintaining accurate usage, billing, and payment records.
  • Monitoring service performance, availability, and reliability.
  • Protecting our systems against fraud, misuse, unauthorized access, and security threats.
  • Responding to customer inquiries and providing technical support.
  • Communicating essential account, service, and security information.
  • Meeting applicable legal, financial, and regulatory obligations.

We do not sell personal information to advertisers or data brokers.

We do not use personal information for purposes incompatible with those for which it was collected unless permitted or required by applicable law.

API use and customer responsibilities

Dehash It provides API-based services that enable authorized customers to resolve supported identifiers into associated mobile phone numbers.

We recognize that mobile phone numbers and related identifiers may constitute personal data under applicable data protection legislation.

Customers using our APIs are responsible for ensuring that their collection, submission, processing, and subsequent use of personal information are lawful and appropriately authorized.

Customers must establish a valid legal basis for processing personal data and comply with applicable privacy, confidentiality, and data protection requirements.

Our services must not be used for unauthorized identification, unlawful surveillance, indiscriminate data harvesting, harassment, or other activities that infringe the privacy rights of individuals.

We reserve the right to investigate suspected misuse and to restrict or suspend access where reasonably necessary to protect individuals, our platform, or compliance with applicable law.

Where Dehash It processes personal data on behalf of a customer, the respective responsibilities of the parties are governed by applicable law and any relevant data processing agreements.

Our registration as a Data Controller and Data Processor does not relieve customers of their independent legal obligations when using our services.

Data Controller and Data Processor roles

Dehash It is registered with Kenya's Office of the Data Protection Commissioner in both capacities.

We act as a Data Controller when we determine the purposes and means of processing personal information, including information used for customer account management, platform administration, billing, security, and our own legal compliance.

In this capacity, we are responsible for ensuring that processing activities have an appropriate lawful basis and comply with applicable data protection requirements.

We may act as a Data Processor when processing personal information on behalf of customers who determine the purposes and means of that processing.

Where applicable, we process such information under documented instructions, appropriate contractual arrangements, and relevant legal obligations.

Our role in any particular processing activity depends on the actual circumstances and is not determined solely by how a service is described or contracted.

Legal bases for processing

We process personal information where an appropriate legal basis exists under the Data Protection Act, 2019, and other applicable laws.

Depending on the circumstances, these grounds may include:

  • Contractual necessity: Processing required to provide services requested by customers or fulfill contractual obligations.
  • Legal compliance: Processing necessary to satisfy applicable legal, financial, accounting, or regulatory requirements.
  • Legitimate interests: Processing necessary for lawful and proportionate operational interests, such as service security, fraud prevention, and platform reliability, where permitted by applicable law.
  • Consent: Processing based on freely given, specific, informed, and unambiguous consent where consent is the appropriate legal basis.

We seek to ensure that personal information is processed only for legitimate purposes and that the nature and extent of processing remain proportionate to those purposes.

Security and confidentiality

We take the security and confidentiality of personal information seriously.

Dehash It maintains technical and organizational safeguards designed to protect information against unauthorized access, unlawful disclosure, alteration, misuse, accidental loss, and destruction.

Our approach to information security incorporates appropriate access controls, authentication measures, operational monitoring, and security management practices.

Access to personal information is limited according to legitimate operational requirements.

We review our security practices as necessary to address evolving risks and maintain appropriate protection for information processed through our services.

While we take reasonable precautions, no digital service or electronic transmission method can guarantee absolute security.

Customers are responsible for safeguarding their account credentials and API keys and implementing appropriate security measures within their own systems.

Sharing and disclosure

We do not sell or rent personal information.

We may disclose limited information to trusted service providers where necessary to operate our platform, facilitate payments, maintain infrastructure, provide technical support, or fulfill other legitimate service requirements.

Where applicable, such providers are expected to handle personal information in accordance with appropriate confidentiality, security, and data protection obligations.

We may also disclose information when required by applicable law, a valid court order, lawful regulatory request, or other legally binding obligation.

Where legally permitted, information may be disclosed when reasonably necessary to investigate fraud, enforce our terms, protect our rights, or respond to threats affecting our services or users.

We do not disclose personal information to unrelated third parties for their independent marketing purposes.

When transactional email is enabled, we use Resend to deliver sign-in and verification codes, team invitations, and optional low-balance alerts to verified organization Owners. This involves sharing the recipient email address and message with that provider. Low-balance alerts are email-only; organization Owners and Admins can change that preference. Turning them off does not turn off security or invitation messages. A phone number saved in your profile is not used as a verification or notification destination.

Data retention

Email verification codes expire after ten minutes. Temporary encrypted delivery copies are erased after delivery acceptance, cancellation, or expiry. Verification challenge metadata is removed once its expiry is more than 24 hours old; delivery metadata is retained for up to 30 days after completion. Notification event and recipient delivery metadata is removed after 30 days once completed or cancelled (including exhausted delivery attempts); organization alert preferences and the minimum wallet observation/cooldown state remain while the organization is active. Pending invitations expire after seven days, releasing reserved seats. Invitation contact details and credential bindings are erased within 30 days after closure. Authorized support and finance operators can inspect account and organization records and perform permitted actions, which are audited. Operator sessions expire within two hours (or fifteen idle minutes); terminal session records are removed after 30 days. Security audit records and financial records are retained separately.

We retain personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected or to comply with applicable legal and regulatory obligations.

Retention periods depend on the category of information, the purpose of processing, operational requirements, and applicable recordkeeping laws.

Account information is generally maintained for the duration of the customer relationship and may be retained afterward where necessary to meet lawful obligations.

Operational and usage information is retained in accordance with applicable retention practices.

Financial and transaction records may be retained for longer periods where required by taxation, accounting, financial reporting, or other applicable legislation.

Where personal information is no longer required, we take appropriate steps to securely delete, anonymize, or otherwise dispose of it, subject to applicable legal requirements.

Your data protection rights

We respect the rights of individuals under Kenya's Data Protection Act, 2019, and other applicable legislation.

Subject to relevant legal requirements and exceptions, individuals may have the right to:

  • Be informed: Understand how and why their personal information is collected and processed.
  • Access: Request information about personal data held about them.
  • Correction: Request the correction of inaccurate, incomplete, or misleading personal information.
  • Objection: Object to certain processing activities where permitted by law.
  • Deletion: Request the deletion of personal information where legally applicable.
  • Restriction: Request restrictions on processing in circumstances recognized by applicable law.
  • Data portability: Exercise applicable rights to receive or transfer personal information.

We may request reasonable information to verify the identity and authority of individuals submitting data protection requests.

Certain requests may be subject to legal limitations, including obligations requiring the continued retention of specific records.

Where Dehash It acts as a Data Processor, we may refer relevant requests to the responsible Data Controller or assist that controller in fulfilling its legal obligations.

Individuals may also submit complaints to Kenya's Office of the Data Protection Commissioner.

International data transfers

Our services may involve technology or infrastructure providers operating in different jurisdictions.

Where personal information is transferred or processed outside Kenya, we take appropriate steps to comply with applicable cross-border data transfer requirements.

Such measures may include contractual safeguards, appropriate data protection arrangements, and other protections required under applicable law.

We seek to ensure that international processing arrangements maintain an appropriate level of protection for personal information.

Cookies and similar technologies

Our website may use cookies and similar technologies necessary for authentication, session management, security, and essential platform functionality.

These technologies help maintain secure user sessions and support the reliable operation of our services.

Where additional technologies requiring consent are introduced, we will provide appropriate information and choices in accordance with applicable law.

You may manage certain cookie preferences through your browser settings. However, disabling essential cookies may affect the availability or functionality of some services.

Account closure

Customers may request account closure by contacting our support team or through account-management features made available on the platform.

Following account closure, associated personal information will be handled in accordance with our retention practices and applicable legal obligations.

Certain financial, transaction, security, and compliance records may need to be retained for legally required periods.

Account closure does not automatically result in the immediate deletion of information that we are required or lawfully permitted to retain.

Where applicable, outstanding billing matters and account balances will be addressed in accordance with our Terms of Service and relevant law.

ODPC registration

Dehash It is registered with Kenya's Office of the Data Protection Commissioner (ODPC) in the following capacities:

  • Data Controller: Registered.
  • Data Processor: Registered.

These registrations reflect our recognition of the regulatory responsibilities associated with collecting, processing, and managing personal information.

We are committed to maintaining appropriate data protection practices and meeting the obligations applicable to our processing activities under Kenya's Data Protection Act, 2019, and its implementing regulations.

Registration with the ODPC does not constitute regulatory endorsement of individual products, processing methods, or security controls.

Changes to this Policy

We may revise this Privacy Policy periodically to reflect changes in our services, business practices, legal obligations, or applicable data protection requirements.

Updated versions will be published on our website with a revised effective date.

Where required by law, we will provide additional notice of material changes affecting how personal information is processed.

We encourage customers to review this Policy periodically.

Contact us

For questions about this Privacy Policy, requests concerning personal information, or inquiries regarding our data protection practices, please contact:

Dehash It

Email: support@dehashit.com

Website: https://dehashit.com

We will review and respond to privacy-related inquiries in accordance with applicable legal requirements.

If you believe your personal data has been processed in violation of applicable data protection law, you may also contact Kenya's Office of the Data Protection Commissioner.

Dehash It is committed to responsible data processing, regulatory accountability, and protecting the privacy of individuals whose information is handled through our services.