Privacy Policy

Last reviewed: 15 November 2026

SautiMetrics ("we", "us", "the platform") processes personal data of people in Kenya for the purpose of running polls, surveys, and public opinion research. This policy explains what we collect, how it's used, and your rights under Kenya's Data Protection Act, 2019.

1. Data We Collect When You Vote in a Poll

When you vote in a public poll, we may record:

• A one-way hash of your phone number, device identifier, and IP address — used only to prevent duplicate voting (one-vote-per-phone/device/IP rules). These are hashed with SHA-256 combined with a server-side secret before storage; the original phone number, device ID, or IP address is never stored in reversible form and cannot be recovered from the hash.
• Gender and age group — only if you choose to share them; both are optional, self-reported fields.
• County, constituency, and ward — used for regional breakdowns of results.
• Whether your vote was OTP-verified, and a fraud-review flag if our anti-abuse checks detect unusual patterns (e.g. many votes from the same network in a short time).

Your raw phone number is not stored alongside your vote.

2. OTP Verification

Some polls require phone verification before voting. When you request a verification code, we temporarily store your phone number in plain text (not hashed) together with a 6-digit code, because we need the real number to send you the SMS. This record expires shortly after issue and is marked used once verified. This is the one place in the platform where your phone number is kept in a form that could, in principle, be read by someone with direct database access — it exists only for the few minutes needed to complete verification.

3. Account Data

If you register an account (to create polls or surveys), we collect:

• Name, email address, and password (your password is stored as an irreversible hash, never in plain text)
• Phone number, if you provide one
• Organization name and type, if applicable
• County, if you select one

4. Payments

Subscription and pay-per-poll payments are processed via M-Pesa (Safaricom Daraja API). When you pay, we store your phone number, the payment amount, an M-Pesa receipt number, and a status/timestamp. We never see or store your M-Pesa PIN, card numbers, or any other payment credential — that information is entered directly with Safaricom and never passes through our servers.

5. SMS Delivery

OTP verification codes are sent via Africa's Talking, a third-party SMS gateway. Sending an SMS necessarily shares your phone number with that provider for delivery purposes.

6. Cookies and Sessions

We use a session cookie to keep you logged in and a CSRF token to protect forms from cross-site attacks. Session data is stored in our database, not in the cookie itself. We do not use advertising or third-party analytics trackers — no cookie categories exist on this platform beyond the essential session and security cookies described here.

7. Your Rights

Under the Data Protection Act, 2019, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data — you can update your name, email, phone, and organization details directly from your profile settings
• Delete your account — this is a self-service feature (Profile → Delete Account) that permanently deletes your account record. Votes, polls, or surveys tied to your account remain in the system for research-integrity purposes, but are dissociated from your identity rather than erased, since votes are already recorded as one-way hashes, not as directly identifying records.

For any other request — including a correction or deletion we haven't automated yet — contact us and we'll process it manually:

• info@sautimetrics.co.ke
• Chat on WhatsApp

8. Related Pages

See our Methodology page for how poll and survey results are calculated and what they do and don't represent, our Terms of Service, and our Data Protection Policy for more on how we comply with Kenyan law.