Privacy policy
Last updated: 9 November 2026
This policy explains how Blast SMS ("we") collects and uses personal data through Blast SMS at https://blastsms.site, our API and our Android and iOS app. We process personal data under the Kenya Data Protection Act, 2019.
Who is responsible
- Your account data: we are the data controller.
- Your contacts and messages: you are the controller and we are your data processor. We process them only on your instructions, to send your messages.
What we collect
| Data | Examples | Why |
|---|---|---|
| Account details | Name, email, phone, company, address, tax number, password (stored hashed) | To create and run your account and to invoice you |
| Payment details | Amount, M-Pesa receipt number, the phone number that paid, payment status | To credit your balance, prevent fraud and keep tax records. We never see your M-Pesa PIN or card number. |
| Contacts you upload | Phone numbers, names, custom fields | To send your messages |
| Messages | Text, sender ID, recipients, delivery reports | To send messages, show reports and handle disputes |
| Usage and device data | IP address, browser or app version, device name, sign-in times | Security, fraud prevention, troubleshooting |
| Support | Ticket messages and attachments | To help you |
Phone contacts in the mobile app. The app reads your phone's address book only when you tap "Phone contacts" and allow access. It then shows the list on your device. Only the contacts you select are uploaded to your account, to send messages to them or add them to a group. The app never reads your contacts in the background. You can withdraw the permission at any time in your phone's settings.
The app does not read your SMS inbox, location, camera or microphone. It stores your sign-in token securely on your device.
The Blast SMS mobile app
The Blast SMS app for Android (package site.blastsms.app) and iOS is published by Blast SMS. It is a client for your Blast SMS account, so this policy covers it in full.
Permissions the app asks for
| Permission | When | Why |
|---|---|---|
| Internet | Always | To talk to https://blastsms.site, the only server the app connects to |
Contacts (READ_CONTACTS) |
Only when you tap Phone contacts and allow it | To show your address book on your device so you can pick recipients or import a group. Only the contacts you select are uploaded. |
The app does not ask for SMS, call log, location, camera, microphone, storage or notification permissions. Files you import (CSV, Excel, vCard, TXT) are opened through the system file picker, which only gives the app the file you choose.
Google Play data safety summary
| Data type | Collected | Shared with third parties | Purpose | Optional |
|---|---|---|---|---|
| Name, email address, phone number | Yes | No | Account management | Required to create an account |
| Contacts (only the ones you select) | Yes | Yes, recipient numbers go to mobile networks to deliver your SMS | App functionality | Yes |
| Messages you send (SMS text) | Yes | Yes, to mobile networks and SMS gateways for delivery | App functionality | Required to send SMS |
| Purchase history (M-Pesa top-ups) | Yes | Yes, with the payment processor | Account management, fraud prevention | Required to buy units |
| Device or other IDs (device name for signed-in devices) | Yes | No | Security | Required |
| App interactions, crash logs, advertising ID | No | No | Not collected | n/a |
- All data is encrypted in transit (HTTPS).
- You can delete your account and data in the app (More → Delete account) or at https://blastsms.site/delete-account.
- The app has no ads and no third-party analytics or tracking SDKs.
Who we share it with
- Mobile networks and SMS gateways (such as Safaricom, Airtel, Telkom and our upstream SMS providers) receive the recipient number, sender ID and message text, so that they can deliver it.
- Payment processors (Safaricom M-Pesa and Mullahc Pay) receive the details needed to take your payment.
- Email and hosting providers that run our infrastructure, under confidentiality obligations.
- Authorities, when the law requires it.
We do not sell personal data or use your contacts for our own marketing.
How long we keep it
- Account data: while your account is open.
- Messages and delivery reports: while your account is open, unless you delete them sooner.
- Payment records: 7 years after the transaction, as Kenyan tax law requires. If your account is deleted, they're kept without your name or phone number.
- Security logs: up to 12 months.
When you delete your account, we permanently erase your profile, contacts, messages, campaigns, templates, sender IDs and support tickets.
Security
Connections are encrypted with HTTPS. Passwords and API tokens are stored only as one-way hashes, payment credentials are encrypted at rest, and two-factor authentication is available. Staff access is limited by role and logged.
Your rights
Under the Data Protection Act you can ask to access, correct, export or delete your personal data, and object to or restrict how we use it. Most of this you can do yourself from your account (profile, contact export, message export, account deletion). For anything else, email hi@blastsms.site. We reply within 30 days. You can also complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).
Transfers outside Kenya
Some of our service providers may process data outside Kenya. When they do, we make sure there are adequate safeguards, as the Data Protection Act requires.
Children
Blast SMS is for businesses and adults. We don't knowingly collect data from children under 18.
Changes
If we materially change this policy, we'll tell you by email or in the dashboard before the change takes effect.
Contact
Blast SMS, Nairobi, Kenya. Email hi@blastsms.site.