Privacy Policy

At UELLOSEND (operated by UviTech Inc.), protecting the privacy, confidentiality, and integrity of your personal information is central to everything we build.

This Privacy Policy explains how we collect, process, store, encrypt, and safeguard your data when you visit our website (uellosend.com), participate in multiplayer live quizzes, cast votes in Smart Cast pageants, purchase digital event passes, or manage SMS campaigns and API integrations.

Depending on how you interact with our platform (as an anonymous player, registered creator, voter, event attendee, or bulk SMS customer), we collect the following categories of data:

• Account & Profile Data: Username, email address, encrypted password hash (managed via Supabase Auth), profile avatar, and organizational branding assets.
• Payments & Billing: Transaction reference IDs, Mobile Money phone numbers (for MoMo billing), currency, billing name. (Note: Full card numbers and CVVs are handled exclusively by PCI-DSS certified Paystack and are never stored on our servers.)
• Bulk SMS & Contacts: Uploaded recipient phone numbers, message payloads, custom alphanumeric Sender IDs, contact group names, and delivery status logs.
• Telemetry & Game Session Data: Player nicknames, real-time WebSocket connection state, answer submission latency timestamps, scorecards, and anonymous device hash for anti-vote-rigging.

We process collected data exclusively for lawful purposes:

• Platform Operation: Delivering synchronized low-latency quiz multiplayer gameplay, calculating scores, and streaming live audience voting leaderboards.
• SMS Dispatch & Gateway Routing: Transmitting SMS traffic across telecommunication network SMSCs (MTN, Telecel, AT) and maintaining delivery status reports.
• Pass & Ticket Fulfillment: Issuing signed digital QR code passes and verifying authenticity upon venue gate check-in.
• Transaction Accounting & Payouts: Processing creator subscriptions, wallet top-ups, MoMo payouts, and generating verifiable digital receipts accessible at /verify-receipt.
• Fraud Prevention & Anti-Cheat: Detecting bot automation, vote-stuffing, rate-limit evasion, and maintaining game integrity.

We implement industry-leading technical and organizational security controls to protect your data against unauthorized access, destruction, loss, or alteration:

• API Key Encryption (AES-256-GCM): All SMS API keys stored for user retrieval are encrypted at rest using AES-256-GCM authenticated cipher encryption. Key verification is executed strictly via cryptographic SHA-256 hashes.
• Encryption in Transit: 100% of web requests, WebSocket real-time sockets (wss://), and API endpoints are encrypted with TLS 1.3/HTTPS.
• Infrastructure Isolation: PostgreSQL 16 databases and Redis clusters run on dedicated isolated environments with strict access control lists and automated encrypted daily backups.

We share minimal necessary data only with vetted third-party service providers who assist us in operating our platform:

• Payment Processors: Paystack (PCI-DSS Level 1) and Mobile Money aggregators for executing checkouts and payouts.
• Telecommunications Carriers: MTN, Telecel, AT, and authorized aggregator SMS gateways for message routing and USSD casting.
• Authentication & Storage: Supabase Inc. for session token management and encrypted media asset storage.
• AI Language Models: Google Cloud (Gemini), Anthropic, and OpenAI strictly for user-initiated quiz draft generation (no customer contact data is ever sent to AI models).

We believe in radical transparency regarding tracking technologies. You can inspect our complete, itemized storage inventory at any time on our dedicated /cookies policy page.

• Consent Categories: We organize cookies and browser storage into four distinct categories: Strictly Necessary (authentication, security, anti-fraud ballot fingerprints), Preferences (audio volume, viewing currency), First-Party Analytics (self-hosted, cookieless Umami metrics), and Rich Media / Marketing (opt-in YouTube/Vimeo video embeds).
• Regulatory Regimes & Defaults: Depending on your jurisdiction (strict opt-in across the EU/EEA, UK, Switzerland, and the African Union / Ghana, or opt-out / notice regimes elsewhere), non-essential categories are disabled by default until you grant affirmative consent.
• Global Privacy Control (GPC): We automatically detect and honor navigator.globalPrivacyControl browser signals to reject non-essential tracking.
• Changing Preferences: You can reopen your privacy choices at any time via the "Cookie Settings" link in the platform footer or inside your account privacy center.

Regardless of your geographic location, you enjoy comprehensive control over your personal data under the General Data Protection Regulation (GDPR), the Ghana Data Protection Act (Act 843), and international privacy frameworks:

• Self-Serve Privacy Center: Registered creators can manage all data rights directly at /settings/privacy.
• Right to Data Portability (Art. 20): Request a complete, machine-readable archive (ZIP) containing your profile, interactive quizzes, questions, smart casts, organized events, SMS campaigns, contact lists, and invoices.
• Right to Erasure ("Right to be Forgotten", Art. 17): Schedule account deletion directly from Privacy Settings. Your request enters a 14-day cancellable grace period during which you can reverse the decision. Once the grace period expires, all creator assets, quizzes, sessions, attendee rosters, and SMS contact books are permanently purged.
• Wallet Forfeiture Notice: In accordance with platform terms, any remaining AI token credits, SMS units, or unpaid Cast/Event earnings are permanently forfeited upon account erasure with no refund.
• Statutory SLA: All data subject requests are handled within our strict 30-day statutory response window (GDPR Art. 12(3)).

Creator Data Retention: Creator data (quizzes, live game sessions, player nicknames, smart cast setups, and SMS contact lists) is retained for as long as your creator account exists, and is deleted when your account is erased.

Financial & Invoice Retention: Transaction invoices and wallet ledger entries are retained in an anonymized format for statutory tax and anti-money laundering compliance periods (GDPR Art. 17(3)(b)).

Proof of Consent: Audit logs of privacy consent choices are retained for five years to satisfy regulatory evidentiary burdens, with personal identifiers detached upon account erasure.

Children's Privacy: UELLOSEND does not knowingly collect personal data from children under 13. When students participate in educational live quizzes, no personal email or account registration is required—students join anonymously with a temporary Game PIN.

If you have any questions, concerns, or requests regarding this Privacy Policy or how your personal information is handled, please contact our Data Protection Officer:

• Data Protection Office: UviTech Inc. / UELLOSEND
• Email: privacy@uellosend.com
• Support & Trust Desk: support@uellosend.com
• Physical Address: Accra, Ghana