Privacy policy
Last updated:
This policy covers the Lekalao service and this website. It says what we hold about you, why, for how long, who else sees it, and what you can ask of us.
If you received an e-mail sent through Lekalao by an organisation, that organisation decides what is done with your address: section 7 explains, and how to reach them.
1. Who we are
The controller of the data described here is Lekalao, Douala, Cameroon. For any question about your data, write to hello@lekalao.com; a person answers.
2. Two roles
- For the people who use the service — members of a team — and for the visitors of this site, we decide what is collected and why: we are the controller.
- For the contacts our customers keep in Lekalao — their subscribers, the recipients of their e-mails — the customer decides; we process that data on its behalf and on its instructions, under the data processing agreement: we are its processor.
3. This website
The site sets no cookie, runs no analytics and loads nothing from anyone else: its fonts are served from the site itself. It records nothing about you; the server that answers sees your IP address, as any server must, to send you the page.
Your choice of currency and of the length of a payment, and whether you dismissed the suggestion to read the site in another language, are kept in your own browser (local storage). They never leave it.
When accounts are opened by hand, the site offers a form that subscribes your e-mail address to our own Lekalao list: you first receive an e-mail asking you to confirm, and nothing else is sent until you do. Your consent, its date, the address it came from and the page are recorded, as Lekalao records them for every customer. Every e-mail we send carries a link to leave in one click.
4. What we hold when you use the service
| What | Details |
|---|---|
| Your account | Name, e-mail address, password (stored only as a bcrypt hash), language, two-factor secret and passkeys if you set them. |
| Your team | Its name, its members and their roles, the postal address its e-mails carry, its billing address, its settings. |
| Billing | Plan, period, amount, currency, dates and the gateway’s reference of each payment. Your card or Mobile Money details are entered with Wajub and never reach us. |
| Security | Your sessions, with the IP address and browser they came from, while they last. The activity log: who did what, to what, from which IP address and by which API token. |
| Correspondence | What you write to us, and our answers. |
6. Why, and on what basis
| Purpose | Basis |
|---|---|
| Providing the service, the e-mails it sends you (verification, password, invitations, alerts, period reminders) and support | The contract between your organisation and us |
| Billing and accounting | The contract, and our legal obligations |
| Keeping the service and its users safe: sessions, activity log, abuse prevention | Our legitimate interest, and yours |
| News about Lekalao | Your consent, which you withdraw in one click |
7. The contacts of our customers
When an organisation uses Lekalao, it may keep in it, for its own contacts: e-mail address, name, the attributes it chooses to ask, language, time zone, subscriptions, the record of each consent (source, date, IP address, page), the e-mails sent and whether they were opened or clicked (with the kind of mail client and device), and the events its shop or application reports, such as orders.
Lekalao does not record the IP address of an open or a click, and ships no geolocation database. A person can unsubscribe in one click and manage their preferences from a page of their own.
That organisation is the controller of this data. To exercise your rights over it, write to the organisation that wrote to you: its postal address is at the foot of each of its e-mails. If you write to us instead, we pass your request on to it.
8. Who else sees it
We do not sell personal data, and we do not share it for advertising. It is seen only by:
- the companies that help us run the service, under contract and only for that: they are named on the subprocessors page;
- the sending provider each customer chooses, which receives the e-mails that customer sends, on its instructions;
- an authority, when the law obliges us to answer it.
9. Where it is kept
Where data leaves the country where it is kept for one that does not protect it as well, we rely on the safeguards the law provides, such as the European Commission’s standard contractual clauses, and on the conditions Cameroonian law sets.
10. How long
| Data | Kept |
|---|---|
| Account and team | While the account or the team exists; then deleted as the terms describe |
| Payments | As long as accounting and tax law require |
| Activity log | 400 days |
| Sessions | While you are signed in |
| Opens, clicks, transactional e-mails, webhook deliveries | 365 days, then deleted every night; campaign statistics keep their totals |
| Calls received from sending providers | 30 days |
| Consent records | Five years by default, which each team can change: they are the proof of the right to write |
| People who unsubscribed | As long as the team decides; a team can have them forgotten after a number of days of its choosing |
| Backups | Until they are replaced by newer ones |
11. Your rights
You can ask what we hold about you, have it corrected, receive it as a file, have it erased, object to its use or have its use limited, and withdraw a consent at any time. Write to hello@lekalao.com. We answer within one month; we may ask you to prove who you are.
You may also complain to the authority that protects personal data where you live: in Cameroon, the authority created by law n° 2024/017 of 23 December 2024; in the European Union, the authority of your country.
12. Security
Connections are encrypted, passwords are stored only as hashes, the credentials of sending providers are encrypted in the database, and every change made in a team is written down. The security page says more, and what we do not claim.
13. Children
The service is for organisations and the people who work in them. It is not meant for children, and we do not knowingly hold their data as users.
14. Changes
When this policy changes, the date at the top changes with it. A change that affects what we do with your data is announced to the owners of each team by e-mail before it applies.
Questions about this document: write to hello@lekalao.com