EN FR RW

Shaka Labs Ltd

Privacy Policy

How Shaka Labs Ltd handles account data and processes your organisation’s mail, chat and attachments.

Effective All legal documents

These documents are in English, and the English text governs. Need help in Kinyarwanda or French? Write to info@shaka.rw.

About this policy

This Privacy Policy explains how Shaka Labs Ltd (“Shaka Labs”, “we”, “us”) handles personal data when you use Shaka at mail.shaka.rw. It is effective 23 August 2026. Related documents: Terms of Service and Data Processing Agreement.

We operate from Kigali, Republic of Rwanda. Contact the data protection contact at info@shaka.rw or +250 799 762 749. Company site: shaka.rw.

This policy is designed around Law Nº 058/2021 of 13/10/2021 relating to the protection of personal data and privacy in Rwanda, and the practical operation of an email host. It is not a substitute for legal advice.

Who is controller and who is processor

Shaka Labs Ltd is the controller of account, billing, device, and service-usage data we collect to run Shaka (for example your name, mailbox address, password hash, session cookies, Mobile Money phone, payment records, and support mail you send to us).

Your organisation is the controller of mailbox content, drafts, attachments, organisation chat, and similar customer content. We process that content as a processor on your documented instructions, which are these product functions plus the Data Processing Agreement. If you are an employee using a company mailbox, your organisation — not Shaka Labs — decides why that mail is stored.

Data we collect

Account and service data (controller):

  • Mailbox local-part and domain, display name, optional phone, role (admin or not), delivery mode, and forward address.
  • Password hashes (not plaintext passwords), session tokens, multi-account roster cookies, and a device identifier cookie.
  • Locale preference (cookie) for Kinyarwanda, English, or French UI.
  • Billing: organisation plan, mailbox quota, period, IntouchPay references, payer phone, amounts in RWF, and payment status.
  • Partner accounts: name, personal email, payout Mobile Money number, referral code, hashed click IP and user-agent, attributed organisations, commissions, and payouts.
  • API keys (hashed or stored for verification), CLI device approval records, web-push subscription endpoints, and optional avatars or organisation logos.
  • Limited operational logs and Cloudflare platform telemetry. We do not run a third-party product-analytics SDK (no Google Analytics, Plausible, or PostHog in the app).

Customer content (processor):

  • Inbound, sent, draft, and trash email, including headers, bodies, and attachment files.
  • Organisation chat messages, membership, receipts, and chat media.
  • AI assistant conversation history when you use the assistant.
  • Client Mailbox API traffic bound to a service mailbox, including webhook deliveries you configure.

How we use data

We use controller data to:

  • Create and authenticate accounts, keep you signed in, and switch among mailboxes on one browser.
  • Bill organisations, send payment receipts, and prevent fraud or unpaid abuse.
  • Provide, secure, debug, and improve the service, and to communicate about it.
  • Comply with law and enforce the Terms.

We process customer content only to provide the functions you use: store and display mail, send via our sending provider, forward when configured, search, chat, optional AI assistance, API access, and backups needed to operate the service.

Lawful basis

For Rwanda Law 058/2021, we rely on: performance of a contract (providing Shaka); legitimate interests in securing and operating the service; consent where you opt into optional features such as web push or the assistant; and legal obligation where we must retain or disclose data. Organisations using us as a processor must have their own lawful basis for the content they store.

Processors and subprocessors

We use:

  • Cloudflare — Workers application hosting, D1 database, R2 object storage, KV, Email Routing, Durable Objects (chat realtime), DNS/zones, and Workers AI.
  • Resend — outbound email. Resend’s infrastructure may include Amazon SES. Receipts and product mail are sent this way.
  • IntouchPay — Mobile Money collections (MTN / Airtel Rwanda).
  • Browser or operating-system push services when you enable notifications (VAPID web push).

Customer content is stored primarily in Cloudflare D1 (structured data) and R2 (files). Chat fan-out uses Durable Objects. Assistant turns are stored in D1 and inferred on Workers AI. A current list also appears in the Data Processing Agreement appendix.

Cookies

We use first-party cookies necessary to run the product:

  • mail_session — signed-in mailbox session.
  • mail_accounts — roster of mailboxes signed in on this browser (up to the product limit).
  • mail_device — device identifier used with the account roster.
  • A locale cookie from our i18n library so the UI language persists.
  • shaka_ref — first-touch affiliate code for up to 30 days, scoped to .shaka.rw in production so checkout on mail.shaka.rw can attribute a referred organisation.

These are not advertising cookies. Native desktop and mobile shells load the same web app and therefore use the same cookies inside the webview.

AI processing

If you use the assistant, suggest-replies, or similar features, mailbox and chat context you trigger is sent to Workers AI (models such as GLM-4.7-Flash) to generate a response. History of assistant threads is stored in our database so you can continue a conversation. We do not sell this content. You can avoid AI features by not opening them; organisation admins who need a stricter rule should instruct their users accordingly.

Retention

Account data lasts for the life of the mailbox and organisation, plus a short period after deletion for backups and dispute handling. Mail follows product folders (including Trash) until you or an admin permanently delete it, or we delete the organisation after termination. Payment records are kept as required for accounting. Push subscriptions last until you disable them or they fail. We may retain data longer if required by law or to resolve a dispute.

When we share data

We do not sell personal data. We share it with processors listed above; with your organisation’s administrators (who can access org mailboxes as the product allows); if you forward mail, with that destination; if you use the API, with systems you authorise; and with authorities when legally required. A payment receipt is emailed to the paying user.

International processing

Cloudflare, Resend, and related infrastructure may process data outside Rwanda. By using the service you instruct us to transfer customer content as needed to those processors to provide Shaka. We select established providers and rely on their contractual and security measures.

Your rights

Depending on your role and Rwandan law, you may request access, correction, deletion, or restriction of personal data we control, and you may complain to the National Cyber Security Authority (NCSA) or other competent authority. Write to info@shaka.rw or call +250 799 762 749. If your request concerns mailbox content, we may redirect you to your organisation’s administrator, who is the controller of that content.

Children

Shaka is a company email product. It is not directed at children. Organisations must not create mailboxes for children except where they have a lawful basis and appropriate safeguards.

Changes

We will post updates on this page and change the effective date. Material changes will be communicated to organisation administrators where practicable.

Contact

Privacy questions: info@shaka.rw or +250 799 762 749.