Politiki y'Ibanga

About this policy

This Privacy Policy explains how Shaka Labs (“Shaka”, “we”, “us”) handles personal data when you use Shaka at mail.shaka.rw. It is effective 16 October 2026. Related documents: Terms of Service and Data Processing Agreement.

Shaka Labs, a private company limited by shares registered by RDB, company code and TIN 156935461, registered office Kaminuza, Bugoyi, Gisenyi, Rubavu District, Western Province, Republic of Rwanda. Company site: shaka.rw.

This policy follows Law Nº 058/2021 of 13/10/2021 relating to the protection of personal data and privacy in Rwanda. It is not a substitute for legal advice.

Data protection contact

Write to info@shaka.rw with the subject “Data protection”, or call +250 799 762 749 (Monday to Friday, 8:00 to 17:00 Kigali time). We answer requests about your rights within 30 days.

Who is controller and who is processor

Shaka Labs is the controller of account, billing, device, and service-usage data we collect to run Shaka (for example your name, mailbox address, password hash, session cookies, Mobile Money phone, payment records, and support mail you send to us).

Your organisation is the controller of mailbox content, drafts, attachments, organisation chat, and similar customer content. We process that content as a processor on your documented instructions, which are these product functions plus the Data Processing Agreement. If you are an employee using a company mailbox, your organisation, not Shaka, decides why that mail is stored.

Data we collect

Account and service data (controller):

• Mailbox local-part and domain, display name, optional phone, role (admin or not), delivery mode, and forward address.
• Password hashes (not plaintext passwords), session tokens, multi-account roster cookies, and a device identifier cookie.
• If you sign in with Google: your Google account email and name, as Google shares them with us.
• Language and theme preferences (cookies).
• Billing: organisation plan, mailbox quota, period, IntouchPay references, payer phone, amounts in RWF, and payment status.
• Partner accounts: name, personal email, payout Mobile Money number, referral code, hashed click IP and user-agent, attributed organisations, commissions, and payouts. Before paying a partner we may also ask for their full legal name and ID or TIN.
• API keys (hashed or stored for verification), CLI device approval records, web-push subscription endpoints, and optional avatars or organisation logos.
• Limited operational logs and Cloudflare platform telemetry. We do not run a third-party product-analytics SDK (no Google Analytics, Plausible, or PostHog in the app).

Customer content (processor):

• Inbound, sent, draft, and trash email, including headers, bodies, and attachment files.
• Organisation chat messages, membership, receipts, and chat media.
• AI summaries, reply suggestions, and assistant conversation history.
• Client Mailbox API traffic bound to a service mailbox, including webhook deliveries you configure.

How we use data

We use controller data to:

• Create and authenticate accounts, keep you signed in, and switch among mailboxes on one browser.
• Bill organisations, send payment receipts, pay partners, and prevent fraud or unpaid abuse.
• Provide, secure, debug, and improve the service, and to communicate about it.
• Comply with law and enforce the Terms.

We process customer content only to provide the functions you use: store and display mail, send via our sending provider, forward when configured, search, chat, AI assistance, and API access.

We make no automated decisions that have a legal or similarly significant effect on you.

Lawful basis

For Rwanda Law 058/2021, we rely on: performance of a contract (providing Shaka); legitimate interests in securing and operating the service and in crediting the partner who referred you (the referral cookie); consent where you opt into optional features such as web push; and legal obligation where we must retain or disclose data, such as tax records. Organisations using us as a processor must have their own lawful basis for the content they store.

Who can open your mailbox

Shaka Labs platform staff, and each organisation’s administrator (the info@ mailbox of its domain), can open the mailboxes of that organisation for support or administration. Every such access is logged. Staff open a mailbox only to run, secure, or support the service, or when the law requires it.

AI processing

When you open an email, its text is sent automatically to Cloudflare Workers AI to suggest replies. In chat, the last message is sent to suggest replies. When you use the assistant, the mail, chat, and account context it needs for your request is sent too, and the conversation is stored in our database so you can continue it.

The models, all run by Cloudflare Workers AI:

• GLM-4.7-Flash for text: summaries, reply suggestions, and the assistant.
• Whisper to turn audio attachments into text when the assistant reads them.
• Llama 3.2 Vision or LLaVA to describe images when the assistant reads them.

Under Cloudflare’s terms, Cloudflare does not use your content to train models, and neither do we. We do not sell this content.

You can turn AI assistance off in your Profile, under AI assistance. When it is off, opening an email or chat sends nothing to Workers AI.

Processors and subprocessors

We use these companies to run the service:

Customer content is stored in Cloudflare D1 (structured data) and R2 (files). Chat fan-out uses Durable Objects. The same list appears in the Data Processing Agreement.

Where your data is stored

Your data is stored outside Rwanda. Our database and file storage are located in Western Europe (Cloudflare D1 and R2). Outbound mail passes through the United States (Resend, using Amazon SES). Cloudflare runs AI and email routing on its global network. By using the service you instruct us to transfer customer content to these processors as needed to provide Shaka.

Safeguards: each processor is bound by a contract with data-protection terms, data is encrypted in transit (HTTPS and TLS), and we send each processor only what its job needs.

Cookies

Cookies needed to run the product:

• mail_session: signed-in mailbox session.
• mail_accounts: roster of mailboxes signed in on this browser (up to the product limit).
• mail_device: device identifier used with the account roster.
• shaka_locale, shaka_theme, and shaka_theme_resolved: your language and light or dark theme.
• google_oauth and google_pending: short-lived, only while you sign in with Google.
• mcp_oauth_req: short-lived, only while you connect an AI app to your mailbox.

Referral cookie, not needed to run the product: shaka_ref stores the code of the partner whose link you opened, for 30 days, across shaka.rw and mail.shaka.rw, so we can credit that partner if your organisation signs up. It holds no other data about you.

We use no advertising cookies. Native desktop and mobile shells load the same web app and use the same cookies inside the webview.

How long we keep data

We may keep data longer if the law requires it or to resolve a dispute.

When we share data

We do not sell personal data. We share it with the processors listed above; with your organisation’s administrator (as described in “Who can open your mailbox”); if you forward mail, with that destination; if you use the API, with systems you authorise; and with authorities when legally required. A payment receipt is emailed to the paying user.

Data breaches

If a personal data breach happens, we tell the National Cyber Security Authority (NCSA) within 48 hours of becoming aware of it, and we tell affected customers without undue delay.

Your rights

Under Rwandan law you may ask to access, correct, delete, or restrict personal data we control, to object to processing, and to receive a copy of your data. You can download your mail yourself from your Profile, under Your data, Download my mail. Write to info@shaka.rw with the subject “Data protection”. We answer within 30 days. If your request concerns mailbox content, we may redirect you to your organisation’s administrator, who is the controller of that content.

You can complain to the National Cyber Security Authority (NCSA), the data protection authority in Rwanda.

Children

Shaka is a company email product. It is not directed at children. Organisations must not create mailboxes for children except where they have a lawful basis and appropriate safeguards.

AI models

Built with Llama. Llama 3.2 is licensed under the Llama 3.2 Community License, Copyright © Meta Platforms, Inc. All Rights Reserved. We also use GLM-4.7-Flash (Z.ai) and Whisper (OpenAI), run by Cloudflare Workers AI.

Changes

We post updates on this page and change the effective date. For a material change, we email organisation administrators at least 30 days before it takes effect.

Contact

Privacy questions: info@shaka.rw (subject “Data protection”) or +250 799 762 749.