Privacy Policy
Last updated: 21 October 2026
Switchgear is a communications and verification platform operated by Brivo Synaptics ("we", "us"), a company registered in Zambia. Businesses use Switchgear to send messages to, receive messages from, and verify their own customers over SMS, email, WhatsApp, push notifications and USSD.
This policy explains what personal data we handle, why, who we share it with, how long we keep it, and the rights you have. We follow the Data Protection Act No. 3 of 2021 of Zambia.
If you received a message from a business through Switchgear, that business decides why and how your data is used, and is the controller of it. We process your data on its behalf and only on its instructions. For questions about why you were contacted, contact that business first. You can also contact us, and we will help or pass your request on.
1. Who this policy covers
- Business customers: people who sign up for, administer or use a Switchgear account on behalf of a business. For this data, Brivo Synaptics is the controller.
- Recipients: people whom a business contacts or verifies through Switchgear, or who message a business's number or channel. For this data, the business is the controller and Brivo Synaptics is its processor.
- Visitors to switchgear.app.
2. Data we collect
From business customers
- Account details: name, work email address, phone number, role and password (stored only as a secure hash).
- Business details for approval ("know your business"): registered business name, registration number, tax number, address, sender-ID paperwork and the documents you upload to support them.
- Billing details: plan, wallet balance, top-ups, invoices and payment references. We do not store full card numbers.
- Usage and technical data: API requests, API key identifiers, IP addresses, settings changes and audit records.
About recipients, on a business's behalf
- Contact details the business sends us: phone number, email address, WhatsApp number or device push token.
- Message content: the template and variables or text the business sends, and replies or inbound messages you send to the business.
- Delivery information: whether a message was sent, delivered, read or failed, with timestamps and the provider's status codes.
- Your WhatsApp profile name and WhatsApp ID, when you message a business on WhatsApp.
- Consent and opt-out records: whether you agreed to be contacted or asked to stop.
- Verification data, when a business uses those services: one-time codes (stored only as a hash), and where offered, identity numbers, identity document images and selfie or liveness captures, with the result of each check.
- USSD session data: your mobile number, the menu steps and your inputs.
From visitors
Our hosting and network providers record basic request logs (IP address, browser type, page requested, time) to keep the site secure and working. This site does not use advertising or tracking cookies.
3. How we use data
- To provide the service: deliver messages, route them through the right provider, run verifications, and return results and delivery receipts to the business that requested them.
- To run business accounts: sign-in, approval of businesses for production use, billing, support and service announcements.
- To keep the platform safe: prevent fraud, spam and abuse, enforce opt-outs, and detect security incidents.
- To meet legal obligations, such as tax records, lawful requests from authorities, and telecommunications rules.
We do not sell personal data. We do not use recipients' data for our own marketing, and we do not use message content to build advertising profiles.
4. Legal basis
For business customers, we rely on performing our contract with you, our legitimate interest in running a secure service, and legal obligations. For recipients, the business that contacts you is responsible for having a lawful basis, such as your consent or a service you use, and we act on its documented instructions.
5. Who we share data with
We share personal data only with the service providers needed to deliver the service, under contracts that protect it:
| Provider | Purpose |
|---|---|
| Meta Platforms (WhatsApp Business Platform) | Sending and receiving WhatsApp messages |
| SMS gateways and mobile network operators (for example Africa's Talking, MTN, Airtel, Zamtel) | Sending and receiving SMS, and USSD sessions |
| Email delivery providers (for example Resend) | Sending email |
| Google Firebase Cloud Messaging | Push notifications to apps |
| Identity verification providers | Identity checks a business requests |
| Cloudflare and our hosting providers | Network security, hosting and storage |
We also share data with the business that sent or received a message, with authorities when the law requires it, and with a buyer if Brivo Synaptics or Switchgear is sold or merged, under the same protections.
6. International transfers
Some providers above, including Meta, Google and Cloudflare, process data outside Zambia. When data leaves Zambia, we rely on the safeguards the Data Protection Act allows, such as contractual protections and the providers' own security commitments.
7. How long we keep data
- Messages, delivery records and verification evidence: by default 90 days in production and 7 days in sandbox, unless the business sets a different period or the law requires longer. Verification decisions may be kept after the evidence is deleted.
- Opt-out records: as long as needed to honour your request.
- Audit records of account and configuration changes: up to 7 years.
- Business account and billing data: for the life of the account and afterwards as long as tax and accounting law requires.
8. How we protect data
Data is encrypted in transit (TLS). Phone numbers, identity data and verification evidence are encrypted at rest. API keys and passwords are stored only as hashes. Access is limited to people who need it, and every administrative action is logged. Our logs do not store message bodies, codes, identity numbers or full phone numbers.
9. Your rights
Under the Data Protection Act you may ask to access your data, correct it, delete it, restrict or object to its use, or receive a copy. You may also withdraw consent where we rely on it. To stop receiving messages from a business, reply with the opt-out word the message gives (for example STOP), or contact the business.
To make a request, see Data deletion or email us at the address below. We answer within 30 days. If your data is held for a business, we pass the request to it and help it respond. If you are not satisfied, you may complain to the Office of the Data Protection Commissioner of Zambia.
10. Children
Switchgear accounts are for businesses and are not meant for children. Businesses must not use Switchgear to contact children unlawfully.
11. Changes
We will update this page when our practices change and change the date at the top. For significant changes, we will notify business customers by email or in their account.
12. Contact
Brivo Synaptics, Zambia
Email: brivosynaptics@gmail.com (subject "Privacy")