Who we are and how to contact us
Huragon Technologies is registered in Kenya and is based in Kisii, Kenya. We provide software for internet service providers (ISPs) to manage subscribers, network access, billing and operations. This notice explains how personal information is handled through our website, tenant workspaces, support and enabled services. Our privacy and support contact is [email protected]. Use the subject Privacy request for personal-information enquiries. Do not include passwords, payment PINs or unnecessary identity documents in your first message.
For account administration, platform subscription billing, website operation and our support records, Huragon determines the purposes of processing. When an ISP enters subscriber information or uses Huragon to operate its service, the ISP generally determines why that information is used and Huragon processes it to provide the service on the ISP's instructions. The actual responsibilities depend on the activity and applicable law. Your ISP remains your first contact for questions about your internet subscription, service eligibility and its own privacy practices.
Information handled by the service
- Account and organization information: company and staff names, usernames, email addresses, telephone numbers, country, localization preferences, roles, branding and account status.
- Subscriber information supplied by an ISP or its customers: identifiers, contact details, location or service notes, assigned packages, account status and connection credentials needed for network provisioning.
- Billing and payment information: amounts, currency, references, telephone numbers used for payments, payment attempts and results, invoices, receipts, subscription records and expenses entered by staff.
- Network and device information: router identifiers and configuration, IP/MAC addresses, session start and stop times, usage counters, diagnostics, connectivity and performance records, and network-map information entered by the ISP.
- Operational and support information: notifications, campaign information, support requests and records of administrative activity. Data available depends on the features used and permissions granted.
We do not ask users to enter a mobile-money PIN into Huragon. Payment authorization takes place through the payment provider's supported flow. Never send payment PINs to support or enter them into subscriber notes.
Sources and reasons for using information
Information comes from account holders, authorized ISP staff, subscribers using supported portals, connected routers, payment-provider notifications and operational use of the service. We use it to authenticate accounts, apply staff permissions, provision network access, maintain subscriber records, process payment confirmations and renewals, produce reports, deliver configured notifications, troubleshoot problems and protect the service against misuse.
Where applicable law requires a legal basis, the basis depends on the purpose: performing an account/service agreement, complying with a legal obligation, legitimate operational and security interests subject to applicable safeguards, or consent where a specific optional activity requires it. An ISP must establish its own lawful basis for subscriber processing and communications. Accepting platform terms is not blanket consent to every processing activity or to marketing.
Payments and external services
For enabled Safaricom M-Pesa/Daraja flows, payment requests and confirmations involve Safaricom and the approved merchant configuration. Information can include a payment telephone number, amount, merchant/account reference, transaction identifier and result. A recorded request is different from a confirmed payment. Provider terms and privacy notices also apply to the provider's processing.
Huragon subscription payments and an ISP's subscriber collections are separate activities. The recipient merchant and collection arrangement depend on the approved configuration. Huragon does not represent that all funds pass through Huragon or that a configured provider is available in every country. Manual records may contain references entered by authorized staff.
Enabled messaging services, hosting/infrastructure services and optional AI providers process information needed for their respective functions. Providers vary with deployment and tenant configuration. Ask support for the current applicable provider and processing-location information before enabling an integration that needs your organization's approval. We do not describe configuration-only payment options as operational collection services.
Sharing and access
Authorized staff can access information according to their account permissions. Platform administration and support may require access for service operation, investigation or assistance. Tenant owners should grant the minimum necessary permissions and review staff access regularly.
Information may be shared with service providers needed to deliver enabled functions, a competent authority when lawfully required, or advisers where needed to address disputes, security or legal obligations. We assess requests against applicable requirements. We do not make subscriber information available to another tenant as part of normal service operation.
Processing locations and international transfers
Cloud infrastructure and external providers may process information outside the ISP's or subscriber's country. Before transferring information where restrictions apply, the relevant parties must establish the required safeguards or other lawful mechanism. Contact support for the applicable locations and arrangements; do not assume that choosing a country or timezone in settings changes data residency.
Retention, exports and deletion
Information is retained according to the purpose for which it is needed, account/service operation, applicable recordkeeping requirements, security investigations and lawful preservation obligations. Different records may have different retention requirements. A universal fixed retention period does not apply to every record.
Available exports depend on the module and staff permissions. Contact support about account closure, data-return arrangements or deletion requests. Deleting an item in a workspace should not be assumed to erase every related record, provider copy or backup immediately. Any retained information remains subject to applicable restrictions. Ask for the current retention and backup-deletion arrangements before relying on a particular deletion deadline.
Security and your responsibilities
The service uses account authentication, permission controls and tenant-scoped access to limit access to information. No networked service can promise absolute security. Protect staff accounts, router credentials and integration keys; remove access when staff leave; avoid placing secrets in free-text notes, screenshots or support messages. Report suspected unauthorized access promptly to [email protected].
Cookies, local storage and installed apps
Dashboard sessions use cookies to recognize authenticated users. Browser storage may retain interface preferences such as appearance and navigation settings; installed-app mechanisms may cache application assets. These have different purposes from subscriber records held by the server. Clearing local browser storage does not delete the organization's server-side records. Browser notification permission can be withdrawn in browser/device settings.
The help centre does not add advertising analytics or tracking. Any future optional tracking should be explained and obtain any consent required before it operates.
Individual requests and complaints
Depending on applicable law, individuals may have rights to information, access, correction, objection, restriction, portability or deletion, and to withdraw consent where processing relies on consent. Rights have legal conditions and exceptions. Requests about subscriber service data should normally go to the relevant ISP; we can help identify or route the request where appropriate.
Contact [email protected] describing your relationship to the service and the request. We may need proportionate identity verification or authorization before disclosing or changing information. We will explain the applicable process and respond within legally required timeframes. You may also contact the competent data-protection authority in the relevant country.
Sources of information and account authority
Information reaches the service when an owner registers a workspace, staff create or import records, a subscriber uses a supported purchase or renewal journey, a router or enabled provider reports an event, or a person contacts support. The information received depends on the feature being used. An ISP may supply information collected through its own forms or subscriber relationships.
The ISP must explain its own collection practices and ensure that records are relevant, accurate and lawfully obtained. We do not independently verify every statement entered by a tenant. Correcting a Huragon record does not automatically correct a separate payment, messaging or network provider's originating records.
An account owner chooses staff access. Staff should use individual accounts and the minimum permissions needed for their role. We may request proportionate evidence of account ownership or authority before transferring an account, recovering access, investigating a disputed instruction or releasing an export.
Payment records and merchant credentials
A supported collection can involve the payer's telephone number, amount, currency, purchase/account reference, intended merchant, provider transaction identifier, request identifiers, timestamps and result codes. A provider may separately request merchant verification or identity information under its own agreement. The information needed to collect an ISP's subscriber payment differs from the information used to administer that ISP's Huragon subscription invoice.
For the implemented Safaricom Daraja flow, authorised requests and provider results are used to match transactions to the relevant tenant and subscriber purchase. Providers listed in country guides are external onboarding references unless a working connector has been separately made available. Listing a provider does not automatically send data to it.
Customers authorise payments through their provider's trusted phone prompt or checkout. Staff must not ask a customer to disclose a mobile-money PIN, bank password or one-time authorisation code to Huragon. Merchant keys, API secrets and callback tokens are operational credentials; protect them and do not include them in subscriber notes, public screenshots or AI prompts.
The provider independently determines its merchant verification, funds handling, dispute procedures, fraud controls and legally required record retention. A deletion or correction in Huragon does not necessarily remove a provider's transaction records.
Automated account and service operations
Configured workflows may calculate expiry, record a verified payment result, determine a service period, create access instructions, send a scheduled notification or apply tenant-defined operating rules. They can depend on package duration, account status, payment state, the tenant's configuration and router reachability.
A pending request is not a confirmed receipt. A confirmed payment does not guarantee that an unreachable router has already applied the related access instruction. A dashboard classification can have an operational explanation rather than represent a final determination about a person.
Contact the responsible ISP to question an access state, renewal, compensation calculation or account classification. The ISP can investigate and seek Huragon support where needed. Where applicable law provides rights concerning an automated decision, the responsible controller will assess the request and any required human review. Optional AI assistance is separate from these ordinary configured billing and network rules.
Support, operational access and exports
Authorised Huragon personnel may access relevant information to provide requested support, diagnose an incident, secure the service, enforce applicable terms or comply with a lawful obligation. Access should be appropriate to the task. We may need the ISP's authorisation before investigating a subscriber record or acting on a request that affects someone else's access.
Provide only the information necessary for a support case. Redact unrelated subscribers, private management addresses where unnecessary, API secrets, payment tokens and identity documents. Do not send a complete subscriber list merely to explain a problem affecting one transaction.
An exported spreadsheet, local download, screenshot or record copied into an external messaging tool leaves the application's access controls. The person handling that copy must protect it, limit recipients and dispose of it appropriately. Removing access to Huragon does not retrieve copies already downloaded by an authorised user.
Retention criteria by record type
Retention reflects the purpose of a record and the requirements that apply to it. We do not claim that all information is erased after one universal number of days.
- Platform account and staff records are needed while the account is administered and may be retained afterwards for closure, disputes, security and applicable legal obligations.
- Subscriber and service records are processed for the ISP's service operation and lawful instructions, subject to recordkeeping and preservation duties.
- Billing, receipt and payment-reference records may be needed for reconciliation, accounting, tax, disputes, reversals and fraud investigation.
- Network, device, diagnostic and security records are needed to operate the service, investigate abuse and resolve faults; their retention should reflect those purposes.
- Support correspondence is retained as needed to resolve requests, maintain relevant service history and handle complaints or legal requirements.
- Published agreement versions and acceptance records provide evidence of the terms and authority accepted at a particular time. Closure does not automatically remove evidence retained for a lawful purpose.
- Backup copies follow the applicable backup and expiry process. A restoration, investigation or lawful hold can affect when a particular copy can be removed.
Contact support for current arrangements relevant to your account, provider locations or a specific deletion deadline. Choosing a country, currency or timezone in settings does not itself choose a hosting location or statutory retention schedule.
Returning information and closing an account
Before closure, an authorised owner should request the available exports and confirm the scope of each file. A report or module export may not contain every account record or constitute a complete database backup. Store exports securely and share them only with authorised recipients.
We assess return, correction and deletion requests against account authority, the ISP's instructions, applicable law, outstanding disputes, security investigations and recordkeeping requirements. Where we process information for an ISP, we may refer the request to that ISP or assist its response rather than make an unauthorised decision about its records.
Removing an item from an active interface can differ from removal from related records, scheduled backups or independent provider systems. Information retained for a necessary lawful purpose remains protected and should be used only for that purpose. We will explain relevant restrictions instead of promising immediate erasure from every system.
Public documentation and abuse prevention
The help centre contains product guidance and fictional examples. It must not contain live subscriber records, working keys or private router configuration. Requests expose ordinary connection information, such as an IP address, requested page, timestamp and browser/user-agent information, to the web infrastructure.
The documentation service keeps temporary request counts to limit excessive access and restricts declared automated crawlers. These controls protect availability and discourage unauthorised collection. They do not add advertising profiles, a browser fingerprint or a new tracking identifier. Hosting and security infrastructure may maintain operational logs under their applicable arrangements.
Public pages can be copied by people or tools that disregard access preferences. Crawler restrictions do not make a public page confidential. Use an authenticated support channel for material that should be restricted.
Incidents and requests from authorities
When we become aware of a suspected incident, we assess the scope, take appropriate containment and recovery steps, and consider affected accounts, provider involvement and reporting requirements. Where required by law or an applicable agreement, we notify the responsible controller, affected people or competent authority. A suspected issue does not necessarily mean that every tenant's information was accessed.
We assess requests from authorities and disclose information where a valid legal basis requires or permits it. We may seek clarification, limit a response to relevant records, or notify an affected customer where lawful and appropriate. We cannot promise notice where a legal prohibition prevents it.
Complaints in Kenya
Huragon Technologies is based in Kisii, Kenya. Contact [email protected] so we can understand and address a privacy concern. This does not prevent a complaint to Kenya's Office of the Data Protection Commissioner or another competent authority.
The ODPC publishes data-subject rights and its official complaint/contact procedures. Applicable rights, exceptions, proportionate identity checks and response periods depend on the request and relevant law. Support is not conditional on surrendering a non-waivable privacy right.
Children and updates
Tenant accounts are intended for people authorized to act for an ISP. ISPs serving children must assess applicable age, guardian, notice and safeguarding requirements for their own services. Contact support if you believe information has been collected improperly.
Published versions carry a publication date. We may update this notice when the service or applicable requirements change and provide additional notice where required. Historical published versions remain available through their version links.