Legal

Privacy Policy

Last updated: June 2026

This Privacy Policy explains how Zyntel Co. Limited ("Zyntel", "we", "us") collects, uses, and protects information about you when you use our websites and products (KantaHub, zyntForms).

1. Who we are

Zyntel Co. Limited is a technology company incorporated in Uganda and headquartered in Kampala. We build operational intelligence software for healthcare and regulated industries.

2. Information we collect

Information you provide

  • Account information: name, email address, organisation name
  • Contact form submissions
  • Data you enter into KantaHub or zyntForms (equipment records, lab results, form responses)

Payment and financial information (zyntForms creators)

If you enable payment collection on a zyntForms form, we collect payout details so we can disburse funds to you after a successful payment. Depending on your chosen disbursement method, this may include:

  • MTN or Airtel Mobile Money phone number
  • Bank name, branch code, account number, and account holder name

This information is stored securely and used solely to process disbursements to you via our payment processor (Pesapal). It is never sold, rented, or used for any purpose other than completing payouts you have authorised. We do not store card numbers or full payment credentials of form respondents — payment card and MoMo collection is handled entirely by Pesapal and never touches our servers.

Information collected automatically

  • Log data: IP address, browser type, pages visited, timestamps
  • Device information: operating system, screen size
  • Usage data: features used, actions taken within the product

3. How we use your information

  • To provide, maintain, and improve our products
  • To respond to support requests and contact form submissions
  • To send important product and security updates (not marketing unless you opt in)
  • To comply with legal obligations applicable in Uganda and any jurisdictions we operate in

4. Data storage and security

Your data is stored on Neon PostgreSQL (serverless Postgres) with encryption at rest and in transit. Hosting is provided by Railway. We apply role-based access control so only authorised team members can access production data. We do not sell your data to third parties.

Financial credentials (payout details): Mobile Money numbers and bank account details provided for payouts are stored in our database with the same encryption-at-rest protections as all other data. Access is restricted to the automated payout system and authorised Zyntel staff. These details are transmitted to Pesapal (our payment processor) over TLS-encrypted connections solely to execute disbursements. We retain payout records for 7 years in accordance with Ugandan financial record-keeping requirements.

zyntForms — anonymous sessions: If you create a form without registering an account, your form and any responses collected are stored for 14 days. After 14 days, all data from unregistered sessions is permanently and automatically deleted. Creating an account before the 14-day window preserves your data indefinitely under your account.

5. Third-party services (sub-processors)

We use the following third-party services to operate our products. Each has its own privacy policy and meets adequate data protection standards.

  • Neon — PostgreSQL database hosting (AWS infrastructure, EU Central region)
  • Railway — application hosting and deployment
  • Cloudflare R2 — file storage for generated PDF tickets and receipts (signed URLs only — no public access)
  • Resend — transactional email delivery
  • Pesapal — payment collection and creator disbursement (MTN MoMo, Airtel Money, bank transfer). Your payout details are shared with Pesapal solely to execute disbursements you have authorised. Pesapal is a licensed payment service provider regulated in Uganda.
  • Africa's Talking — SMS and WhatsApp message delivery for ticket and receipt notifications
  • PostHog — product analytics (anonymised usage events; no response data is sent to PostHog)
  • Upstash — Redis-based rate limiting (IP addresses only; not linked to personal accounts)

6. Data retention

We retain your data for as long as your account is active or as required by law. You may request deletion of your account and data at any time by emailing [email protected]. We will process deletion requests within 30 days.

7. Your rights

You have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Request deletion of your data
  • Object to or restrict processing in certain circumstances

To exercise any of these rights, contact us at [email protected].

8. Cookies

Our marketing site (zyntel.net) uses minimal cookies — only those necessary for security and basic analytics (session identifiers). We do not use tracking cookies or cross-site advertising cookies. Our products (KantaHub, zyntForms) use session cookies required for authentication. For full details, see our Cookie Policy.

9. Children's privacy

Our products are designed for healthcare and business teams. We do not knowingly collect data from children under 18. If you believe we have collected data from a minor, contact us immediately.

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email or an in-product notice. The "Last updated" date at the top of this page reflects the current version.

11. Contact

For privacy questions or data requests: [email protected]
Zyntel Co. Limited, Kampala, Uganda.