Messangi Privacy Notice

Effective Date: June 2026

1. Introduction

Messangi Corporation and its affiliates (together, “Messangi,” “we,” “us,” or “our”) provide communications platform as a service (CPaaS) solutions that let our business customers reach their own users across messaging channels such as SMS, WhatsApp, RCS, email, voice, and push notifications. We are committed to handling personal information responsibly and in accordance with applicable data protection laws.

This Privacy Notice explains how we collect, use, share, and protect personal information when you visit our websites, create or administer an account, communicate with us, or otherwise interact with our services. It also explains the rights and choices available to you depending on where you are located.

Because of the way our services work, Messangi acts in two different roles depending on the data involved. Section 2 explains those roles, which determine who is responsible for the personal information and to whom you should direct a request.

2. The Messangi Entities and Our Roles

Messangi Corporation is a company incorporated in the United States, with its principal address at 5798 SW 68th St, Miami, FL 33143, USA. Messangi Corporation is the entity that maintains our certification under the Data Privacy Framework described in Section 7 and is the controller for the personal information described in this notice. We also operate through affiliated entities in Latin America that may act as the responsible party (controller) for personal information processed in their respective jurisdictions, which is addressed in the local privacy notices for those jurisdictions.

2.1 When Messangi is a controller

We act as a controller when we determine the purposes and means of processing. This applies to information about our business customers and their personnel, prospective customers, website visitors, and people who communicate with us. For this information, Messangi is responsible and you may contact us using the details in Section 12.

2.2 When Messangi is a processor

We act as a processor (service provider) when we transmit messages and process communications on behalf of our business customers. In this role our customer is the controller. The customer decides what to send, to whom, and on what legal basis, and we process that information only on the customer’s documented instructions and under our agreement with them.

If you are an end user who received a message from a business that uses Messangi, that business is the controller of your information. Requests to access, correct, or delete that information should be directed to the business you interact with. We will support our customer’s response as required by our agreement and applicable law.

3. Personal Information We Collect

“Personal information” means information that identifies, relates to, or could reasonably be linked with an identifiable individual. We collect only the information we need for the purposes described in this notice.

3.1 Information we collect as a controller

Identity and contact details, such as name, business email address, telephone number, and company name.
Account credentials, such as username and password used to secure your account.
Billing information, such as billing address and payment method details, processed securely through our payment processors.
Verification information, such as identification or proof of address, where required for compliance and security.
Preferences, such as language and communication preferences.
Device and usage information collected automatically, such as IP address, browser type, operating system, and how you interact with our websites and services. See Section 6 on cookies.

3.2 Information we process as a processor, on behalf of our customers

When our customers use our services to communicate with their users, we process the following on their behalf and on their instructions:

Usage data, such as phone numbers, email addresses, timestamps, routing information, and delivery logs necessary to transmit messages or calls.
Communication content, such as the text, voice, images, or other material that the customer or its users transmit through our services.

We process this information solely to provide the services requested by the customer. As a processor, we rely on the customer to have a valid legal basis to collect and process this information and to provide any required notices to and obtain any required consents from its users.

4. How We Use Personal Information

As a controller, we use personal information to:

Provide, operate, maintain, and secure our websites and services.
Create and administer accounts and process payments.
Communicate with you, provide support, and manage our relationship.
Improve and develop our services, including analytics.
Detect, prevent, and respond to fraud, abuse, security incidents, and other harmful activity.
Comply with legal obligations and enforce our agreements.
Send service and, where permitted, marketing communications, which you can opt out of as described in Section 9.

As a processor, we use the information described in Section 3.2 only to deliver the services on our customer’s instructions.

We do not sell personal information, and we do not share it for cross context behavioral advertising.

4.1 Legal bases (where required)

Where data protection law requires a legal basis, we rely on one or more of the following: performance of a contract; your consent; our legitimate interests, provided they are not overridden by your rights; compliance with a legal obligation; and protection of vital interests. Where we rely on consent, you may withdraw it at any time.

5. How We Share Personal Information

We do not sell personal information. We share personal information only in the following circumstances:

Service providers and subprocessors that help us operate, such as payment processors, cloud hosting providers, support platforms, and analytics providers, each bound by contract to protect the information and use it only to provide services to us.
Telecommunications and communications providers, such as carriers and messaging platforms, to route and deliver messages and calls.
Legal and safety disclosures, such as responses to lawful requests by public authorities, subpoenas, or court orders, and to enforce our terms, prevent fraud, or protect rights and safety.
Business transfers, such as a merger, acquisition, reorganization, or sale of assets, with notice as required by law.
With your consent or at your direction.
Aggregated or de identified information that does not identify you.

We maintain a list of the subprocessors we use to provide the services, available on our website.

6. Cookies and Tracking Technologies

We use cookies and similar technologies on our websites to enable basic functionality, remember your preferences, measure performance, and, where applicable, support marketing. The categories we use include essential cookies, performance and analytics cookies, functionality cookies, and advertising cookies.

You can manage your preferences through our cookie preferences tool and through your browser settings. Disabling certain cookies may affect functionality. Where required, we honor opt out preference signals, including Global Privacy Control, as described in Section 9.3.

7. International Data Transfers and the Data Privacy Framework

Your personal information may be transferred to and processed in countries other than your own, including the United States, where our facilities and certain service providers are located. We use appropriate safeguards for these transfers as described below.

7.1 Data Privacy Framework

Messangi Corporation complies with the EU to United States Data Privacy Framework, the UK Extension to the EU to United States Data Privacy Framework, and the Swiss to United States Data Privacy Framework, as administered by the U.S. Department of Commerce. Messangi Corporation has certified that it adheres to the Data Privacy Framework Principles with regard to the processing of personal data received from the European Union, the United Kingdom, and Switzerland in reliance on the applicable framework. To learn more and to confirm our current certification, please visit https://www.dataprivacyframework.gov/ and search the participant list for Messangi Corporation. If there is any conflict between the terms of this notice and the Data Privacy Framework Principles, the Principles govern with respect to data processed in reliance on the framework.

7.2 Notice, choice, and onward transfers

Consistent with the Principles, we provide notice about the personal information we process and the purposes for which we use it, and we offer the choices described in Section 9.2. Where we transfer personal information covered by our certification to third parties acting as our agents, we remain accountable under the Principles. We require those agents to provide at least the same level of protection as the Principles, and we remain liable if an agent processes such personal information in a manner inconsistent with the Principles, unless we can demonstrate that we are not responsible for the event giving rise to the damage.

7.3 Other transfer mechanisms

For transfers not covered by the Data Privacy Framework, or where an additional mechanism is appropriate, we rely on other lawful transfer mechanisms, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, together with any supplementary measures required by law.

7.4 Dispute resolution under the Data Privacy Framework

In compliance with the Data Privacy Framework, Messangi Corporation commits to resolve complaints about our collection or use of your personal data transferred in reliance on the framework. Individuals with inquiries or complaints should first contact us at privacy@messangi.com. Data Privacy Framework organizations must respond within 45 days of receiving a complaint. For complaints regarding non human resources data that we do not resolve, we commit to refer them to the ICDR-AAA Data Privacy Framework Independent Recourse Mechanism, a dispute resolution provider based in the United States, at no cost to you. See https://go.adr.org/dpf_irm.html. For complaints regarding human resources data transferred from the European Union in the context of the employment relationship, we commit to cooperate with the panel established by the European Union Data Protection Authorities. Under certain conditions, you may be able to invoke binding arbitration for residual claims not resolved by other means, as described on the Data Privacy Framework website. Messangi Corporation is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission.

8. Security

We maintain technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These measures include access controls that limit access to authorized personnel bound by confidentiality obligations, encryption of data in transit, monitoring, and an incident response process. We review our security measures and seek to improve them over time.

You also have a role in keeping information secure. Please keep your account credentials confidential, enable available security features such as additional authentication, and keep your own devices protected and current. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your Privacy Rights and Choices

The rights available to you depend on your location and on whether Messangi is acting as a controller or a processor. For information we process as a processor on behalf of a customer (Section 2.2), please direct your request to that customer, and we will assist them as required. For information we control, you may exercise the rights below by contacting us at privacy@messangi.com.

9.1 Rights available to all individuals

Access the personal information we hold about you.
Correct inaccurate or incomplete information.
Delete your information, subject to legal exceptions.
Object to or request restriction of certain processing.
Receive your information in a portable, commonly used, machine readable format where applicable.
Withdraw consent where processing is based on consent.

9.2 Choices under the Data Privacy Framework

For personal information processed in reliance on the Data Privacy Framework:

Opt out. We will offer you the opportunity to opt out before we disclose your personal information to a third party other than a processor acting on our behalf, or before we use it for a purpose materially different from the purpose for which it was originally collected or later authorized by you. To opt out, contact privacy@messangi.com.
Opt in for sensitive information. For sensitive personal information, such as information about health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or sex life, we will obtain your affirmative express consent before disclosing it to a third party other than a processor acting on our behalf, or using it for a materially different purpose.

9.3 United States state privacy rights

If you are a resident of California or another U.S. state with a comprehensive privacy law, you may have the rights to know and access the categories and specific pieces of personal information we collect, to correct it, to delete it, to opt out of any sale or sharing for cross context behavioral advertising, and to limit the use of sensitive personal information. We do not sell personal information and do not share it for cross context behavioral advertising. We will not discriminate against you for exercising these rights.

We honor opt out preference signals, including Global Privacy Control, where required.

You may submit a request through privacy@messangi.com, and you may use an authorized agent where the law permits. We will verify your request as required by law. If we decline a request, you may appeal by replying to our decision; we will respond within the time the applicable law requires.

The categories of personal information we have collected in the preceding twelve months, the sources, the business or commercial purposes for which we use them, and the categories of third parties to whom we may disclose them, are summarized below. Retention is described in Section 10.

Category (as defined by California law)	Collected	Sources	Purpose	Disclosed to (categories)
Identifiers (name, email, phone, IP address, account identifiers)	Yes	You; your device; your organization	Provide and secure services; account administration; communications	Service providers; communications providers; legal and safety recipients
Customer records (billing and payment details, contact information)	Yes	You; your organization; payment processors	Billing and payment; account administration	Payment processors; service providers
Commercial information (services purchased or used)	Yes	You; your use of the services	Provide services; analytics; relationship management	Service providers
Internet or network activity (usage and interaction with our sites and services)	Yes	Automatic collection; cookies	Operate, secure, and improve our sites and services	Service providers; analytics providers
Geolocation data (approximate, derived from IP address)	Yes	Automatic collection	Security, fraud prevention, and analytics	Service providers
Audio or electronic information (communication content processed as a processor)	Yes, as processor	Our customers and their users	Deliver messaging services on customer instructions	Communications providers; service providers
Sensitive personal information	Only if provided by you or contained in customer content	You; our customers	See Section 9.2; limited to disclosed purposes	Service providers, as needed for the disclosed purpose

9.4 Latin America

Depending on your country, you may have rights under local data protection law, including the rights to access, rectify, cancel or delete, and object to the processing of your personal information (the ARCO rights in several jurisdictions), to portability where provided, and to withdraw consent. You also have the right to lodge a complaint with the competent authority in your country. The relevant frameworks include, among others:

Mexico: the Federal Law on Protection of Personal Data Held by Private Parties and its 2025 reform. A standalone Aviso de Privacidad applies to processing governed by Mexican law.
Colombia: Law 1581 of 2012 and Decree 1377 of 2013, overseen by the Superintendencia de Industria y Comercio.
Chile: Law 19.628, as modernized by Law 21.719.
Venezuela: the constitutional and sectoral data protection requirements applicable in Venezuela.
Brazil: the General Data Protection Law (LGPD), overseen by the ANPD.
Peru: Law 29733 on personal data protection.

To exercise these rights, contact privacy@messangi.com.

9.5 European Economic Area, United Kingdom, and Switzerland

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the rights described in Section 9.1, and you may lodge a complaint with your local supervisory authority. Where we process your information in reliance on the Data Privacy Framework, Section 7 and Section 9.2 also apply.

10. Data Retention

We retain personal information for as long as needed to provide our services, maintain our relationship with you, and fulfill the purposes described in this notice, and then for the period necessary to comply with our legal, accounting, tax, and contractual obligations and to resolve disputes and enforce our agreements. When acting as a processor, we retain information processed on a customer’s behalf in accordance with our agreement with that customer and their instructions. When information is no longer needed, we delete it or de identify it.

11. Other Information

11.1 Automated processing

We use automated processes for purposes such as fraud detection, spam prevention, and protecting the security of our services. These processes analyze signals to identify potentially fraudulent or malicious activity.

11.2 Children

Our services are not directed to individuals under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, please contact us and we will take steps to delete it.

11.3 Third party websites

Our websites and services may link to third party sites. We are not responsible for their privacy practices, and we encourage you to review their notices.

12. Changes and Contact

We may update this Privacy Notice from time to time. When we make significant changes, we will post a prominent notice on our website and, where appropriate, notify you by email. The effective date at the top indicates when the notice was last revised.

If you have questions, concerns, or requests regarding this notice or our data practices, please contact us:

Messangi Corporation Attn: Privacy Team 5798 SW 68th St, Miami, FL 33143, USA Email: privacy@messangi.com