Only useful data
Public diagnostics work without an account, and we limit account information to what the feature needs.
SautiLink Cloud Engine · Legal
Privacy is a product requirement.
This policy explains what SautiLink Cloud Engine processes, why it is needed, who helps us operate the service, how long information is kept, and how you can access, correct or delete your data.
No data marketplace
We do not sell personal data or share it for cross-context behavioural advertising.
No payment profile
Cloud Engine tools are currently free. We do not collect card or billing details for these tools.
Clear deletion routes
You can clear device-local recents, change optional preferences, or request deletion of your account.
SautiLink Corporation respects privacy by design. Cloud Engine provides public website, DNS, email, SSL, HTTP, security-header and infrastructure diagnostics. You may use public tools anonymously; a SautiLink Account is optional for features that require identity or saved preferences.
Scope and data controller
This Privacy Policy applies to SautiLink Cloud Engine at cloudengine.sautilink.com, its SautiLink Account features, the @sautilinkcloud_bot Telegram companion, related APIs, and future mobile or desktop versions that link to this policy.
SautiLink Corporation, Uhuru Street, Mwanza, Tanzania, is responsible for deciding how personal data covered by this policy is processed. A third-party website you choose to inspect remains responsible for its own content and privacy practices.
Service-specific policy. This document covers Cloud Engine and its connected account and bot functions. A different SautiLink product may publish additional terms when it introduces different data uses.
Information we process
Information you provide
- Account data: email address, password handled by our authentication provider, full name, username, optional avatar URL, account creation and update timestamps.
- Communication preferences: an optional email-updates choice and, if introduced and voluntarily configured, an international-format WhatsApp number, its verification state and an optional WhatsApp-updates choice.
- Support communications: your email address, message and any information you choose to include when contacting [email protected] or [email protected].
- Diagnostic inputs: a domain, public IP address, public URL, DKIM selector or similar technical target that you submit to a tool.
Technical information
When you connect to the service, our hosting and security infrastructure may process request metadata such as IP address, browser or app type, operating system, timestamps, requested route, response status, security signals and error information. This supports delivery, abuse prevention, troubleshooting and service reliability.
Information we do not currently require
Cloud Engine does not currently require payment-card information, government identity documents, precise device location, contacts, photos, microphone recordings, camera access, health data or biometric data. We do not intentionally ask users to submit sensitive personal data through diagnostic targets or support messages.
Diagnostic targets, requests and results
To run a check, Cloud Engine must send the supplied target to the relevant analyzer. Depending on the tool, this may involve DNS resolvers, certificate or HTTP requests, and requests to the public website or infrastructure being inspected. Those systems may receive the Cloud Engine server's request metadata and the target required to complete the check.
Anonymous scan results are processed to return the requested report. Cloud Engine does not currently maintain an application-level history of anonymous scans. A short recent-target list on the homepage is stored locally on your device, not in a SautiLink account.
Exports generated by supported reports are created in your browser. A JSON, CSV or PDF file is stored wherever you choose to save it and is then controlled by you and your device.
Use public targets only. Do not submit passwords, authentication tokens, private dashboard URLs, confidential query strings or personal information that is unnecessary for a technical check.
Cookies, sessions and storage on your device
- Essential account cookies: secure session cookies are used to keep signed-in accounts authenticated. These are necessary for account features and are not advertising cookies.
- Recent targets: up to a small number of recent audit targets may be stored in browser local storage so you can reopen them on that device. You can clear them from the workspace or the deletion page.
- Interface state: the app may store limited settings needed to preserve a user-selected experience. We do not use device storage to build an advertising profile.
You can block or clear browser storage using your browser settings, but removing essential session data may sign you out.
Telegram companion data
If you choose to use the Telegram bot, Telegram supplies information needed to process your interaction, including your Telegram user ID, chat ID, language code, command or callback data and the target you submit. Cloud Engine stores a limited preference profile connected to your Telegram user ID, currently including language, report detail, developer-mode presentation and default start view.
Telegram is a separate platform with its own privacy practices. Messages sent through Telegram are processed by Telegram before they reach Cloud Engine. Do not use the bot for secrets or private credentials.
To request deletion of stored Telegram preferences, contact support and include the Telegram user ID shown in the bot's Settings screen. Never send your Telegram password or login code.
How we use information
We use the information described above to:
- run the diagnostic tool or report you requested;
- create, verify, secure and maintain a SautiLink Account;
- remember user-selected settings and communication choices;
- deliver authentication, security and transactional account emails;
- send optional product updates only when the relevant preference is enabled;
- detect abuse, enforce rate limits, investigate errors and protect the service;
- measure reliability and improve features using limited technical or aggregate information;
- respond to support, privacy and legal requests; and
- comply with applicable law and valid legal process.
No sale or targeted-ad sharing. We do not sell personal data, rent user lists or share personal data for cross-context behavioural advertising. Cloud Engine currently contains no paid tools or advertising programme.
Legal bases for processing
Where applicable law requires a legal basis, we rely on one or more of the following:
- Service performance: processing needed to run a requested diagnostic, maintain an account or provide support.
- Consent: optional product-update preferences and any future optional device permission. Consent may be withdrawn without affecting earlier lawful processing.
- Legitimate interests: securing, debugging and improving a free public service, provided those interests are not overridden by your rights.
- Legal obligation: records or disclosures required by applicable law, regulation, court order or lawful authority.
We aim to process personal data consistently with the Tanzania Personal Data Protection Act, 2022 and other applicable data-protection requirements in places where the service is offered.
Service providers and disclosures
We disclose information only as needed to operate the service, respond to your request, protect users or comply with law. Current provider categories include:
| Provider or category | Purpose | Information involved |
|---|---|---|
| Cloudflare | Hosting, content delivery, network security and limited traffic measurement. | Request metadata, IP address, route, timestamps, security and performance signals. |
| Supabase | Authentication and protected database services for account profiles and preferences. | Email, authentication records, account ID, profile and preference fields. |
| ZeptoMail | Authentication, security and transactional email delivery. | Recipient email, sender, subject, message content and delivery metadata. |
| Telegram | Delivery of the optional bot interface. | Telegram identifiers, messages, commands and platform metadata. |
| Public internet services and targets | DNS resolution and public website or infrastructure diagnostics. | The technical target and request data necessary to perform the selected check. |
Providers may process data under their own terms as independent platforms or under contractual duties as service providers. We may also disclose information if reasonably necessary to address fraud, abuse, security incidents, legal claims, a corporate reorganisation, or a valid request from a competent authority.
International data transfers
Cloud hosting, authentication, email and messaging providers may process information on infrastructure located outside Tanzania or your country. Where cross-border safeguards are required, we seek to use appropriate contractual, organisational and technical measures and to follow applicable transfer requirements.
No internet service can guarantee that information remains in a single country because routing, security and provider infrastructure can be distributed. Contact us if you need additional information about a specific transfer.
How long information is kept
| Data | Typical retention approach |
|---|---|
| Browser-local recent targets | Until you clear them, clear site data, use a private session that closes, or the browser removes them. |
| Anonymous diagnostic requests and results | Processed to answer the request. No current application-level scan-history record; limited infrastructure or security logs may remain for the provider's operational schedule. |
| Account and profile data | While the account remains active, then deleted following a verified request except for limited information that must be retained for security, legal or dispute purposes. |
| Telegram preferences | Until the preference profile is removed or deletion is requested using the Telegram user ID. |
| Support and privacy correspondence | For as long as reasonably needed to resolve the request, document the response and meet legal obligations. |
| Backups and security records | Residual copies may remain temporarily in protected backups or fraud-prevention records and expire according to recovery and legal schedules. |
We review retention as features change and aim not to keep identifiable information longer than necessary for the stated purpose.
How we protect information
We use measures appropriate to the current service, including encrypted network connections, secure session cookies, access controls, server-side secrets, database row-level security, restricted service roles, input validation, rate limits and security monitoring. Access to personal data is limited to authorised operations and people who need it.
No online service is completely secure. You are responsible for protecting your password, verification codes, exported reports and devices. If you believe your account or data has been compromised, contact [email protected] promptly.
If a personal-data incident creates notification duties under applicable law, we will take reasonable steps to investigate, contain and notify affected people or authorities as required.
Your rights and choices
Depending on applicable law, you may have rights to:
- ask whether we process your personal data and request access to it;
- correct inaccurate or incomplete information;
- request deletion of information that is no longer required;
- object to or request restriction of certain processing;
- withdraw consent for optional communications;
- request a portable copy of information where the right applies; and
- complain to the Tanzania Personal Data Protection Commission or another competent authority.
You can edit supported account profile fields and email-update preferences in Account settings. To exercise another right, email [email protected] or [email protected]. We may need to verify identity before disclosing, changing or deleting account information.
Account and data deletion
All users may request deletion regardless of location. Deactivation alone is not treated as account deletion. After reasonable identity verification, we will remove the account and associated personal data from active systems unless specific information must be retained by law, for security, fraud prevention or to establish or defend legal claims.
Use our Account & Data Deletion page for the current process, expected timing, Telegram instructions and a direct deletion-request email link. Current manual requests are normally completed within 30 days, and we will confirm when the active account record has been removed.
Store-distributed apps. Any SautiLink app that offers account creation will also provide an accessible way to initiate account deletion from within the app before public store release.
Children and younger users
Cloud Engine is a technical utility and is not directed to children under 13. A person who is below the age at which local law allows independent consent must use account features only with permission and supervision from a parent or legal guardian.
We do not knowingly request children's sensitive data. If you believe a child provided personal data without valid permission, contact us so we can investigate and remove it where appropriate.
Changes to this policy
We may update this policy when the service, law, provider list or data practices change. The effective and last-updated dates will be revised. If a change materially affects how existing account data is used, we will provide additional notice through the service or an appropriate account channel before the change takes effect where required.
We will update the policy and app-store privacy disclosures before introducing materially different collection, such as payments, advertising, precise location, contacts, photos or device sensors.
Contact and complaints
For privacy questions, access requests, corrections, deletion or complaints, contact SautiLink Corporation. Please do not email passwords, one-time verification codes or API keys.
Privacy and company[email protected]
Account and technical support[email protected]
OfficeUhuru Street, Mwanza, Tanzania
Data authorityTanzania PDPC