Your data, handled with care.

Who we are

Wave Billing (wavebilling.co.ke) is billing and network management software for internet service providers. This notice explains what personal data Wave handles and why. It is written to meet Kenya’s Data Protection Act, 2019.

When you sign up

When an ISP creates a Wave account we collect:

• your ISP’s name and, if you give them, its town and approximate size
• your name, email address and mobile number
• your password, which is stored only as a one-way hash we cannot read
• the internet address your request came from, to stop abuse of the sign-up form

When your ISP uses Wave

ISPs use Wave to manage their own customers. For that, Wave stores the customer details the ISP enters or that their network reports: names, phone numbers, account usernames, plans and expiry dates, payments and receipts, invoices, router and session data (such as IP addresses, device MAC addresses and data used) and the messages sent to them.

For this data the ISP decides what is collected and why; Wave processes it on the ISP’s behalf. If you are an ISP’s customer, contact your ISP first about your data.

How we use it

• to run the service: sign-in, billing, payments, connecting and disconnecting customers, and sending the messages ISPs switch on
• to bill ISPs for Wave and to contact ISP owners about their account
• to keep the service secure, prevent fraud and fix problems

We do not sell personal data and we do not use it for advertising.

Who we share it with

Only the providers needed to run the service, and only what they need:

• ZetuPay and Safaricom M-Pesa, to process payments (Wave never sees M-Pesa PINs)
• the SMS gateway an ISP connects, and WhatsApp through the number the ISP links, to deliver messages
• our hosting and email providers
• authorities, where the law requires it

Cookies

Wave uses a cookie to keep you signed in and stores small preferences (such as light or dark mode) in your browser. We do not use advertising or tracking cookies.

How we protect it

• every ISP’s data is kept separate, and every page checks who is signed in and what they may see
• passwords are hashed and stored secrets such as router and gateway credentials are encrypted
• sign-in and public forms are rate-limited to stop guessing and abuse
• sensitive actions are recorded in an activity log

How long we keep it

We keep account data while an ISP uses Wave and for as long afterwards as needed for legal, tax and dispute purposes. Sign-up requests that are declined are kept briefly as a record, without the password.

Your rights

You can ask to see the personal data we hold about you, to correct it, to delete it, or to object to how it is used, and you can complain to the Office of the Data Protection Commissioner. ISP owners can ask through Support in the Wave dashboard.