Privacy Policy

The data controller is TOTAL INNOVATION, publisher of the Miracle platform, reachable at the following contact details:

• Company name: TOTAL INNOVATION (SARL)
• Address: Ouaga 2000, Immeuble NLVI, Ouagadougou, Burkina Faso
• Contact email: contact@total-innovation.net
• Phone: +226 64 84 33 33
• Website: total-innovation.net

Account data

• Name, email address and password (stored encrypted / hashed).
• Phone number and professional contact information.
• Company name and billing information.

WhatsApp and SMS service usage data

• Phone numbers of recipients to whom you send OTP codes, messages, media or campaigns, processed on your behalf.
• Send and verification logs (status, timestamp, partially masked number, e.g. +22670******000).
• Content of your messages, media, templates, WhatsApp and SMS campaigns, and their sending settings.
• Identity verification documents (KYC) when you request a dedicated WhatsApp name.
• Webhooks you configure (URL, events, signing secrets).
• Consumption metrics: messages sent, verified, failed, quota used.

Referral program (optional)

• Your personal referral code and, where applicable, the link between your account and the account that referred you.
• Points balance, earning history and quota conversions.
• The payment details you provide when requesting a withdrawal (e.g. Mobile Money number).

Technical data

• IP address, browser type and operating system.
• Security and API access logs (API keys used, request headers).
• Anonymous public-page visit statistics (page views, online presence).
• Cookies and session identifiers (see the Cookie Policy).

We process your data for the following purposes, each relying on an appropriate legal basis:

We never sell your personal data. We only share it with providers strictly necessary to deliver the service, bound by confidentiality and security obligations:

• WhatsApp / Meta Platforms - delivering WhatsApp messages to recipients.
• LigdiCash - secure payment processing (Mobile Money, cards).
• Hosting and server infrastructure providers.
• Transactional email provider (where applicable).
• Competent authorities when required by law.

• Account data: for the entire duration of the contractual relationship. If the account is deleted, it is deactivated immediately and the data is permanently erased at the end of a 90-day retention period (see our "Data deletion" page).
• OTP, message, campaign and SMS logs (masked numbers, statuses): for the period necessary for monitoring and billing, then deleted or anonymized. SMS logs and Meta system errors are automatically purged after 90 days.
• Media, templates, webhooks and devices: deleted with the account, unless legal retention applies.
• OTP codes: deleted upon expiry (5 minutes) or after verification.
• Billing data: retained in accordance with applicable accounting and tax obligations, including after account deletion.
• Security logs: retained for a period proportionate to security needs.
• Referral program ledger (points, withdrawals): retained for accounting traceability, detached from your account after deletion (see our "Data deletion" page).

We implement appropriate technical and organizational measures to protect your data:

• Encryption of communications (HTTPS/TLS) and encryption of sensitive data at rest.
• Hashing of passwords and OTP codes.
• Masking of phone numbers in logs.
• Access control, API key authentication and rate limiting.
• Regular backups and access monitoring.

In accordance with applicable data protection regulations (notably Burkina Faso law No. 010-2004/AN and, where applicable, the GDPR), you have the following rights:

• Right of access to your personal data.
• Right to rectify inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") under the conditions provided by law.
• Right to restriction and objection to processing.
• Right to data portability.
• Right to withdraw your consent at any time.
• Right to lodge a complaint with the competent data protection authority (in Burkina Faso, the CIL).

To exercise these rights, contact us at contact@total-innovation.net. We respond within a maximum of 30 days. The detailed account and data deletion procedure is described on the “Data deletion” page available from the footer.

When you use the service to send OTPs to your own users, you act as the data controller for those numbers and undertake to:

• Have a valid legal basis for sending messages to recipients.
• Obtain recipients' consent where required by law.
• Inform your users about the use of their numbers.
• Not use the service for spam or unsolicited messages.

We may update this Privacy Policy to reflect legal or service changes. The last update date appears at the top of the page. In case of significant change, we will notify you by email or through the portal.