Privacy Policy

Last updated June 4, 2026

Casa Management Solutions ("Casa," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and process your personal data when you use Bwat and related services ("Services").

Bwat is an AI-powered assistant that connects you to third-party large language model (LLM) providers. We do not train those third-party foundation models — they are operated by the LLM providers under their own policies. We do, however, use the conversations of consenting users to fine-tune our own models that power features such as translation and specialized sub-agents, so that Bwat keeps improving. This is enabled by default, and you can opt out at any time from your account settings; see Section 2 ("Uses of Personal Data") for details and how to opt out. Your conversations are also routed through our servers to those third-party AI providers to generate responses, and we store your conversation history to provide the Service to you.

This Privacy Policy also describes your privacy rights. More information about your rights, and how to exercise them, is set out in Section 4 ("Rights and Choices").

Table of Contents

1. Collection of Personal Data
2. Uses of Personal Data
3. How We Disclose Personal Data
4. Rights and Choices
5. Data Transfers
6. Data Retention and Security Controls
7. Your Content and Files
8. Children
9. Changes to Our Privacy Policy
10. Contact Information
11. Legal Bases for Processing

1. Collection of Personal Data

We collect the following categories of personal data:

Personal data you provide to us directly

• Identity and Contact Data: Your name, email address, and phone number when you sign up for a Bwat account. We may also collect or generate indirect identifiers (e.g., "USER12345").
• Payment Information: Your mobile money and card payment details (phone number, transaction references) when you purchase a Bwat subscription. Payments are processed through Pesapal; we do not store your mobile money PIN, card number, or account credentials.
• Inputs and Outputs: When you use Bwat, you send prompts ("Inputs") that generate AI responses ("Outputs"). Your Inputs are routed to third-party AI providers to generate Outputs. We store your conversation history so you can access it later. If you include personal data in your Inputs, that data will be processed as part of the Service.
• Files: If you upload files to Bwat, we store them on our servers to provide file management and knowledge base features. Your files remain yours (see Section 7).
• Feedback: Ideas, suggestions, or ratings you provide about the Service. If you rate an Output, we store the related conversation as part of your Feedback.
• Communication Information: If you contact us via support channels, we collect your name, contact information, and message contents.

Personal data we receive automatically from your use of the Services

When you use the Services, we receive certain technical data automatically ("Technical Information"):

• Device and Connection Information: Device type, operating system, browser information, IP address (and approximate location derived from it), time zone, and connection information.
• Usage Information: Dates and times of access, pages viewed, features used, and token consumption data for rate limiting and billing purposes.
• Log and Troubleshooting Information: Error logs, performance data, and diagnostic information when issues occur.
• Cookies & Similar Technologies: We use cookies and similar technologies to manage the Services, recognize you, and analyze usage to make the Services safer and more useful. We do not use advertising cookies or serve ads.

2. Uses of Personal Data

We use your personal data for the following purposes:

• To provide, maintain, and operate the Bwat service, including routing your Inputs to third-party AI providers and delivering Outputs back to you;
• To store and manage your conversation history and uploaded files;
• To create and administer your Bwat account;
• To process payments and manage your subscription;
• To enforce rate limits and usage quotas;
• To communicate with you about the Services, including service announcements and support;
• To prevent and investigate fraud, abuse, and violations of our Usage Policy;
• To investigate and resolve disputes and security issues;
• To debug and repair errors;
• To improve the Services through aggregated, de-identified usage analytics;
• With your consent (enabled by default, and which you can withdraw at any time), to improve Bwat by fine-tuning our own models and building quality evaluations, using your conversations (Inputs and Outputs). See "Your choices about improving Bwat" below; and
• To enforce our Terms of Service and Usage Policy.

Your choices about improving Bwat

To help Bwat get better over time, we use the conversations of consenting users to fine-tune our own models — for example, the models behind translation and specialized sub-agents — and to build quality evaluations. This is enabled by default, but you are always in control:

• You can turn it off at any time from the data-sharing toggle on your Settings page (under Privacy & Data), on both the web and the mobile app.
• Turning it off stops any future use of your conversations to improve Bwat. Because information already incorporated into a trained model cannot always be isolated and removed after the fact, opting out applies going forward; it does not remove contributions already used to train a model.
• We do not use the conversations of users who have opted out for this purpose, and your choice does not affect your access to, or experience of, Bwat.

What we do NOT do with your data

• We do not sell your personal data.
• We do not serve advertisements. Your data is never used for ad targeting or shared with advertisers.
• We do not train the third-party foundation models that generate your responses; those are operated by the LLM providers under their own privacy policies.
• If you opt out, we do not use your conversations to improve Bwat. You can opt out at any time from your account settings.

3. How We Disclose Personal Data

Casa discloses personal data to the following categories of third parties:

• Third-party AI providers: Your Inputs are sent to third-party LLM providers to generate Outputs. These providers have their own privacy policies governing how they process your data. We encourage you to review the privacy policies of these providers.
• Payment processors: Payment information is shared with our payment processor to process mobile money transactions.
• Authentication providers: We use a third-party authentication service to manage account sign-in. They process your identity and contact data under their own privacy policy.
• Infrastructure providers: We use cloud hosting, database, and storage services that process data on our behalf as service providers.

Casa may also disclose personal data in the following circumstances:

• As part of a significant corporate event: If Casa is involved in a merger, acquisition, or other transfer of business assets, your personal data may be transferred as part of that transaction.
• Pursuant to legal requirements: We may disclose personal data to governmental authorities as required by law, in response to legal process, or to protect the health and safety of any person, to protect against fraud, or to enforce our legal rights.
• With your consent: We will disclose personal data when you give us permission to do so.

4. Rights and Choices

Depending on where you live and applicable laws, you may have the following rights regarding your personal data. We may decline a request if we have a lawful reason for doing so.

To exercise your rights, email us at privacy@getcasaapp.com. We may verify your identity before processing your request. Casa will not discriminate against you for exercising your privacy rights.

• Right to know: The right to know what personal data we process about you, the sources, purposes, and third parties we share it with.
• Access & data portability: The right to request a copy of your personal data, and in certain cases, to port your information.
• Deletion: The right to request deletion of your personal data. You can delete individual conversations from your history at any time; they will be removed from our back-end within 30 days.
• Correction: The right to request correction of inaccurate personal data. Note that we cannot control the factual accuracy of AI-generated Outputs, as these are produced by third-party AI models.
• Objection: The right to object to processing of your personal data on grounds of legitimate interest.
• Restriction: The right to restrict our processing of your personal data in certain circumstances.
• Withdrawal of consent: Where processing is based on consent, you have the right to withdraw it at any time.
• Automated decision-making: Casa does not engage in automated decision-making that produces legal effects or similarly significant effects on you.

5. Data Transfers

When you use the Services, your data may be transferred to servers outside your home country, including to third-party AI providers and infrastructure services. Where required by applicable law, we use appropriate legal frameworks such as standard contractual clauses to safeguard international transfers.

6. Data Retention and Security Controls

Casa retains your personal data for as long as reasonably necessary to provide the Services and for the purposes outlined in this Privacy Policy. When data is no longer needed, we delete, destroy, or anonymize it as required by applicable law.

Aggregated or De-Identified Information

We may process data in aggregated or de-identified form to analyze service effectiveness and improve user experience. For example:

• We analyze aggregated usage patterns (token consumption, feature usage, error rates) to improve the Services. This information does not identify individual users.
• If conversations are flagged for potentially violating our Usage Policy, we may review them for enforcement purposes.
• Where you have not opted out (see "Your choices about improving Bwat" in Section 2), we use conversation content (Inputs and Outputs) from consenting users to fine-tune our own models and build evaluations. We minimize and, where practical, pseudonymize this data, and we retain it only as long as needed for these purposes.

Security Controls

We implement appropriate technical and organizational security measures designed to protect personal data from loss, misuse, unauthorized access, disclosure, alteration, or destruction.

7. Your Content and Files

Your data belongs to you. All content you create through Bwat — including conversations, generated code, and uploaded files — is yours. You retain full ownership and all rights to your content. Casa does not claim any ownership of your Inputs, Outputs, or uploaded files. Beyond what is necessary to operate the Service (storing and transmitting your data to provide Bwat's functionality), the only additional use we make of your conversations is to improve Bwat as described in Section 2 — and only where you have not opted out.

You may export, share, modify, or delete your content at any time.

8. Children

Bwat is not directed to, and is not intended for use by, anyone under the age of 18. We do not knowingly collect personal data from children under 18. If you are under 18, please do not use the Services or provide us with any personal data. If you believe a child under 18 has provided us with personal data, email us at privacy@getcasaapp.com and we will take reasonable steps to investigate and delete that information.

9. Changes to Our Privacy Policy

Casa may update this Privacy Policy from time to time. We will notify you of material changes and update the date at the top. You can request a summary of changes by contacting us.

10. Contact Information

If you have questions about this Privacy Policy or your personal data, contact us:

Casa Management Solutions Kampala Sir Apollo Kaggwa Road Uganda Email: privacy@getcasaapp.com Website: getcasaapp.com Hours: Mon. - Fri. 8AM - 6PM

Under many countries' laws, you have the right to lodge a complaint with the supervisory authority in the place in which you live or work.

11. Legal Bases for Processing

Purpose	Type of Data	Legal Basis
To provide and operate the Bwat service	Identity and Contact Data, Payment Information, Inputs and Outputs, Files	Contract
To create and administer your account	Identity and Contact Data, Payment Information	Contract
To process payments and manage subscriptions	Identity and Contact Data, Payment Information	Contract
To enforce rate limits and usage quotas	Identity and Contact Data, Technical Information	Contract, Legitimate interests: Necessary to ensure fair usage and service availability for all users.
To communicate with you about the Services	Identity and Contact Data, Communication Information, Technical Information	Contract. Consent where required.
To prevent fraud, abuse, and Usage Policy violations	Identity and Contact Data, Inputs and Outputs, Technical Information	Legitimate interests, Legal obligation: Protecting our business, users, and systems from harmful activity.
To investigate and resolve disputes	Identity and Contact Data, Inputs and Outputs, Feedback	Legitimate interests, Legal obligation: Resolving complaints to improve user satisfaction and meet legal obligations.
To investigate and resolve security issues	Identity and Contact Data, Technical Information, Inputs and Outputs	Legal obligation, Legitimate interests: Protecting user data and system integrity.
To debug and repair errors	Identity and Contact Data, Feedback, Technical Information	Legitimate interests: Maintaining reliable service operation.
To improve the Services through aggregated analytics	Technical Information, de-identified usage data	Legitimate interests: Understanding usage patterns to improve service quality.
To improve Bwat by fine-tuning our own models and building evaluations	Inputs and Outputs	Consent: Enabled by default and withdrawable at any time from your account settings.
To enforce our Terms of Service and Usage Policy	Identity and Contact Data, Inputs and Outputs, Technical Information	Contract, Legitimate interests: Maintaining a safe and functional platform.