1. About this Policy and who we are
Yassuh ("Yassuh", "we", "us", or "our") operates the Yassuh Digital Mailbox — a one-way messaging platform that lets verified organizations in Jamaica (such as government agencies, emergency services, banks, utilities, and news providers) send messages and alerts to citizens through our mobile app. Yassuh is strictly one-way: you receive messages, and you cannot reply to senders through the app.
This Privacy Policy explains what personal information we collect from you, why we collect it, how we use and share it, and the choices and rights you have. It applies to our mobile app, our website, and related services (together, the "Service").
By creating an account or using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with it, please do not use the Service.
We are the data controller for the personal information described here, except where we are handling information on behalf of a verified organization you have subscribed to (see "How we share information"). If you have questions, contact us using the details in the "How to contact us" section.
2. Information we collect
We aim to collect only what we need to run the Service. We collect:
- Account and identity information: your mobile phone number, your name, and your parish. Your phone number is used to identify your account and to verify it by one-time passcode (OTP).
- Precise device location: with your permission, we collect your device's GPS location (latitude and longitude, and an accuracy estimate) so that location-targeted alerts (for example, a flood or storm warning for your area) can reach the right people. Location handling is described in more detail below.
- Push notification tokens: a device token issued by the push notification service so we can deliver messages to your device.
- Subscriptions and delivery data: the organizations and channels you subscribe to, and technical delivery records such as whether a message was sent, delivered, opened, or acknowledged.
- Usage and device information: basic technical data such as device and operating-system type, app version, language, general app-interaction events, and diagnostic or crash logs. This helps us keep the Service secure and working.
- Communications with us: if you contact support, we keep your messages and our replies.
We do not ask you for, and you should not send us, sensitive personal information (such as health, financial account, or biometric data) except where a specific feature clearly requires it.
3. Why we use your information (purposes)
We use your personal information to:
- Provide the Service: create and secure your account, verify your phone number, and deliver messages and alerts from organizations you have subscribed to.
- Target alerts geographically: use your parish and, where enabled, your precise device location so that location-based alerts (including emergency alerts) are delivered to people in the relevant area.
- Deliver push notifications: route messages to your device through the push notification service.
- Maintain delivery records and analytics: understand whether messages were delivered, opened, or acknowledged, measure Service performance, and improve reliability.
- Keep the Service safe: detect, prevent, and investigate fraud, abuse, security incidents, and technical problems.
- Meet legal and compliance obligations: including maintaining audit records and responding to lawful requests.
We will not use your information for materially different purposes without telling you and, where required, obtaining your consent.
4. How we use your location, and how to turn it off
Location targeting helps alerts reach the people they are meant for. Here is how it works and how you stay in control:
- Permission-based: we only access your device's precise location if you grant location permission to the app through your device's operating system. If you do not grant permission, location features simply do not run, and geographic targeting falls back to the parish you registered.
- Foreground use: we request your location while you are using the app; we do not run continuous, always-on background location tracking of your device. Location reports are also rate-limited (throttled) so we do not collect a fix more often than needed.
- What we send: when a location fix is taken, we send its coordinates and an accuracy value to our servers to evaluate which geographic alerts apply to you.
- Turning it off: you can decline the permission when asked, or disable location access for the Yassuh app at any time in your device settings (iOS or Android). If you disable location, you may still receive alerts targeted to your registered parish or to channels you subscribe to, but you may not receive alerts that depend on your precise, current position.
Important: turning off location may mean you miss location-specific emergency alerts. You should never rely on Yassuh as your only source of emergency information (see the disclaimer section).
5. Lawful basis and your consent
We process your personal information on the following bases, as recognized under Jamaican data protection law (including the Data Protection Act, 2020):
- Your consent: for example, when you grant location permission, or opt in to a particular organization or channel. You may withdraw consent at any time (for example, by turning off location or unsubscribing), though this will not affect processing that already occurred.
- Performance of a service you request: to operate your account, verify your phone number, and deliver the messages you have subscribed to receive.
- Our legitimate interests: to secure the Service, prevent abuse, keep audit and delivery records, and improve reliability — balanced against your rights and expectations.
- Legal obligations: where we must process information to comply with applicable law or a lawful request.
Where we rely on consent and you withdraw it, we will stop the relevant processing unless we have another lawful basis to continue (for example, keeping certain records required by law).
6. Third-party service providers (processors)
We use trusted third parties to help run the Service. These providers process personal information on our behalf and under our instructions, and are expected to protect it. They include:
- Push notification delivery: Firebase Cloud Messaging (a Google service), which delivers push notifications to your device using your device token.
- SMS and one-time passcode (OTP) delivery: a telecommunications/SMS provider (currently Twilio, with the possibility of alternative providers such as Amazon SNS) to send verification codes and, where applicable, SMS fallback messages to your phone number.
- Hosting and infrastructure: cloud hosting, database, storage, and queue/processing providers that run our servers and store data.
- Analytics and diagnostics: tools that help us understand app performance and fix crashes and errors.
We also relay content from third-party content sources (weather and news), described separately below. Those sources receive requests from our servers, not directly from you, and are content providers rather than processors of your personal information.
Each provider only receives the information it needs to perform its function. Their handling of information is also governed by their own terms and privacy policies.
7. How we share information — and our no-sale commitment
We do not sell your personal information, and we do not rent or trade it for money or other valuable consideration.
We share personal information only in these limited situations:
- With organizations you subscribe to: when you subscribe to a verified organization or channel, that organization can send you messages and may receive delivery and acknowledgement data (for example, that a message was delivered, opened, or acknowledged) and, where relevant to targeting, aggregate or area-level information. Organizations are independently responsible for the messages they send and for their own handling of any information they receive.
- With service providers: as described in the previous section, to operate the Service on our behalf.
- For legal reasons: to comply with applicable law, a court order, or a lawful request from a public authority; to enforce our terms; or to protect the rights, safety, and property of Yassuh, our users, or the public.
- In a business transfer: if Yassuh is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy or a successor policy.
We do not give senders your precise location coordinates. Location is used by our systems to determine who is in a targeted area; senders target areas, not individuals' exact positions.
8. Automated third-party content (weather and news)
As a convenience, the Service relays certain automated content from third-party sources:
- Weather: forecasts and advisories derived from third-party weather data (for example, Open-Meteo). These are model estimates and are provided for general information only.
- News: headlines and short excerpts from Jamaican news outlets (for example, The Gleaner or the Jamaica Observer) via their public RSS feeds, with a link back to the original article. We aggregate with attribution; we do not republish full articles.
We are a conduit for this content. We do not author it, and we do not warrant its accuracy, completeness, timeliness, or availability. Your use of, and reliance on, third-party content is at your own risk, and may be subject to the source's own terms. When you follow a link to an external site, that site's own privacy practices apply, not ours.
9. Data retention
We keep personal information only for as long as we need it for the purposes described in this Policy, and then delete or anonymize it, unless a longer period is required or permitted by law.
As a general guide:
- Account information (phone number, name, parish) is kept while your account is active.
- Location data is used for targeting at the time of an alert and is retained only as long as reasonably needed for that purpose, security, and troubleshooting; we aim to minimize how long precise location is stored.
- Delivery, acknowledgement, and audit records are kept for operational, security, and compliance purposes. Some audit records are, by design, append-only and are retained for accountability.
- Diagnostic and usage logs are kept for a limited period for security and reliability.
When you delete your account, we erase or irreversibly anonymize your personal information — including your name, mobile number, email address, TRN, parish, saved and last known location, and password — and we delete your device push tokens, channel subscriptions and group memberships. Append-only audit records are retained for up to 7 years for security, fraud prevention and legal accountability, keyed to an internal identifier that is no longer linked to your identity. Deleted data can remain in routine database backups until those backups are rotated out of storage.
Full detail, and how to request deletion without the app, is at https://mailbox.yassuh.dev/delete-account.
10. Security
We take reasonable technical and organizational measures designed to protect your personal information against loss, misuse, and unauthorized access, disclosure, alteration, or destruction. These measures include, where appropriate, encryption in transit, access controls, hashed credentials and secrets, and audit logging.
However, no method of transmission over the internet or method of electronic storage is completely secure. While we strive to protect your information, we cannot and do not guarantee its absolute security. You are responsible for keeping your device and account access secure, and for notifying us promptly if you believe your account has been compromised.
11. Children's privacy
The Service is intended for adults and is not directed to children. We do not knowingly collect personal information from children below the age at which consent is required under Jamaican law without appropriate parental or guardian consent.
If you believe a child has provided us with personal information without the required consent, please contact us and we will take reasonable steps to delete that information. A parent or guardian who becomes aware that their child has registered may contact us to request removal.
12. Your rights and how to exercise them
Subject to applicable Jamaican law, you have rights over your personal information, which may include:
- Access: to ask what personal information we hold about you.
- Correction: to ask us to correct information that is inaccurate or incomplete (you can also update your name and parish in the app).
- Deletion: to ask us to delete your personal information, or to delete your account yourself in the app (Profile tab → Delete account). You can also request deletion without the app at https://mailbox.yassuh.dev/delete-account.
- Objection and restriction: to object to or ask us to limit certain processing.
- Withdraw consent: for example, by turning off location permission or unsubscribing from a channel.
- Complain: to lodge a complaint with the relevant Jamaican data protection authority.
To exercise a right, contact us using the details in the "How to contact us" section. We may need to verify your identity (for example, by confirming control of your registered phone number) before acting on a request. We will respond within the time required by applicable law. Some requests may be limited where we are required or permitted by law to retain information, or where a request would affect others' rights.
13. International transfers
Yassuh serves Jamaica, but some of the service providers we rely on (for push notifications, SMS/OTP, hosting, and analytics) may store or process information on servers located outside of Jamaica. This means your personal information may be transferred to, and processed in, countries whose data protection laws differ from Jamaica's.
Where we transfer personal information across borders, we take steps intended to ensure it remains protected in a manner consistent with this Policy and applicable Jamaican law, such as relying on providers that offer appropriate safeguards. By using the Service, you understand that your information may be processed in this way.
14. Delivery is not guaranteed
Messages and alerts — including emergency alerts — are delivered over the public internet and through third-party push notification services (such as Firebase Cloud Messaging) and, where applicable, SMS. For this reason, delivery is not guaranteed: messages may be delayed, may arrive out of order, or may not arrive at all, for reasons outside our control (including network conditions, device settings, operating-system limits, and third-party outages).
Yassuh is a conduit and does not author or guarantee the content, accuracy, or timeliness of any message. You must not rely on Yassuh as your sole or primary source of emergency information. Always follow official government channels and instructions from emergency and public-safety authorities. This section summarizes points also covered in our Terms of Service and any applicable disclaimers.
15. Changes to this Policy
We may update this Privacy Policy from time to time — for example, to reflect changes in the Service, our providers, or the law. When we make material changes, we will take reasonable steps to notify you, such as by posting the updated Policy in the app or on our website and updating the "Effective date" above.
Your continued use of the Service after an update takes effect means you accept the updated Policy. If you do not agree to a change, you should stop using the Service and may delete your account. We encourage you to review this Policy periodically.
16. How to contact us
If you have questions, requests, or complaints about this Privacy Policy or how we handle your personal information, please contact us:
- Yassuh Digital Mailbox
- Attn: Privacy / Data Protection
- Email: support@yassuh.com
- Account deletion: https://mailbox.yassuh.dev/delete-account
We will do our best to respond promptly. If you are not satisfied with our response, you may have the right to contact the relevant Jamaican data protection authority.
This Policy is governed by the laws of Jamaica, and any disputes relating to it are subject to the jurisdiction of the courts of Jamaica, as further set out in our Terms of Service.