Privacy Policy

Last updated March 29, 2026

Casa Management Solutions ("Casa," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and process your personal data when you use Bwat and related services ("Services").

Bwat is an AI-powered assistant that connects you to third-party large language model (LLM) providers. We do not train AI models. Your conversations are routed through our servers to third-party AI providers to generate responses, and we store conversation history to provide the Service to you.

This Privacy Policy also describes your privacy rights. More information about your rights, and how to exercise them, is set out in Section 4 ("Rights and Choices").

Table of Contents

1. Collection of Personal Data
2. Uses of Personal Data
3. How We Disclose Personal Data
4. Rights and Choices
5. Data Transfers
6. Data Retention and Security Controls
7. Your Content and Files
8. Children
9. Changes to Our Privacy Policy
10. Contact Information
11. Legal Bases for Processing

1. Collection of Personal Data

We collect the following categories of personal data:

Personal data you provide to us directly

• Identity and Contact Data: Your name, email address, and phone number when you sign up for a Bwat account. We may also collect or generate indirect identifiers (e.g., "USER12345").
• Payment Information: Your mobile money payment details (phone number, transaction references) when you purchase a Bwat subscription. Payments are processed through OlyCash; we do not store your mobile money PIN or account credentials.
• Inputs and Outputs: When you use Bwat, you send prompts ("Inputs") that generate AI responses ("Outputs"). Your Inputs are routed to third-party AI providers to generate Outputs. We store your conversation history so you can access it later. If you include personal data in your Inputs, that data will be processed as part of the Service.
• Files: If you upload files to Bwat, we store them on our servers to provide file management and knowledge base features. Your files remain yours (see Section 7).
• Feedback: Ideas, suggestions, or ratings you provide about the Service. If you rate an Output, we store the related conversation as part of your Feedback.
• Communication Information: If you contact us via support channels, we collect your name, contact information, and message contents.

Personal data we receive automatically from your use of the Services

When you use the Services, we receive certain technical data automatically ("Technical Information"):

• Device and Connection Information: Device type, operating system, browser information, IP address (and approximate location derived from it), time zone, and connection information.
• Usage Information: Dates and times of access, pages viewed, features used, and token consumption data for rate limiting and billing purposes.
• Log and Troubleshooting Information: Error logs, performance data, and diagnostic information when issues occur.
• Cookies & Similar Technologies: We use cookies and similar technologies to manage the Services, recognize you, and analyze usage to make the Services safer and more useful. We do not use advertising cookies or serve ads.

2. Uses of Personal Data

We use your personal data for the following purposes:

• To provide, maintain, and operate the Bwat service, including routing your Inputs to third-party AI providers and delivering Outputs back to you;
• To store and manage your conversation history and uploaded files;
• To create and administer your Bwat account;
• To process payments and manage your subscription;
• To enforce rate limits and usage quotas;
• To communicate with you about the Services, including service announcements and support;
• To prevent and investigate fraud, abuse, and violations of our Usage Policy;
• To investigate and resolve disputes and security issues;
• To debug and repair errors;
• To improve the Services through aggregated, de-identified usage analytics; and
• To enforce our Terms of Service and Usage Policy.

What we do NOT do with your data

• We do not train AI models on your data. Your Inputs, Outputs, and files are not used to train any machine learning models.
• We do not sell your personal data.
• We do not serve advertisements. Your data is never used for ad targeting or shared with advertisers.

3. How We Disclose Personal Data

Casa discloses personal data to the following categories of third parties:

• Third-party AI providers: Your Inputs are sent to third-party LLM providers to generate Outputs. These providers have their own privacy policies governing how they process your data. We encourage you to review the privacy policies of these providers.
• Payment processors: Payment information is shared with our payment processor to process mobile money transactions.
• Authentication providers: We use a third-party authentication service to manage account sign-in. They process your identity and contact data under their own privacy policy.
• Infrastructure providers: We use cloud hosting, database, and storage services that process data on our behalf as service providers.

Casa may also disclose personal data in the following circumstances:

• As part of a significant corporate event: If Casa is involved in a merger, acquisition, or other transfer of business assets, your personal data may be transferred as part of that transaction.
• Pursuant to legal requirements: We may disclose personal data to governmental authorities as required by law, in response to legal process, or to protect the health and safety of any person, to protect against fraud, or to enforce our legal rights.
• With your consent: We will disclose personal data when you give us permission to do so.

4. Rights and Choices

Depending on where you live and applicable laws, you may have the following rights regarding your personal data. We may decline a request if we have a lawful reason for doing so.

To exercise your rights, email us at privacy@casamanagementsolutions.com. We may verify your identity before processing your request. Casa will not discriminate against you for exercising your privacy rights.

• Right to know: The right to know what personal data we process about you, the sources, purposes, and third parties we share it with.
• Access & data portability: The right to request a copy of your personal data, and in certain cases, to port your information.
• Deletion: The right to request deletion of your personal data. You can delete individual conversations from your history at any time; they will be removed from our back-end within 30 days.
• Correction: The right to request correction of inaccurate personal data. Note that we cannot control the factual accuracy of AI-generated Outputs, as these are produced by third-party AI models.
• Objection: The right to object to processing of your personal data on grounds of legitimate interest.
• Restriction: The right to restrict our processing of your personal data in certain circumstances.
• Withdrawal of consent: Where processing is based on consent, you have the right to withdraw it at any time.
• Automated decision-making: Casa does not engage in automated decision-making that produces legal effects or similarly significant effects on you.

5. Data Transfers

When you use the Services, your data may be transferred to servers outside your home country, including to third-party AI providers and infrastructure services. Where required by applicable law, we use appropriate legal frameworks such as standard contractual clauses to safeguard international transfers.

6. Data Retention and Security Controls

Casa retains your personal data for as long as reasonably necessary to provide the Services and for the purposes outlined in this Privacy Policy. When data is no longer needed, we delete, destroy, or anonymize it as required by applicable law.

Aggregated or De-Identified Information

We may process data in aggregated or de-identified form to analyze service effectiveness and improve user experience. For example:

• We analyze aggregated usage patterns (token consumption, feature usage, error rates) to improve the Services. This information does not identify individual users.
• If conversations are flagged for potentially violating our Usage Policy, we may review them for enforcement purposes.

Security Controls

We implement appropriate technical and organizational security measures designed to protect personal data from loss, misuse, unauthorized access, disclosure, alteration, or destruction.

7. Your Content and Files

Your data belongs to you. All content you create through Bwat — including conversations, generated code, and uploaded files — is yours. You retain full ownership and all rights to your content. Casa does not claim any ownership or license over your Inputs, Outputs, or uploaded files beyond what is necessary to operate the Service (i.e., storing and transmitting your data to provide Bwat's functionality).

You may export, share, modify, or delete your content at any time.

8. Children

Our Services are not directed towards children under the age of 18. We do not knowingly collect personal data from children. If you become aware that a child under 18 has provided personal data to us, please email us at privacy@casamanagementsolutions.com and we will investigate and, if appropriate, delete the data.

9. Changes to Our Privacy Policy

Casa may update this Privacy Policy from time to time. We will notify you of material changes and update the date at the top. You can request a summary of changes by contacting us.

10. Contact Information

If you have questions about this Privacy Policy or your personal data, contact us:

Casa Management Solutions Kampala Sir Apollo Kaggwa Road Uganda Email: privacy@casamanagementsolutions.com Website: www.casamanagementsolutions.com Hours: Mon. - Fri. 8AM - 6PM

Under many countries' laws, you have the right to lodge a complaint with the supervisory authority in the place in which you live or work.

11. Legal Bases for Processing

Purpose	Type of Data	Legal Basis
To provide and operate the Bwat service	Identity and Contact Data, Payment Information, Inputs and Outputs, Files	Contract
To create and administer your account	Identity and Contact Data, Payment Information	Contract
To process payments and manage subscriptions	Identity and Contact Data, Payment Information	Contract
To enforce rate limits and usage quotas	Identity and Contact Data, Technical Information	Contract, Legitimate interests: Necessary to ensure fair usage and service availability for all users.
To communicate with you about the Services	Identity and Contact Data, Communication Information, Technical Information	Contract. Consent where required.
To prevent fraud, abuse, and Usage Policy violations	Identity and Contact Data, Inputs and Outputs, Technical Information	Legitimate interests, Legal obligation: Protecting our business, users, and systems from harmful activity.
To investigate and resolve disputes	Identity and Contact Data, Inputs and Outputs, Feedback	Legitimate interests, Legal obligation: Resolving complaints to improve user satisfaction and meet legal obligations.
To investigate and resolve security issues	Identity and Contact Data, Technical Information, Inputs and Outputs	Legal obligation, Legitimate interests: Protecting user data and system integrity.
To debug and repair errors	Identity and Contact Data, Feedback, Technical Information	Legitimate interests: Maintaining reliable service operation.
To improve the Services through aggregated analytics	Technical Information, de-identified usage data	Legitimate interests: Understanding usage patterns to improve service quality.
To enforce our Terms of Service and Usage Policy	Identity and Contact Data, Inputs and Outputs, Technical Information	Contract, Legitimate interests: Maintaining a safe and functional platform.