bridGe Privacy Policy

bridGe is operated by ITEDA Solutions, based in Nairobi, Kenya. For the data described in this policy, ITEDA Solutions acts as the data controller in respect of form owners' account and settlement details, and as a data processor acting on the form owner's instructions in respect of their respondents' form answers. Contact: info@itedasolutions.com.

This policy is written to meet the disclosure requirements of Kenya's Data Protection Act, 2019 and, where it applies to a given user, the EU/UK General Data Protection Regulation.

• Performance of a contract. Processing a respondent's phone number and payment amount is necessary to carry out the payment they chose to initiate by submitting the form, and to deliver the service a form owner signed up for.
• Legal obligation. Payment and transaction records are retained to meet tax, accounting and financial-record obligations under Kenyan law.
• Legitimate interests. Securing the service, preventing fraud and abuse, and keeping operational logs — balanced against the rights of the people involved, which is why identifiers such as phone numbers are masked in those logs.
• Consent. Where consent is the basis (for example, a form owner granting bridGe access to a specific spreadsheet), it can be withdrawn at any time; see “Your rights” below.

• Form owners: your Google account email, the M-Pesa number and payment destination (Paybill, Till, or bank account) you configure, and your form/sheet identifiers.
• Respondents: the M-Pesa phone number entered on the form, the payment amount, the transaction status and M-Pesa receipt number, and the form responses needed to compute the amount. Where the form collects an email address, we also process it to send payment receipts and payment-failure notices.
• Technical: logs required to operate and secure the service (with phone numbers redacted where feasible).

bridGe accesses your Google Forms and the linked Google Sheet only to add the payment section, read the fields needed to compute the amount, and write the payment status back to your responses sheet. To calculate and process each payment, the phone number and the amount due are sent to bridGe's own secure systems, which communicate with Safaricom to initiate the M-Pesa request. Your form and sheet content is not sent anywhere else. bridGe's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements. We do not use Google user data for advertising, and we do not sell it.

• To initiate M-Pesa payments and record their outcome.
• To update your responses sheet with payment status.
• To provide support, prevent abuse, and meet legal obligations.

If the form collects a respondent's email address, bridGe uses it to send a receipt when a payment succeeds, and a notice with a retry link when a payment fails. For form owners on our Direct settlement tier, bridGe periodically emails an invoice (with a link to pay bridGe's service fee) to the Google account email you registered the form with. All of these are transactional messages tied to a specific payment or invoice, not marketing. We do not send marketing email, and we do not share respondent or owner email addresses with anyone else.

We share the minimum data necessary with Safaricom (M-Pesa) to process payments, and we operate on Google Cloud. We do not sell your data.

Because bridGe handles payment information, we maintain organisational and technical safeguards appropriate to that sensitivity:

• Encryption in transit and at rest. All data moving between the add-on, our systems, and the payment provider travels over encrypted connections, and stored payment and form records are encrypted at rest.
• Protected credentials. Keys and payment credentials are held in a dedicated, access-controlled credential store rather than in the application itself.
• Authenticated, role-separated access. Our systems require authentication, with administrative access separated from ordinary service access and limited to a small number of named, authorised personnel.
• Data minimisation. Phone numbers and bank account numbers are masked wherever they are displayed or recorded — including on payment pages seen by respondents and in a form owner's own settings. Full values are used only where completing the payment requires them.
• What we never receive. bridGe never sees or stores M-Pesa PINs, banking passwords, or card details. Respondents authorise each payment directly with Safaricom on their own device; that authorisation never passes through bridGe.
• Least-privilege access to your Google account. bridGe requests access only to the specific spreadsheet you create or select for a form, never to your Google Drive as a whole. bridGe does request access to your Google Forms, which Google grants at the account level rather than per form — this is required so that the add-on's background trigger can write payment results back to your responses sheet after you have closed the form, and it is used for no other purpose.

We retain payment records for as long as needed to operate the service and to meet legal and accounting obligations under Kenyan law, after which they are deleted or anonymised. Form owners can disconnect bridGe from a form at any time, and can request deletion of their stored configuration and payment records by emailing info@itedasolutions.com. We respond to deletion requests within 30 days.

We do not use data obtained through Google Workspace APIs — including your form responses, spreadsheet contents, or any personal data of your respondents — to develop, improve, or train generalised artificial intelligence or machine learning models. We do not transfer such data to any third party for that purpose.

bridGe is operated from Kenya, but our systems and cloud service providers process and store data on servers located outside Kenya, including in South Africa. This means your personal data may be transferred and processed outside Kenya and outside the European Economic Area, under the data-protection terms and safeguards offered by those providers. Payment instructions are additionally transmitted to Safaricom PLC in Kenya, which is necessary to execute an M-Pesa payment.

Subject to the conditions in the applicable law, you have the right to:

• be informed about how your data is used (this policy);
• request access to the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of your data, where we are not required to retain it for legal or accounting reasons;
• request restriction of or object to processing;
• request portability of data you provided to us, in a structured, commonly used format;
• withdraw consent at any time where processing is based on consent — for form owners, this includes disconnecting bridGe from a form, or revoking bridGe's access to your Google account at myaccount.google.com/permissions (opens in a new tab).

To exercise any of these, email info@itedasolutions.com. We respond within 30 days. If your data was submitted through someone else's form, we may need to direct your request to that form owner, who decides what their form collects.

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.

If you believe we have mishandled your personal data, please contact us first so we can put it right. You also have the right to complain to a supervisory authority: in Kenya, the Office of the Data Protection Commissioner (odpc.go.ke (opens in a new tab)); in the EEA or UK, your local data protection authority.

Questions or requests: info@itedasolutions.com.

We may update this policy; material changes will be reflected here with a new effective date.