Privacy Policy
Last Updated: July 2025
FaidaFlow ("we", "us", "our") operates the FaidaFlow platform — a financial operating system for micro, small, and medium enterprises (MSMEs). This Privacy Policy explains how we collect, use, store, and protect your personal and business data in compliance with the United Republic of Tanzania's Personal Data Protection Act, 2022 (PDPA), the Electronic and Postal Communications Act (EPOCA), and applicable international standards.
1. Data Controller
FaidaFlow operates as the Data Controller for all personal data processed through the Platform. Our registered contact for data protection inquiries is available at privacy@faidaflow.com.
2. Data We Collect
We collect the following categories of data: • Account Information: Full name, email address, phone number (+255), and hashed password when you register. • Business Profile: Business name, physical address, Tax Identification Number (TIN), VAT Registration Number (VRN), business logo, and industry category. • Transaction Data: Income and expense records, invoices, quotations, POS sales, purchase orders, and stock movements that you enter into the Platform. • Customer & Supplier Records: Names, phone numbers, email addresses, and outstanding debt balances of your business contacts. • Usage Data: Device type, IP address, browser version, pages visited, and session duration — collected automatically for security and analytics. • AI Interaction Data: Text or voice inputs provided to the AI Assistant for transaction categorization and business insights.
3. Legal Basis for Processing
Under the Tanzania PDPA 2022 (Section 10), we process your data on the following lawful bases: • Consent: You provide explicit consent during registration and when enabling optional features (e.g., AI insights, email notifications). • Contractual Necessity: Processing is necessary to deliver the services you have subscribed to. • Legitimate Interest: We process usage data for platform security, fraud prevention, and service improvement. • Legal Obligation: We may process data to comply with tax reporting requirements under the Tanzania Revenue Authority (TRA) regulations.
4. How We Use Your Data
Your data is used exclusively for the following purposes: • To operate and deliver FaidaFlow's core bookkeeping, invoicing, POS, inventory, and reporting features. • To generate AI-powered business insights and categorize transactions. • To send service-related communications (account verification, password resets, monthly business summaries). • To generate financial reports (Profit & Loss, Balance Sheet, Tax Reports) that you export. • To improve platform performance, fix bugs, and develop new features. • To comply with Tanzanian tax and financial regulations.
5. Data Storage & Security
• All data is stored in encrypted databases hosted on Supabase infrastructure with AES-256 encryption at rest and TLS 1.3 encryption in transit. • Passwords are hashed using bcrypt with salt rounds and are never stored in plaintext. • Access to production databases is restricted to authorized personnel with multi-factor authentication. • We conduct periodic security audits and vulnerability assessments. • Backups are encrypted and retained for disaster recovery purposes only.
6. Data Sharing & Third Parties
We do NOT sell, rent, or trade your personal or business data to third parties. Data is shared only with: • Infrastructure Providers: Supabase (database hosting), Vercel (application hosting) — bound by Data Processing Agreements. • AI Services: Google Gemini API — for transaction categorization and insights generation. Only anonymized transaction descriptions are sent; no personally identifiable information is transmitted. • Email Delivery: NodeMailer via SMTP — for sending transactional emails. • Future Payment Processors: When payment integrations are activated, transaction data necessary for processing payments will be shared with licensed payment service providers operating under the Bank of Tanzania regulations. You will be notified before any such integration is activated.
7. Your Rights Under the PDPA 2022
As a data subject under Tanzanian law, you have the following rights: • Right of Access (Section 16): You may request a copy of all personal data we hold about you. • Right to Rectification (Section 17): You may request correction of inaccurate or incomplete data. • Right to Erasure (Section 18): You may request deletion of your personal data, subject to legal retention obligations. • Right to Data Portability (Section 19): You may request your data in a machine-readable format (CSV/JSON export is available in-app). • Right to Object (Section 20): You may object to processing based on legitimate interest. • Right to Withdraw Consent: You may withdraw consent at any time by contacting us. To exercise any of these rights, contact us at privacy@faidaflow.com. We will respond within 30 days as required by law.
8. Data Retention
• Active account data is retained for the duration of your subscription. • Upon account deletion, personal data is permanently erased within 90 days, except where retention is required by Tanzanian tax law (TRA requires business records to be retained for 5 years). • Usage analytics are anonymized after 12 months.
9. Cookies & Local Storage
FaidaFlow uses essential cookies and browser local storage for: • Authentication: Maintaining your login session. • Preferences: Storing your language preference (Swahili/English) and theme settings. • PWA Support: Caching application assets for offline access. We do NOT use third-party advertising or tracking cookies.
10. Children's Privacy
FaidaFlow is designed for business use and is not directed at individuals under the age of 18. We do not knowingly collect data from minors. If you believe a minor has provided us with personal data, please contact us immediately.
11. International Data Transfers
Your data may be processed on servers located outside Tanzania (via Supabase and Vercel infrastructure). In all cases, we ensure that adequate data protection safeguards are in place as required by Section 29 of the PDPA 2022, including Data Processing Agreements with all sub-processors.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email notification and an in-app banner. Continued use of the Platform after such notification constitutes acceptance of the updated policy.
13. Contact & Complaints
For privacy inquiries, data access requests, or complaints: • Email: privacy@faidaflow.com • Regulatory Authority: If you are dissatisfied with our response, you may lodge a complaint with the Tanzania Information and Communication Technology Commission (TCRA) or the relevant data protection authority designated under the PDPA 2022.