Usalama Escrow — Privacy Policy

This policy explains what we collect, why, who sees it, and what you can do about it. It is written to be understood rather than to be unreadable.

We handle personal data under the Personal Data Protection Act, 2022 of the United Republic of Tanzania.

1. What we collect

To create your account: your phone number, and a one-time code we send to confirm it is yours.

To verify your identity: your full name as written on your NIDA card, your 20-digit National Identification Number, and the mobile money number where your money will be sent. Where document verification is required, a photograph of your identity document and a photograph of your face.

To secure your account: a cryptographic hash of your PIN. We do not store the PIN itself and cannot recover it. Whether you have chosen to use a fingerprint or face unlock is stored on your phone, not with us.

When you trade: what you sold or bought, the amounts, the order codes, the dates, and a photograph of the parcel when you mark an order shipped.

When you report a problem: what you tell us about what went wrong, and anything you send us as evidence.

Automatically: the times you signed in, the device you used, and a record of the actions you took in the app.

We do not collect your location. We do not read your messages or contacts. We do not track you across other apps or websites. We have no advertisers.

2. Your fingerprint and your face

If you unlock the app with a fingerprint or face, that biometric never reaches us. It is compared inside your phone's secure hardware — the Secure Enclave on iPhone, the hardware keystore on Android — which tells the app only yes or no. We cannot read it, store it, or send it anywhere, and neither can Apple or Google.

3. Why we collect it

To provide the service. We cannot arrange for your money to be held and then sent to the right person without knowing who you are and where your money should go.

Because the law requires it. Tanzanian anti-money-laundering law requires financial services to know who their customers are. Your NIDA is collected for this reason, not because we want it.

To settle disputes. When two people disagree about an order, the record of what happened is what allows a fair decision. Without it, every dispute would come down to who argued loudest.

To detect fraud and money laundering. We look for patterns that suggest the service is being used to move money rather than to buy goods.

4. Your National Identification Number

This is the most sensitive thing we hold, and it is treated differently from everything else.

It is never shown to anyone you trade with. A buyer sees a seller's name and their trading record. They never see a NIDA.

Our own staff see only the last four digits. Every screen in our administration system masks it.

Full disclosure requires a logged legal request. Only a senior administrator can reveal a complete NIDA, only with a stated legal basis, and every such disclosure is permanently recorded with the name of the person who made it.

5. Who we share it with

NEDA Labs Limited, our payment partner, receives your name, NIDA and mobile money number. They hold the money and are required to verify who their customers are. They operate under the oversight of the Bank of Tanzania.

Our identity verification provider receives your documents and photograph when document verification is required. They check them and tell us the result.

Your counterparty sees your name, your business name if you have one, how many completed orders you have, and how many disputes. They see nothing else.

Authorities, where we are required by law to disclose, including the Financial Intelligence Unit and the courts.

We do not sell your data. We do not share it for advertising.

6. How long we keep it

Transaction records: seven years after the order completes. This is a legal requirement for financial records and we cannot shorten it, including at your request.

Identity records: seven years after your account closes, for the same reason. A date is recorded when your account closes, and the records are destroyed automatically when it passes.

Parcel photographs: two years, or until any dispute about that order is resolved and the period for challenging it has passed.

Sign-in and activity records: two years.

One-time codes: ten minutes, then deleted.

7. Closing your account

Closing your account from within the app removes your name, business name, PIN, payout number, and your profile as anybody else sees it. Every device is signed out and notifications stop.

Your transaction records are not deleted. We are required to keep them, and your counterparty's record of a completed trade is theirs as much as it is yours. They are destroyed seven years later.

You may return. Signing up again with the same number reopens your account, with its trading history.

8. Your rights

Under the Personal Data Protection Act you may:

See what we hold about you. Ask us and we will provide it within 30 days.

Correct it. If your name or number is wrong, tell us. Some fields are locked after verification — contact us and we will correct them with you.

Ask us to delete it. You can close your account in the app, as described above. Some records must be kept for the period stated.

Object to how we use it, or ask us to restrict it, where the law allows.

Complain. To us first, at support@usalamaescrow.co.tz. If we do not resolve it, to the Personal Data Protection Commission of Tanzania.

9. How we protect it

Your NIDA is stored in our database and never written to logs or displayed except as described above. Your PIN is stored only as a cryptographic hash and cannot be read by anyone, including us.

All communication between the app and our systems is encrypted. Your session credential is held in your phone's secure storage, not in ordinary app data. Access to customer data by our staff is restricted by role and every access is recorded permanently, including who looked and when.

No system is perfectly secure. If a breach occurs that puts your data at risk, we will tell you and the Commission as required by law.

10. Children

Usalama Escrow is not for anyone under 18. We do not knowingly collect data from children. If we learn that we have, we will delete it.

11. Changes

We may update this policy. Material changes will be shown in the app at least 14 days before they take effect.

12. Contact

USALAMA ESCROW LIMITED Mwanjelwa Sokoni, Room No. 257, Mbeya · P.O. Box 2817, Mbeya, Tanzania support@usalamaescrow.co.tz

Data protection enquiries: support@usalamaescrow.co.tz