Privacy Policy

1 Information We Collect

Information You Provide

• Account registration: Shop name, owner name, phone number, email address, and password.
• Business profile: Business type, logo, brand colours, and tagline.
• Sales data: Customer names, phone numbers, product/service descriptions, quantities, and amounts when you create invoices.
• Product catalogue: Item names, descriptions, prices, and units.
• Withdrawal details: Mobile money number, account name, and network for fund withdrawals.
• Staff information: Name and phone number of team members you invite.
• KYC documents: Identity document type, ID number, and document photographs for account verification.

Information Collected Automatically

• Device information: Device type, operating system version, and unique device identifiers.
• Usage data: Features used, screens visited, and actions within the app.
• Push notification tokens: Firebase Cloud Messaging (FCM) tokens for delivery of notifications.
• Transaction logs: Records of all sales, payments, and withdrawals.
• IP address: Used for fraud detection and rate limiting.

Information We Do NOT Collect

• We do not collect customers' full mobile money account numbers or PINs.
• We do not access your device contacts, camera, microphone, or location unless explicitly requested for a feature you initiate.
• We do not use your data for advertising profiling.

2 How We Use Your Information

We use the information we collect to:

• Create and manage your PayZaa account and shop profile
• Process mobile money payments from your customers via Hubtel or Orchard Payment
• Generate and deliver invoice payment links via SMS and WhatsApp
• Send AI-generated receipt SMS messages to customers after cash sales
• Manage your wallet balance and process withdrawal requests
• Send push notifications for payment confirmations, queue updates, and system alerts
• Generate business analytics, revenue reports, and AI sales insights
• Enable team management and staff activity logging
• Verify your identity through our KYC process as required by financial regulations
• Detect fraud, abuse, and prevent unauthorised access
• Comply with applicable laws and regulatory requirements
• Provide customer support
• Improve the app based on aggregated usage patterns

3 Data Sharing & Disclosure

We do not sell your personal information. We share data only in these circumstances:

Payment Processors

Transaction data is shared with Hubtel and Orchard Payment to process mobile money payments. These providers are independently responsible for their own privacy practices.

SMS Providers

Customer phone numbers and message content are shared with Hubtel or SMSOnlineGH (as configured) to deliver SMS notifications and receipts.

AI Services

Aggregated, anonymised sales data (amounts, item names, counts) is sent to Groq AI to generate daily insights and receipt messages. No personal identifiers are included in these requests.

Your Customers

Your shop name, logo, and branding are shown on your customer-facing payment page. Customer data you enter is used solely to process their transaction.

Legal Requirements

We may disclose data if required by law, court order, or government authority in any jurisdiction where we operate.

Service Providers

Trusted third-party providers (cloud hosting, push notifications via Firebase) may process data on our behalf under strict confidentiality agreements.

4 Data Security

We implement industry-standard security to protect your data:

• Encryption in transit: All data between the app/web and our servers is encrypted using HTTPS/TLS.
• Authentication: JWT (JSON Web Token) authentication with 30-day expiry and role-based access control.
• Passwords: Hashed with bcrypt — we never store plain-text passwords.
• Database transactions: Critical financial operations use row-level locking to prevent race conditions.
• Idempotency: Invoice creation uses idempotency keys to prevent duplicate transactions on retry.
• Rate limiting: Login, registration, and sensitive endpoints are rate-limited to prevent brute-force attacks.
• API keys: Payment provider credentials are stored server-side and never exposed to client apps.

5 Data Retention

• Account data: Retained while your account is active. Deleted within 90 days of an account deletion request.
• Transaction records: Retained for 7 years to comply with financial regulations.
• KYC documents: Retained for a minimum of 5 years as required by anti-money laundering regulations.
• Invoice data: Retained for 5 years for business record-keeping.
• Activity logs: Retained for 12 months then automatically purged.
• Push notification tokens: Deleted when you uninstall the app or log out.
• AI prompt data: Not stored by us; subject to Groq's own data retention policies.

6 Your Rights & Controls

You have the right to:

• Access: Request a copy of all personal data we hold about you.
• Correction: Update inaccurate information via the app Settings page or by contacting us.
• Deletion: Request deletion of your account and personal data (see Section 7).
• Portability: Request your data in a portable CSV or JSON format.
• Opt out of notifications: Control push notifications through your device Settings or the in-app Notifications screen.
• Withdraw consent: Stop using the service and request account deletion at any time.

To exercise any right, contact privacy@eliosof.payzaa.com. We will respond within 30 days.

7 Account Deletion

You can request full deletion of your PayZaa account and associated data at any time:

How to delete your account

1. Open the PayZaa app → Settings → scroll to the bottom → tap "Delete Account"
2. Or email privacy@eliosof.payzaa.com with your registered phone number and the subject line "Account Deletion Request"

What gets deleted

• Your shop profile, branding, and login credentials — deleted within 90 days
• Your product catalogue, customer list, and staff records — deleted within 90 days
• Push notification tokens — deleted immediately

What we retain (required by law)

• Transaction records and invoices — retained for 7 years per financial regulations
• KYC identity documents — retained for 5 years per AML regulations
• Wallet withdrawal history — retained for 7 years

8 Payment Data

PayZaa does not store customers' mobile money credentials or process raw card data. All payment processing is handled by Hubtel or Orchard Payment through their PCI-compliant infrastructure.

What PayZaa stores:

• Transaction reference numbers assigned by the payment provider
• Payment amounts and timestamps
• Payment status (pending, paid, failed, voided)
• Mobile network used (MTN, Vodafone, AirtelTigo) — not the full account number

9 Push Notifications

PayZaa sends push notifications via Firebase Cloud Messaging (FCM) for:

• Payment received confirmations
• Withdrawal status updates
• New customer in queue alerts
• System and security alerts

You can disable push notifications at any time in your device Settings (iOS: Settings → Notifications → PayZaa; Android: Settings → Apps → PayZaa → Notifications) or within the app's Notifications screen.

FCM tokens are linked to your device and are deleted from our servers when you log out or uninstall the app.

10 App Tracking & Analytics

PayZaa does not use any third-party advertising networks, cross-app tracking, or advertising identifiers (IDFA/GAID). We do not participate in any ad networks or data brokers.

We collect basic usage analytics (screens visited, features used) solely to improve the app experience. This data is aggregated, not linked to individual identities, and is not shared with third parties for advertising purposes.

On iOS, PayZaa does not request App Tracking Transparency (ATT) permission because we do not track users across apps or websites owned by other companies.

11 Children's Privacy

PayZaa is a business tool intended exclusively for adults (18 years and older) who operate businesses. We do not knowingly collect personal information from anyone under 18.

If you believe we have inadvertently collected data from a minor, please contact us immediately at privacy@eliosof.payzaa.com and we will delete the information promptly.

12 Third-Party Links

The PayZaa app and payment pages may contain links to third-party websites or services (e.g., payment provider pages). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

13 International Data Transfers

PayZaa operates across Africa. Your data may be processed and stored on servers located outside your country of residence. By using PayZaa, you consent to the transfer of your information to servers that may be located in different countries, subject to applicable data protection laws.

We ensure that any such transfers are subject to appropriate safeguards to protect your personal information.

14 Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Sending a push notification through the PayZaa app
• Displaying a notice within the app on next login
• Updating the "Last updated" date at the top of this page
• Emailing you if the change materially affects your rights

Continued use of PayZaa after changes take effect constitutes acceptance of the updated policy.

15 Contact Us

For questions, data requests, or privacy concerns: