Privacy Policy

1. Who we are

SakuraPay is a product of SakuraGroup Ltd, a company registered in the United Republic of Tanzania (TIN 152-129-074). Our registered office is in Dar es Salaam, Tanzania.

Data controller contact: [email protected] · +255 753 930 000.

2. What data we collect

We collect and process the following categories of personal data:

• Account data — name, email address, phone number, company name, and authentication credentials when you register.
• Transaction data — mobile money payment records including sender/receiver name, phone number, amount, reference code, date/time, and network operator.
• Device data — device model, OS version, app version, and identifiers necessary for the service.
• Usage data — pages visited, features used, timestamps, and interaction patterns on the dashboard.
• Support data — any information you provide when contacting our support team.

3. Why we process your data

• Performance of contract — to provide the SakuraPay service you have subscribed to, including capturing and displaying mobile money transactions.
• Legitimate interest — to improve our service, detect fraud, ensure security, and provide customer support.
• Legal obligation — to comply with Tanzanian tax and financial regulations, including record keeping for TRA audits.
• Consent — for optional features such as marketing communications. You can withdraw consent at any time.

4. How we use your data

• Display mobile money transactions on your dashboard in real time.
• Send transaction alerts and confirmations via push notifications and SMS.
• Generate revenue analytics, statements, and reconciliation reports.
• Authenticate your identity and secure your account.
• Provide technical support and respond to enquiries.
• Improve our products, features, and user experience.
• Comply with applicable laws and lawful government requests.

5. Data sharing

We do not sell your personal data. We may share data with:

• Infrastructure providers — Google Cloud Platform, Vercel, for the purpose of operating the service. Bound by data processing agreements.
• SMS gateway — for sending transaction confirmation messages to your customers. Only the phone number and transaction summary are shared.
• Law enforcement — when required by Tanzanian law or a valid court order.

6. Data security

• All data in transit is encrypted using TLS 1.2 or higher.
• Sensitive data at rest is encrypted using AES-256.
• API keys and secrets are stored in secure key stores and secret managers.
• Dashboard access is protected by OAuth 2.0 with session management.

7. Data retention

We retain transaction data for the duration of your subscription plus 90 days after account closure, unless a longer retention period is required by law (e.g., TRA requires 5-year financial records). You may request earlier deletion — see our Data Deletion Policy.

8. Your rights

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your data (subject to legal retention requirements).
• Data portability — request your data in a machine-readable format (CSV/JSON).
• Restrict processing — request that we limit how we use your data.
• Withdraw consent — for processing based on consent, at any time.

To exercise any of these rights, email [email protected] with subject line “Privacy Request”. We will respond within 30 days.

9. Children’s privacy

SakuraPay is a business tool and is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from children.

10. Cookies

The SakuraPay dashboard uses essential cookies for authentication and session management. We do not use advertising or third-party tracking cookies.

11. App permissions

The SakuraPay companion app requests only the permissions necessary to operate the service, including internet access, camera (for QR code pairing), and background operation. No unnecessary data is collected or stored.

12. International data transfers

Your data may be processed on servers located outside Tanzania (Google Cloud Platform regions). We ensure appropriate safeguards are in place, including data processing agreements with our infrastructure providers.

13. Changes to this policy

We may update this privacy policy from time to time. Material changes will be notified via email or an in-app notice at least 14 days before taking effect.

14. Contact us