Your Privacy at Shashura

1. Who We Are

Shashura is a payments and financial technology service operated by Techdom Digital Solutions (U) Ltd, a company incorporated in Uganda ("we", "us", "our"). Shashura provides Mobile Money collection and disbursement services, payment links, merchant tools and a WhatsApp-based interface for customers and merchants.

For all privacy enquiries, including requests to access, correct or delete your data, contact us at info@shashura.com.

---

2. Information We Collect

We only collect information that is necessary to provide our services, comply with the law, and keep your money and account safe.

2.1 Information You Provide

• Account details: full name, phone number, email address (optional), business name and registration details for merchant accounts.
• Authentication credentials: a password (stored as a one-way bcrypt hash — we never see the plaintext) and one-time codes sent during sensitive operations.
• KYC information: for merchants and SACCOs, we may collect identification documents, signatory details and business registration documents to comply with anti-money-laundering laws.
• Customer fields on payment links: if a merchant configures their payment link to ask for additional information (for example, a student number or order reference), we capture and store what you provide on that link.
• Support correspondence: messages you send us via email, the contact form, or WhatsApp.

2.2 Information Generated by Your Use of the Service

• Transaction data: amount, sender and recipient phone numbers, network (MTN / Airtel), reference IDs, timestamps, fees applied and the success or failure status of every collection or disbursement.
• WhatsApp conversation logs: when you message our WhatsApp business number, we store the messages and your selections (e.g. menu choices, amounts entered, merchant codes) for the duration of the conversation and as part of the transaction record.
• Subscription and billing records: if you pay a recurring or subscription-style payment link, we keep a record of your subscription state, renewal dates and payment history.
• Technical data: IP address, browser/device information, pages visited and approximate location derived from IP — used for security, fraud prevention and service reliability.
• Audit logs: a record of administrative actions, OTP issuance and verification, fee changes and similar events, kept for security and regulatory purposes.

2.3 Information from Third Parties

• Telco name lookups: when you initiate a transaction, we may query MTN MoMo or Airtel Money to confirm the registered name on a phone number, so we can show it to the sender for verification before the money moves.
• Callback data: the mobile money providers send us status updates after a transaction completes or fails. These updates are part of the transaction record we keep.

---

3. Why We Use Your Information

We use the information we collect for these specific purposes, and no others:

• To process your transactions — the most important reason. We pass your phone number, amount and reference to MTN or Airtel so they can debit or credit your account.
• To verify your identity when you log in, set up an account, withdraw funds, or take other sensitive actions.
• To communicate with you — sending transaction receipts, security codes, subscription reminders, account notifications and replies via email, SMS and WhatsApp.
• To prevent fraud and abuse — including detecting unusual activity, protecting your wallet from unauthorised access, and complying with financial-crime obligations.
• To improve the service — anonymous, aggregated usage patterns help us identify slow flows, common errors, and features customers actually need.
• To meet legal obligations — including reporting to the Bank of Uganda, Financial Intelligence Authority, Uganda Revenue Authority and other regulators when required by law.

We do not use your data for advertising, profiling for marketing purposes, or sale to third parties.

---

4. Who We Share Your Information With

We share data only with the following categories of recipients, and only the data each one needs to do its specific job:

We will never sell your personal information, share it with advertising networks, or disclose it to anyone else without your consent or a clear legal obligation.

---

5. How We Store and Protect Your Information

We take security seriously because we have to — we are moving money. Our protections include:

• Encryption in transit: all connections to Shashura, including the API, the merchant portal and webhooks, use HTTPS with modern TLS.
• Password hashing: we never store your password in readable form. We use bcrypt with industry-standard work factors.
• Two-factor authentication: sensitive actions (such as withdrawals) require a one-time code delivered to your registered email or phone, in addition to your password or WhatsApp identity.
• Least-privilege access: only authorised members of our engineering and operations teams can access production systems, and access is logged.
• Regular reviews: we review our code and infrastructure for security weaknesses on an ongoing basis.

No system is impossible to compromise, so we encourage you to use a strong, unique password, keep your phone secure and tell us immediately if you suspect anything unusual on your account.

---

6. How Long We Keep Your Information

We keep different categories of information for different periods, in line with our regulatory obligations:

• Transaction records: retained for at least 10 years from the date of the transaction, in line with anti-money-laundering record-keeping requirements.
• Account and KYC information: retained for the duration of your account plus a further 7 years after closure.
• WhatsApp conversation context: session state expires after 30 minutes of inactivity. The underlying transactions are retained per the rules above.
• Audit and security logs: retained for at least 1 year, longer where investigations are ongoing.
• Marketing preferences and unsubscribes: retained indefinitely so we can honour your choice.

Once a retention period expires, we either delete the data or anonymise it so it can no longer be linked back to you.

---

7. Your Rights

Under Uganda's Data Protection and Privacy Act, 2019, you have the following rights over your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to fix anything that is inaccurate or out of date.
• Deletion: ask us to delete your data, subject to records we are legally required to keep.
• Restriction: ask us to limit how we use your data while a complaint is being resolved.
• Objection: object to specific uses, particularly for any direct marketing.
• Withdraw consent: where we rely on your consent, you can withdraw it at any time.
• Lodge a complaint: with Uganda's Personal Data Protection Office (PDPO) if you believe we are not handling your data properly.

To exercise any of these rights, email info@shashura.com. We will respond within 30 days. There is no charge for reasonable requests.

---

8. Specific Notes for WhatsApp Users

When you message our WhatsApp business number, the following also applies:

• Your messages are processed via Meta's WhatsApp Cloud API. Meta's own privacy policy governs that processing — see whatsapp.com/legal/privacy-policy.
• The first time you message us, if your number is not yet linked to a Shashura account, we will guide you through a self-registration step. Completing it creates a Shashura personal account in your name.
• We may message you back proactively (within Meta's policy windows) to confirm transactions you initiated, send security codes you requested, or remind you about a subscription you signed up for.
• You can stop receiving messages from us by replying STOP at any time. This will not delete your account but will end conversational notifications.

---

9. Children

Shashura is not intended for use by anyone under 18. We do not knowingly collect personal data from children. If you believe a child has registered, contact us and we will remove the account.

---

10. Changes to This Policy

We may update this policy from time to time — for example, when we introduce a new feature, a new third party joins our processing chain, or the law changes. Material changes will be notified via email (where we have one for you) and an in-app notice. The "Last updated" date at the top of this page always reflects the current version.

---

11. Contact Us

If you have any questions about this policy, or want to exercise your rights, please reach out:

By using Shashura, you acknowledge that you have read this Privacy Policy and agree to the practices described above.