Legal
Privacy Policy
Version: 2026-07-18 · Last updated: 18 Jul 2026
TemboPay (“we”) provides payment and wallet software for Tanzanian businesses. We act as a business-facing platform that routes payments through a licensed payment service provider (currently Selcom). This policy explains what personal data we collect, why, how long we keep it, and who receives it.
What we collect
- Account details: name, email, phone, business profile.
- Know-your-business data for merchants: TIN, incorporation documents, physical address, beneficial owner identity details, PEP declaration, settlement mobile-money number.
- Payment and wallet records: amounts, currencies, channels (mobile money, card hosted checkout, TAN-QR, wallet), timestamps, IP address, and device metadata needed for security and AML monitoring.
- Support and complaint records, including reference numbers.
- Consent records (policy version, time, IP).
We do not store raw card numbers (PAN) or CVV. Card payments are handled on the licensed processor’s hosted checkout.
Why we collect it
- To provide checkout, wallets, settlement visibility, and developer APIs.
- To meet AML / record-keeping expectations applicable to payment activity (transaction records retained for at least 10 years).
- To handle consumer complaints and security investigations.
Where data lives
Production personal data is intended to be hosted in Tanzania. If that changes, we will update this policy and obtain any additional consents or transfer safeguards required under the Personal Data Protection Act, 2022.
Who we share with
- Selcom (or another licensed rail we integrate) — to process payments and settle funds.
- Regulators or law enforcement when legally required.
- Infrastructure and communications providers under contract, solely to operate the service.
Retention
Transaction, KYB, consent, complaint, and AML review records are retained for at least 10 years from the relevant transaction or end of the business relationship, unless a longer legal hold applies.
Your rights
You may request access to or correction of your personal data, and file a privacy-related complaint via our complaint channel. Withdrawing consent may prevent us from providing payment services that depend on that processing.