Privacy Policy

1. Introduction

bhuru ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal information when you use the bhuru platform. By using our Service, you consent to the practices described in this policy.

2. Information We Collect

Information you provide directly:

• Phone number (required for all transactions)
• Email address (optional, for receipt delivery)
• Meter numbers, vehicle registration numbers, and other service-specific details
• Name and profile information (if you register via Google OAuth)

Information collected automatically:

• Transaction records (reference number, service type, amount, status, timestamp)
• IP address and user agent (for security and rate limiting)
• Currency preference cookie
• Session data managed by our authentication system
• Push notification token and app installation identifier, when notifications are enabled
• Optional screenshots that you choose to attach to a bug report

Information from third parties:

• Google profile information (name, email, profile picture) when you sign in with Google OAuth
• Payment confirmation data from Paynow (transaction reference, payment method type, and payment status)

Gifting and bhuru tags:

• If you choose a bhuru tag to receive gifts, we store the tag together with the display name and avatar you choose to show, and your per-service gift settings.
• When you send a gift, we store the gift details, any message you add, and the identifiers of the sender and recipient in order to deliver, claim, or refund it.
• Resolving a bhuru tag or gift link reveals only the display name, avatar, and giftable services the recipient has chosen to show. It never reveals their phone number, email address, meter or account numbers, saved details, balance, or transaction history to the person sending the gift.

3. How We Use Your Information

• To process your transactions and deliver purchased services
• To send SMS and email confirmations with your transaction reference number
• To link guest transactions to your account when you register
• To display your transaction history in your dashboard
• To send insurance renewal reminders (if opted in)
• To detect and prevent fraud and abuse
• To deliver requested push notifications and reminders
• To investigate feedback and bug reports you submit
• To comply with legal obligations
• To send marketing communications (only with your explicit consent; you can opt out at any time from your profile page)

4. Data Sharing & Processing Roles

We share your information only as necessary to provide the Service:

• Paynow & EcoCash Direct: Mobile money payment collection. Your phone number and transaction charge details are shared with your payment provider to request and verify payment.
• Service providers (ZETDC, mobile networks, insurance companies): Meter numbers, phone numbers, and vehicle details are shared with the relevant provider to fulfill your purchase.
• Email provider: A transactional email provider delivers your transaction confirmations and receipts.
• Cloud database & hosting: Your data is stored and served by our cloud database and hosting providers.
• Push notifications: A push-notification provider uses your push token and app installation information to deliver the notifications you enable.

We do not sell your personal information to third parties. A current list of our sub-processors is available on request at privacy@bhuru.com.

Our role and the roles of third parties

bhuru is the data controller for the personal information you provide to us — we determine how and why it is processed. The third parties above fall into two groups:

• Service providers (data processors): Our email, database, hosting, and push-notification providers process personal information on our behalf and under our instructions, only to operate, secure, and support the Service.
• Principals (independent recipients): Payment providers (Paynow, EcoCash Direct) and the providers you buy from (ZETDC, mobile networks, insurers) receive the information necessary to fulfil your purchase and process it under their own privacy terms as independent controllers.

Data processing agreements

Where we engage a service provider to process personal information on our behalf, we require it to protect that information, use it only for the agreed purpose, keep it confidential, and return or delete it when our engagement ends. Business partners and billers who need a formal Data Processing Agreement (DPA) with specific commitments can request one at privacy@bhuru.com; where a DPA is signed, its terms govern that processing.

5. Data Retention

• Transaction records: Retained for 7 years for financial compliance purposes.
• Account data: Retained until you delete your account. You can delete your account from your profile page.
• Audit logs: Retained for 2 years for security and compliance purposes.
• Session data: Managed securely by our authentication system with automatic expiry.
• Push tokens: Retained while notifications are enabled or until the installation is unregistered.
• Feedback attachments: Retained only as long as needed to investigate and resolve the submitted report, subject to legal and security requirements.
• Gift funds and records: Funds from an unclaimed gift are held for 30 days before being refunded in line with our Terms; thereafter the associated transaction record is retained with other transaction records for compliance.

6. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of your personal data from your profile page.
• Deletion: Delete your account and associated data from Profile > Account Settings in the mobile app. You may also email privacy@bhuru.com. Transaction and audit records may be retained for the compliance periods stated above.
• Opt-out: Opt out of marketing communications from your profile page at any time.
• Correction: Update your phone number and profile information from your profile page.

7. Security

We implement industry-standard security measures including TLS encryption for all data in transit, strong industry-standard encryption at rest for sensitive stored data (such as saved payment details), secure on-device storage for authentication tokens, access controls on user-facing data, and rate limiting on sensitive API endpoints. However, no system is completely secure. We encourage you to protect your device and Google account.

8. Cookies

We use a single functional cookie (bhuru.currency) to remember your currency preference (USD or ZIG). This cookie does not track you across other websites and is not used for advertising. Session cookies are managed by our authentication system for authentication purposes.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. We will notify registered users of material changes via email.

10. Children's Privacy

Our Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18 without the written consent of a parent or guardian. If you are a parent or guardian and believe your child has provided us with personal information, please contact us, and we will take steps to delete such information.

11. Contact

For privacy-related questions or to exercise your rights, contact us at privacy@bhuru.com.