Privacy Policy

Last updated 4 October 2026

This policy explains how TiinyPay ("TiinyPay", "we") collects and uses personal data, in line with Uganda’s Data Protection and Privacy Act, 2019 and its Regulations. We are the data controller for the data described here.

1. What we collect

• Account data: name, email, business name, password (stored only as a one-way hash), and your authenticator set-up.
• Verification data: National Identification Number, ID document images, business registration documents, Tax Identification Number, phone numbers, LinkedIn profile link, and a short video and photos from the live check.
• Transaction data: phone numbers you collect from or pay, amounts, references, registered names returned when a number is checked, and transaction outcomes.
• Technical data: IP address, browser and device information, sign-in times and security logs.

2. Why we use it

• To provide the service: create your account, process payments and payouts, keep wallet balances and send you service emails and SMS codes.
• To verify identity and prevent fraud, money laundering and misuse, including blocking sign-ins from VPNs and proxies.
• To meet legal obligations, including record keeping and reporting under Ugandan law.
• To keep the service secure and improve it.

We rely on your consent, the need to perform our contract with you, our legal obligations, and our legitimate interest in preventing fraud.

3. Who we share it with

We share only what each party needs: our mobile money payment partner and the mobile network operators (to move money and check numbers); our email providers (Resend, or our own mail server); our SMS provider (Pahappa); an IP-reputation service (to detect VPNs and proxies); and regulators, courts or law enforcement where the law requires. When you check a new password, only a partial, anonymous fingerprint of it is compared against known breached passwords; your password itself never leaves our servers. Some providers process data outside Uganda; where they do, we use providers with appropriate safeguards. We never sell personal data.

4. How we protect it

Identity documents and live-check recordings are encrypted at rest and are only viewable by authorised staff, and each viewing is logged. Accounts are protected by two-factor authentication. Access to our systems is restricted and audited.

5. How long we keep it

We keep account, verification and transaction records for as long as your account is open and afterwards for as long as the law requires, which for financial and identification records can be up to 10 years. Security logs are kept for a shorter period unless needed to investigate an incident.

6. Your rights

You can ask to access the personal data we hold about you, to correct it, or to have it deleted or its use restricted where the law allows (some records must be kept for legal reasons). You can object to processing based on our legitimate interests, and withdraw consent where we rely on it. You can also complain to the Personal Data Protection Office of Uganda. To use your rights, email [email protected].

7. If you are a merchant’s customer

If you pay or receive money through a business that uses TiinyPay, that business decides why your data is collected and is responsible to you for it. We process your data on its behalf to carry out the payment, and for our own legal and fraud-prevention duties.

8. Cookies

We use only essential cookies: to keep you signed in, protect forms from forgery, and bind a live check to the device that started it. We don’t use advertising or tracking cookies.

9. Children

TiinyPay is not for anyone under 18, and we don’t knowingly collect their data.

10. Changes and contact

We’ll post updates here and tell you about significant changes. Questions: [email protected].