Privacy Policy

1. Statutory Compliance

Swap Africa collects, processes, and protects personal data in strict compliance with the Data Protection and Privacy Act, 2019 of Uganda and the Data Protection and Privacy Regulations, 2021.

2. Information We Collect

• Buyers (Guest Sessions): 24-hour guest session tokens stored solely as SHA-256 cryptographic hashes, payment phone numbers, and delivery drop-off addresses.
• Sellers: Phone numbers (authenticated via OTP), profile information, government-issued KYC verification documents (National ID/Passport), and shop logos.
• Riders / Couriers: Vetting credentials, contact details, payout destination phone numbers (used for account holder name verification and mobile money earnings disbursement), and real-time location data transmitted during active delivery gigs.

3. Signing in with Google

If you choose Continue with Google, Google shares your name, email address and profile picture with Swap Africa. We request only these basic details (Google's openid, email and profile permissions). We never receive your Google password, and we have no access to your Gmail, contacts, files or any other data in your Google Account.

We use these details to create your Swap account and sign you in, to show your name on your account, and to send account and transaction emails to that address. We do not sell them, use them for advertising, or share them with anyone other than the service providers that run Swap's sign-in and databases on our behalf, under the same safeguards as the rest of your data.

The details are stored with your Swap account and are deleted when you delete your account, except where section 6 requires us to keep financial records. You can also remove Swap's access at any time from your Google Account at myaccount.google.com/permissions. That stops future Google sign-ins but does not delete your Swap account.

Swap Africa's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Data Security & Storage Safeguards

Data is encrypted in transit (TLS 1.3 / HTTPS) and at rest (AES-256). Private KYC files are stored securely in isolated storage and are accessed by authorized administrators strictly via short-lived 60-second signed URLs. Raw session tokens, security PINs, and authorization secrets are never stored in plain text or logged in system traces.

5. Information Sharing & Third Parties

Personal data is shared strictly as required to process transactions:

• Licensed Mobile Money Operators (MTN Mobile Money, Airtel Money) for account holder verification, funding collections, refunds, and earnings payouts.
• SMS delivery partners for transaction One-Time Passwords (OTPs) and notifications.
• Assigned delivery riders (receiving buyer contact name and drop-off coordinates during active delivery).
• Regulatory authorities (Financial Intelligence Authority, Bank of Uganda) when mandated by statutory law.

6. Retention, In-App Account Deletion & Your Rights

Financial ledger records and audit logs are retained for 7 years as required under statutory financial laws. Temporary guest session records expire and are deleted after 24 hours.

In-App Account Deletion: Registered users and riders can delete their accounts at any time directly within the application under Account / Settings > Delete Account. Deleting your account permanently revokes your authentication credentials, terminates active sessions, and deletes or anonymizes non-statutory personal data.

Under the Data Protection and Privacy Act, 2019, you have the right to access, correct, or request deletion of your personal data, and to object to processing. Contact our privacy team at [email protected] to submit a request.