1. Scope and Roles
This Privacy Policy explains how Rejesho collects, uses and protects data in connection with the Service. Rejesho acts in two different roles. For Tenant and Member financial data, entered by a Tenant institution and its Authorized Users, Rejesho acts as a data processor, processing that data strictly on the Tenant's instructions. For its own limited data, such as a tenant admin's account details and billing information, Rejesho acts as a data controller.
Where you are a Member of a Tenant institution, your loan and collection data is controlled by that institution, not by Rejesho. Requests about that data should be directed to the institution, as explained in Section 7.
2. What Data We Collect
Account data: Names, phone numbers, email addresses and roles of Authorized Users, collected to create and manage accounts on the Service.
Member and financial data: Member names, phone numbers, loan and collection records, and group and branch structure, entered by Tenants and their Authorized Users on the institution's behalf. This data is collected from Tenants, not directly from Members by Rejesho.
Authentication data: Where Google sign-in is used, the name, email address and profile photo associated with the Google account, used only to verify identity.
Usage and device data: Standard web access information such as browser type, IP address and pages visited, collected through normal use of the Service.
SMS delivery metadata: Phone numbers and message delivery status passed to Africa's Talking, Rejesho's SMS provider, to deliver collection and loan notifications under the sender ID REJESHO.
3. How We Use Data
Data is used to operate the Service, process collections and loan transactions, send SMS notifications to Members, provide support to Tenants and Authorized Users, secure accounts against unauthorized access, and improve the reliability and usability of the product.
4. Third-Party Processors
Rejesho uses a small number of third-party processors to operate the Service. Africa's Talking delivers SMS notifications on Rejesho's behalf under the sender ID REJESHO. Google provides OAuth sign-in, used only to verify a user's identity, not to share other Google account data. Rejesho also uses hosting and database infrastructure providers to run the Service. Each processor is bound to use data only as instructed, and only for the purpose of providing its service to Rejesho.
5. Data Retention
Tenant and Member data is retained for as long as the Tenant's account remains active, and for a reasonable period afterward for legal, tax and audit purposes. Audit-trail records, showing who changed what and when, are kept as part of the integrity of the Service's financial ledger and are not deleted on request, since they document transactions that have already occurred.
6. Data Security
Rejesho protects data with encryption in transit, access controls based on an Authorized User's role, and strict tenant data isolation, so that no institution can access another institution's data. Passwords are stored using industry-standard hashing and are never stored or transmitted in plain text.
7. Data Subject Rights under Tanzanian Law
Rejesho respects the rights given to data subjects under the Personal Data Protection Act, 2022 of Tanzania, including the right to request access, correction or deletion of personal data. Because most data subjects processed through the Service are Members who do not hold a direct account with Rejesho, requests about Member data should be made to the Member's institution, which controls that data and is best placed to action the request. Rejesho supports its Tenant institutions in responding to such requests.
8. Cookies
Rejesho uses a small number of cookies necessary for the Service to work. A cookie named rejesho_locale, set to expire after one year, remembers a visitor's language preference. A cookie named rejesho_install_dismissed, set to expire after one year, remembers that a visitor closed the offer to install the app. A session cookie keeps a signed-in user logged in.
The public website at rejesho.com sets no analytics cookie and stores nothing on a visitor's device for measurement. Inside the signed-in application, Rejesho uses PostHog to understand how the software is used, which sets a first-party cookie named ph_rejesho. It records the pages and actions of staff using the Service, never the personal details of members whose records the Service holds. Rejesho does not use advertising cookies and does not sell or share personal data with advertisers.
9. Children's Data
The Service is a business tool intended for use by financial institutions and their staff, and is not directed at children. Rejesho does not knowingly collect personal data from children.
10. International Data Transfers
Where data is transferred outside Tanzania in the course of operating the Service, Rejesho applies appropriate safeguards to protect it in transit and at rest. Details of the hosting location and safeguards in place for a specific Tenant are available on request by contacting founder@kaypeetech.com.
11. Changes to This Policy
Rejesho may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the date of the most recent revision. Where a change is material, Rejesho will communicate it to tenant admins in advance of it taking effect.
12. Contact
Questions about this Privacy Policy, or requests relating to privacy and data protection, can be sent to founder@kaypeetech.com.