SwarmPay

Privacy Policy

Effective: 19 August 2026  ·  Last updated: 19 August 2026

SwarmPay lets you hold, send and request money, and buy and sell, inside a WhatsApp conversation or in the SwarmPay app. Doing that means handling information about you. This policy explains exactly what we collect, why we collect it, who we share it with, and the control you have over it.

1. Who we are

SwarmPay is a WhatsApp-first payments and commerce service operating in Zimbabwe. The controller responsible for your personal information is:

Entity	SwarmPayTech (Private) Limited, trading as SwarmPay
Entity number	62300A02102025
Structure	Private Limited (Pvt Ltd), registered 7 October 2025 in Zimbabwe
Head office	Harare, Zimbabwe
Website	www.swarmpay.org
Privacy contact	privacy@swarmpay.app
General enquiries	info@swarmpay.org

In this policy, "we", "us" and "SwarmPay" mean that entity. "You" means anyone who uses SwarmPay — as a customer holding a wallet, as a merchant selling through SwarmPay, or as someone who is sent money or an invoice by a SwarmPay user.

2. Information we collect

Account and profile

• Your mobile number in international format. This is your account identifier and how we reach you on WhatsApp.
• Your first and last name, and the display name you choose.
• Your email address, if you give us one.
• Your country, city and address, where you provide them.
• An optional profile photo and short bio.
• For business accounts: your organisation name and type.
• Security credentials — your password and transaction PIN are stored only as one-way hashes, never in a form we or anyone else can read back.

Identity and business verification (KYC)

Financial regulation requires us to know who our customers are before certain limits are lifted. When you verify your identity we collect:

• Your document type and number — national ID, passport or driver's licence.
• Images of that document, front and back.
• A selfie used to check that the document belongs to you.
• For businesses: registration certificate, tax clearance and proof of address.

Financial and transaction information

• Your wallet balances in each currency you hold.
• Every transaction — amount, currency, date, time, counterparty, reference, fee and status.
• Deposits and withdrawals, including the mobile-money or bank rail used and the provider's reference.
• Payment requests and invoices you send or receive.
• Saved payment methods — the mobile-money number or account you have chosen to reuse. We do not store full card numbers.
• SafePay escrow records: what was bought, the amount held, delivery confirmations, and any dispute messages and evidence you upload.

Commerce information (if you sell through SwarmPay)

• Your shop details, locations and branches.
• Your products, prices, images and videos.
• Orders placed with you, their items, status history and your notes.
• Customer records — the name and mobile number of people who order from you, which we hold on your behalf.

WhatsApp conversation information

• Your WhatsApp ID and phone number, and your WhatsApp profile name as WhatsApp supplies it.
• The content of messages you exchange with SwarmPay — what you type, the buttons you tap, and the data you enter in a SwarmPay Flow form.
• Session state — where you are in a conversation, so we can continue it, and the security state of a pending payment.

Device and technical information

• Device push token, if you allow notifications, so we can alert you to money arriving.
• App version, device type and operating system.
• IP address, request logs and error diagnostics, kept for security, fraud detection and debugging.

Permissions the app may ask for

Permission	What we do with it
Contacts	Your phone book is read on your device so you can pick someone to pay. Only the number you actually select is sent to us. We never upload your address book.
Camera and microphone	Taking photos and videos of products you list, and capturing verification documents.
Photo library	Choosing existing images for products, verification or your profile, and saving product images back.
Notifications	Alerting you to payments, orders and account activity.
NFC	Writing and reading a SwarmPay tap card. No personal data is written to the card.

Every one of these is optional. You can decline or later withdraw any of them in your device settings; SwarmPay keeps working, minus the feature that needed it.

3. Where the information comes from

• You — when you register, verify your identity, set up a shop, or send a message.
• Your use of the service — transactions, orders and conversations generate records as they happen.
• Payment providers — mobile-money and banking partners confirm whether a payment succeeded and return their own references.
• Meta / WhatsApp — your WhatsApp ID and profile name arrive with the messages you send us.
• Other users — someone can send you money, an invoice or an order before you have an account. We hold a minimal record against your number so the funds are waiting for you when you claim it.

4. How and why we use it

Purpose	Why we are allowed to
Opening and running your wallet, moving money, settling orders, running SafePay escrow	Performing our contract with you
Verifying your identity, screening for money laundering and terrorist financing, keeping transaction records	Complying with a legal and regulatory obligation
Detecting and preventing fraud, unauthorised access and abuse; enforcing limits	Our legitimate interest in a safe payments service, and legal obligation
Sending you transaction notices, receipts and security alerts on WhatsApp, in the app and by push	Performing our contract with you
Answering support requests and resolving disputes	Performing our contract, and our legitimate interest in good service
Fixing faults, monitoring reliability and improving the service	Our legitimate interest in a working product
Screening you and your counterparties against sanctions and watch lists	Complying with a legal obligation
Automated checks that score a transaction for fraud risk, hold it, or apply a limit	Our legitimate interest in a safe payments service, and legal obligation
Identity documents and selfie	Your explicit consent, plus our legal due-diligence obligation
Optional device permissions — contacts, camera, photos, notifications	Your consent, withdrawable at any time

5. WhatsApp and Meta

SwarmPay reaches you on WhatsApp through the WhatsApp Business Platform, operated by Meta. This means:

• Messages between you and SwarmPay pass through Meta's infrastructure to be delivered. Meta processes them under its own WhatsApp Privacy Policy, which applies alongside this one.
• We use your WhatsApp number solely to deliver the service you asked for — balances, receipts, payment confirmations, order updates and support.
• We do not use WhatsApp data for advertising, do not build advertising profiles from it, and do not transfer it to any third party for their own marketing.
• If you are a merchant who connects your own WhatsApp Business Account to SwarmPay, we receive and store the identifiers needed to send and receive messages for your shop. You remain responsible for how you message your own customers.
• You can stop WhatsApp messages at any time by replying STOP, or by blocking the SwarmPay number in WhatsApp. Security and legally-required notices may still reach you by other means.

We handle data received through Meta's platform in line with Meta's Platform Terms and Developer Policies. Specifically:

• We use it only to provide and improve SwarmPay — the purpose you gave it to us for — and for no unrelated purpose.
• We do not sell it, licence it, or transfer it to a data broker, an information-resale service, or anyone building advertising profiles.
• We keep it only as long as we need it, and we delete it when you ask us to, on the path set out under Deleting your data. Where Meta instructs us to delete data, we do that too.
• We protect it with the safeguards described in How we protect it, and we require the same of anyone processing it for us.

6. Who we share it with

Who	What they receive, and why
Payment and mobile-money providers (including EcoCash, InnBucks and our banking aggregator)	The number, amount and reference needed to complete a deposit, payment or cash-out you asked for.
Meta Platforms	Message content and your WhatsApp number, to deliver messages to you on WhatsApp.
Cloud infrastructure providers (Amazon Web Services, Supabase)	They host and store the service. They process data on our instructions only.
Google Firebase	Delivering push notifications to your device.
Merchants you buy from	Your name, mobile number, order contents and delivery details — what a seller needs to fulfil your order.
Counterparties	When you send or request money, the other person sees your name and the transaction details.
Regulators, law enforcement and courts	Where we are legally required to disclose, or must do so to establish or defend a legal claim.
Professional advisers, auditors, or a buyer of the business	Under confidentiality, where necessary. Any successor is bound by this policy.

7. Where your data is stored

SwarmPay runs on Amazon Web Services in the us-east-1 region and on a Supabase-hosted PostgreSQL database. Your information is therefore stored and processed outside Zimbabwe, in the United States. Our providers are bound by contract to protect it to the standard described here, and we rely on their contractual safeguards for those transfers.

8. How long we keep it

Information	Kept for
Transaction and wallet records	The period required by Zimbabwean financial and anti-money-laundering law, counted from the transaction date. These cannot be deleted on request while that period runs.
Identity verification documents and selfies	The same statutory period after your account closes, then deleted. Customer due-diligence records carry the same period as the transactions they support.
Account and profile data	While your account is open, and until any retention obligation on related records expires.
WhatsApp conversation and session state	Short-lived. Session state expires within days; message records are kept only as long as needed for support, dispute resolution and fraud investigation.
Technical logs and diagnostics	Typically a matter of weeks, longer where a security investigation requires it.

When a retention period ends, we delete the information or irreversibly anonymise it so it can no longer be linked to you.

9. Your rights and choices

You can ask us to:

• Access the personal information we hold about you, and get a copy of it.
• Correct anything inaccurate or incomplete — much of this you can do yourself in the app under Settings.
• Delete your account and data. See Deleting your data.
• Restrict or object to particular uses of your information.
• Withdraw consent for anything you consented to, such as device permissions or optional messages.
• Complain to us, and to the relevant data protection authority in Zimbabwe, if you think we have handled your data wrongly.
• Ask a person to review an automated decision that has affected you. See Automated decisions.

Write to privacy@swarmpay.app. We answer within 30 days. We will ask you to confirm your identity first — usually by verifying control of your registered mobile number — because these requests concern financial records.

Some rights have limits. We cannot delete transaction records we are legally required to keep, and we cannot act on a request we cannot verify.

10. Deleting your data

You can delete your SwarmPay account and the personal data attached to it yourself, from Settings in the app. Closing the account starts a 30-day countdown that you can cancel at any point by signing back in; after 30 days the deletion runs automatically and permanently. Full instructions, what gets deleted and what we are obliged to keep are on a dedicated page:

11. Automated decisions

Some checks run without a person looking at them, because they have to happen in the moment a payment does:

• Fraud and risk scoring — a transaction can be held, delayed or declined automatically where it matches a risk pattern.
• Limits — how much you can hold, send or cash out is applied automatically from your verification level and the regulatory limits that apply to mobile wallets.
• Sanctions and watch-list screening — a match flags the transaction for review.

None of these permanently close an account on their own. If an automated decision has blocked something and you think it is wrong, you can ask a person to review it — write to privacy@swarmpay.app or raise it through Support, and a human will look at the decision and tell you the outcome.

12. Your choices

• Service messages — receipts, payment confirmations, security notices. These come with the account and cannot be switched off while it is open, because they are how you find out what happened to your money.
• Everything else — product news, tips and offers. Reply STOP on WhatsApp, or turn them off under Settings → Notifications. Turning these off never affects your service messages.
• Device permissions — contacts, camera, photos, notifications. Grant or withdraw any of them in your device settings at any time.
• Push notifications — turn off in your device settings; you will still see everything in the app and on WhatsApp.

13. How we protect it

• All traffic between your device, WhatsApp and our servers is encrypted in transit using TLS.
• Passwords and PINs are stored as one-way hashes. Nobody at SwarmPay can read them.
• Your app session is held in your device's secure keystore, not in ordinary app storage.
• Database access is governed by row-level security, so a signed-in user can only ever read their own records.
• Internal services authenticate to each other with signed, timestamped requests, and money-moving operations require a second independent signature.
• Every request to move money out requires your password or PIN, with lockout after repeated failures.
• Access to production data by our staff is restricted and logged.

No system is perfectly secure. If a breach ever affects your personal information, we will notify you and the relevant authority without undue delay.

14. Children

SwarmPay is for people aged 18 and over. We do not knowingly collect information from children. If we learn that we hold data about a child, we delete it and close the account.

15. Changes to this policy

We update this policy when the service or the law changes. The "last updated" date at the top always reflects the current version. For material changes we will tell you in the app and on WhatsApp before they take effect. Continuing to use SwarmPay after that means you accept the revised policy.

16. Contact us

Questions, requests or complaints about privacy:

• Email privacy@swarmpay.app
• Post: SwarmPayTech (Private) Limited, Harare, Zimbabwe