Legal & Privacy

1. Introduction

MojaWave Technologies Ltd ("we," "us," or "our") is committed to protecting the personal data of our customers, their end-users, and visitors to our platform. This Privacy Policy explains how we collect, use, store, and protect personal data in compliance with the Tanzania Personal Data Protection Act (TDPA) 2022 and other applicable laws.

MojaWave acts as a data controller in respect of personal data we collect directly from you (account data, billing data). We act as a data processor in respect of personal data you submit through our APIs (your end-users' phone numbers, email addresses, and payment details).

2. Data We Collect

Account Data: Name, email address, company name, phone number, and billing information collected during registration and account management.

API Transaction Data: Phone numbers, email addresses, message content, payment amounts, and Mobile Money identifiers submitted through our APIs as part of your use of the services. This data belongs to your end-users; you are responsible for having appropriate consent to process it.

Usage Data: API request logs, IP addresses, timestamps, error codes, and delivery status data generated through use of our services.

Technical Data: Browser type, operating system, and session data collected via cookies when you access the MojaWave dashboard.

3. How We Use Your Data

• To provision, operate, and maintain the MojaWave platform and APIs
• To process payments and maintain billing records as required by Tanzanian tax law
• To send service notifications, security alerts, and transactional emails
• To detect, investigate, and prevent fraudulent or abusive use of our services
• To comply with legal obligations, regulatory requirements, and lawful requests from Tanzanian authorities
• To improve our services through aggregated, anonymised analytics

We do not sell personal data to third parties. We do not use personal data submitted through your APIs for our own marketing purposes.

4. Data Sharing

We share personal data only with service providers who assist us in delivering the services (listed in our Data Processing Agreement as sub-processors), regulatory authorities when required by law, and successors in the event of a business transfer or acquisition.

All sub-processors are contractually bound to process data only on our instructions and to maintain appropriate security standards.

5. Data Retention

Account data is retained for the duration of your account and for 7 years thereafter as required by Tanzanian tax and financial records legislation. API transaction data (message logs, payment records) is retained for 90 days by default; customers on paid plans may configure longer retention periods up to 2 years. Usage logs are retained for 30 days for security monitoring purposes.

You may request deletion of your account data at any time, subject to retention requirements imposed by applicable law.

6. Your Rights Under the TDPA

Under the Tanzania Personal Data Protection Act 2022, you have the right to:

• Access your personal data held by MojaWave
• Correct inaccurate or incomplete personal data
• Delete your personal data, subject to legal retention obligations
• Object to processing of your personal data in certain circumstances
• Data portability — receive your data in a structured, machine-readable format

To exercise any of these rights, contact our Data Protection Officer at [email protected]. We will respond within 30 days.

7. Security

We implement industry-standard technical and organisational measures to protect personal data, including AES-256 encryption at rest, TLS 1.2+ in transit, role-based access controls, regular security audits, and incident response procedures. API keys are stored as one-way hashed values and are never logged in plaintext.

8. Contact Our DPO

Our Data Protection Officer can be reached at [email protected] or by post at MojaWave Technologies Ltd, Dar es Salaam, Tanzania. You also have the right to lodge a complaint with the Personal Data Protection Commission of Tanzania.

1. Purpose

This Acceptable Use Policy ("AUP") defines the rules governing how MojaWave's communication and payment APIs may be used. The AUP is designed to protect the integrity of our network, the security of our customers and their end-users, and compliance with Tanzanian law and international carrier guidelines.

2. Prohibited Uses — All Services

You may not use any MojaWave service to:

• Violate any applicable Tanzanian or international law or regulation
• Impersonate any person or organisation or misrepresent your identity
• Transmit content that is unlawful, harmful, threatening, abusive, harassing, defamatory, or obscene
• Facilitate money laundering, terrorist financing, or any other financial crime
• Engage in any activity that interferes with or disrupts MojaWave's infrastructure or third-party networks
• Attempt to gain unauthorised access to MojaWave systems, customer accounts, or carrier infrastructure
• Resell or sublicense access to MojaWave APIs without prior written authorisation

3. SMS-Specific Rules

All SMS sending must comply with TCRA regulations and the guidelines of the relevant mobile network operators. Specifically:

• You must have verifiable consent from all recipients before sending marketing or promotional SMS messages
• You must honour opt-out requests immediately and maintain suppression lists
• Sender IDs must accurately represent your business name as registered with the TCRA
• You may not send SMS messages that contain phishing links, malware, or misleading content
• Bulk commercial sends require prior approval of your campaign and Sender ID by MojaWave's compliance team

4. Email-Specific Rules

• You may only send emails from domains you own and have verified through MojaWave's domain verification process
• All commercial email must include a valid physical address and a working unsubscribe mechanism
• You may not send unsolicited bulk email (spam) under any circumstances
• Email content must not contain deceptive subject lines or misleading header information

5. Payments-Specific Rules

• The Payments API may only be used for lawful commercial transactions
• You must comply with all applicable Bank of Tanzania regulations and anti-money laundering (AML) requirements
• You must not use the Payments API to process transactions for prohibited industries as defined in our onboarding documentation
• You are responsible for implementing appropriate fraud detection and KYC procedures for your end-users

6. Enforcement

MojaWave reserves the right to investigate any suspected violation of this AUP. Where a violation is confirmed or suspected, we may take any of the following actions: issue a warning, temporarily suspend the affected API key, permanently terminate the account, report the activity to appropriate authorities including the TCRA, Bank of Tanzania, or law enforcement.

Account termination for AUP violations results in forfeiture of any unused credits and does not entitle the customer to a refund.

1. Scope and Application

This Data Processing Agreement ("DPA") applies to all personal data that you (the "Controller") submit through MojaWave's APIs in the course of using our services. MojaWave acts as a "Processor" under the Tanzania Personal Data Protection Act (TDPA) 2022 in respect of this data.

This DPA supplements the Terms of Service and, in the event of any conflict regarding data processing obligations, this DPA shall prevail.

2. Processor Obligations

MojaWave as Processor agrees to:

• Process personal data only on documented instructions from you, unless required by applicable law
• Ensure that persons authorised to process the personal data have committed to confidentiality
• Implement appropriate technical and organisational security measures
• Assist you in responding to data subject rights requests under the TDPA
• Delete or return all personal data upon termination of the services, at your election
• Make available all information necessary to demonstrate compliance with the TDPA and allow for audits

3. Sub-processors

You provide general authorisation for MojaWave to engage sub-processors. Current sub-processors engaged by MojaWave in the delivery of services include cloud infrastructure providers, SMS aggregators, mobile money network operators, and email delivery infrastructure partners. A current list of sub-processors is available upon request at [email protected].

MojaWave will provide 30 days' notice of any intended changes to sub-processors, giving customers the opportunity to object on reasonable grounds related to data protection.

4. Security Measures

MojaWave implements the following technical and organisational measures:

• Encryption: AES-256 at rest; TLS 1.2 or higher in transit for all data
• Access Control: Role-based access control (RBAC); multi-factor authentication required for all staff with production access
• Logging: All data access events are logged with tamper-evident audit trails
• Vulnerability Management: Regular penetration testing and automated dependency scanning
• Physical Security: Data hosted in ISO 27001-certified data centres within or directly connected to the East African region

5. Breach Notification

In the event of a personal data breach affecting data processed on your behalf, MojaWave will notify you without undue delay and in any event within 72 hours of becoming aware of the breach. The notification will include the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to address the breach.

6. International Data Transfers

MojaWave processes and stores data primarily within Tanzania and the East African region. Where data is transferred outside Tanzania (for example, to a sub-processor's infrastructure), MojaWave ensures that appropriate safeguards are in place as required by the TDPA, including standard contractual clauses or adequacy decisions recognised by the Personal Data Protection Commission of Tanzania.