AFRIPEIEffective 23 October 2026
Privacy policy
This policy describes how AFRIPEI collects, uses, and stores personal data when you use afripei.co.tz, the merchant portal, the owner portal, the merchant app, the checkout page, and the AFRIPEI API.
A shorter notice for someone paying a business is on the customer privacy page. Cookies are described on the cookie notice. The rules for using the service are on the legal page.
Who this covers
- A person who creates or is invited to a merchant account, including the owner of that business and anyone they add to the team.
- A customer whose phone number is used to collect or receive Tanzanian shillings.
- A person who signs in to the owner portal to review merchants.
- A person who writes to us from the contact page or from support in the merchant portal.
Who we are
AFRIPEI is payment infrastructure for Tanzania. Merchants integrate once. Collections and payouts move Tanzanian shillings through mobile money. The public site is https://afripei.co.tz. The API is https://api.afripei.co.tz. The merchant portal is https://merchant.afripei.co.tz.
For privacy questions, use the contact page or open a request from the merchant portal. Do not send passwords, API secrets, webhook signing secrets, or one-time codes.
The data we process
What we hold depends on how you use AFRIPEI.
- Account. Email, hashed password, display name, phone number, role, and merchant membership. Sign-in and registration may send a one-time code by SMS. A new merchant stays in review until verification is accepted, and cannot move money until then.
- Team. An invited person is stored by email and role. The invite is not emailed. The person who sends the invite receives a token to pass on.
- Verification. A merchant may submit a phone photograph, a NIDA number, and a driving licence photograph or a voting ID photograph. Owner staff review those files. Approving them opens an account that was waiting for verification. Rejecting them sends the reason back to the merchant.
- Payments and payouts. Amount in TZS, currency, customer or recipient phone in E.164, name when one is sent, merchant reference, status, the fee snapshot stored with that transaction, and the related ledger entries. A checkout page collects the phone number the customer types.
- Messages. SMS for a registration code, a sign-in code, a payment result, or a payout result. The text includes the amount, the shop name, and a reference. It does not include a password or an API key.
- API and webhooks. Application names, hashed API keys, webhook URLs, and signed event deliveries. The secret of a key is shown once at creation.
- Sessions. An HTTP-only session cookie, a CSRF token, IP address, and user agent. Sessions expire. Idle time is shorter on the owner portal than on the merchant portal. Sign-in success, failure, and lockout are written to the audit log. There is no email that announces a login.
- Audit. Insert-only records of money and access actions, with a hash chain on the platform audit log.
- Support. Messages you open from the merchant portal, attached to a transaction id when you provide one.
We do not ask for card numbers. We do not use advertising cookies. We do not sell personal data. We do not build a marketing profile from payment phones.
Why we process it
- To create and operate merchant and owner accounts, including SMS one-time codes.
- To collect and send real TZS on the mobile-money wallets customers already use: M-Pesa, Airtel Money, Mixx by Yas, and Halopesa.
- To keep a ledger, apply the fee snapshot, enforce limits, and show balances and reports.
- To verify a merchant before activation, and for owner review of those submissions.
- To sign webhooks, authenticate API keys, and investigate disputes or abuse.
- To tell the customer and the merchant, by SMS and in the portal, whether a payment or payout completed.
- To meet record-keeping duties that apply to payment services in Tanzania.
Processing of personal data on this platform is intended to comply with the Personal Data Protection Act, 2022 of Tanzania, including the bases of contract, legal obligation, and legitimate interests in operating a payment service.
Who receives data
Mobile-money collections and payouts are sent to licensed payment partners behind AFRIPEI. They receive the phone number, amount, currency, and a payment reference so they can prompt the handset and settle the transfer. AFRIPEI does not name those partners on merchant or customer screens.
The merchant who created the payment can see that payment in the portal, including the phone number, the amount, the status, and the fee snapshot. A payout is visible to that same merchant.
SMS messages are sent through an SMS gateway using sender ID AFRIPEI. The destination number and message body are required for delivery. Registration codes, sign-in codes, and payment and payout notices go out this way when SMS is connected.
If you register a webhook, we POST signed events to the URL you configure. You are responsible for that endpoint and for the personal data inside the event.
Hosting: the websites run on Vercel. The API, worker, and databases run on DigitalOcean. Personal data may therefore be stored or processed outside Tanzania. We still treat Tanzanian numbers, verification files, and transaction records as payment data, not marketing lists.
We share data with authorities when the law requires it.
Cookies
Signed-in portals set afripei_session (HTTP-only) and afripei_csrf (readable by the page so forms can send X-CSRF-Token). Those cookies are required to keep you signed in and to stop cross-site form posts. The public marketing pages do not need them. The detail is on the cookie notice.
How long we keep it
A merchant session cookie lasts up to 12 hours and ends sooner after idle time. Owner portal idle time is shorter. One-time codes expire in minutes. Financial records, verification files, and audit rows are kept for as long as the ledger, merchant review, dispute handling, and applicable law require. We do not rewrite fee snapshots or delete ledger history to tidy a dashboard.
You may ask us to close an account. Closing it does not erase completed payments. Those rows stay in the ledger.
Your choices
You can update merchant profile fields in the portal, rotate API keys, disable a webhook, and sign out. You may ask for a copy of the personal data we hold on your user, or ask us to correct it, by using the contact page or the merchant portal. We may refuse deletion of transaction, verification, or audit records where we must keep them.
A customer who wants a payment looked at should start with the business they paid. That business can see the payment. AFRIPEI can be reached through the contact page.
If Tanzanian law gives you a right to complain to the Personal Data Protection Commission, that right is not limited by this policy.
Children
AFRIPEI is a business payment service. It is not offered to children.
Security
Passwords are stored with Argon2id. API keys are stored hashed. Webhooks are HMAC-signed. MFA is available on portal accounts. Owner and merchant portals are separate permission domains. Live keys move real TZS. No method is perfect. Keep your live keys and phone in your control.
Changes
If this policy changes in a material way, the effective date at the top of this page changes with it. The customer notice and the cookie notice are part of the same set and use the same date when they change.