Privacy Policy

1. Who we are

YoPay is a WhatsApp-native commerce platform operated by Ajili Africa Ltd, a company registered in Kigali, Rwanda. YoPay gives businesses a dedicated WhatsApp line powered by a personal Agent that handles customer conversations, orders, and payments.

Data controller contact: info@yopay.africa

2. Legal framework

This policy is issued in compliance with Law No. 058/2021 of 13/10/2021 on the Protection of Personal Data and Privacy in Rwanda, and with the data requirements of Meta Platforms, Inc. for use of the WhatsApp Business Platform.

3. Information we collect

• WhatsApp messages. When you interact with a merchant's YoPay Agent via WhatsApp, we receive and store your WhatsApp phone number, display name (if shared by Meta), and the content of your messages.
• Orders and payments. When you place an order or make a payment (e.g., via MTN MoMo), we record transaction amounts, references, and timestamps.
• Merchant data. Merchants who sign up provide business name, address, contact details, and product catalogue information.
• Chat leads. If you engage with the YoPay contact chat on our website and voluntarily share your name and phone number, we store that information so our team can follow up with you.
• Usage data. We collect anonymised analytics (page views, performance metrics) through privacy-respecting tools. No third-party advertising trackers are used.

4. How we use your information

• To operate YoPay Agent conversations on behalf of merchants.
• To process and confirm orders and payments.
• To improve service quality through review of anonymised conversation logs.
• To send transactional notifications (order confirmations, delivery updates).
• To follow up with prospective merchants who have expressed interest in YoPay.
• To comply with legal obligations in Rwanda and applicable jurisdictions.

5. Legal basis for processing

We process personal data on the following bases:

• Contract performance. Processing is necessary to deliver the service you have requested through a merchant (orders, payments, delivery).
• Consent. Where you voluntarily provide contact details (e.g., via our website chat), processing is based on your consent. You may withdraw consent at any time by emailing us.
• Legitimate interest. We process data to operate, secure, and improve our platform, where these interests are not overridden by your rights.
• Legal obligation. We retain certain records as required by Rwandan tax and commercial law.

6. Data sharing

We do not sell your personal data. We share data only with:

• Merchants. The business whose YoPay Agent you contacted receives your messages and order details to fulfil your request.
• Sub-processors. Cloud infrastructure (DigitalOcean, Frankfurt, Germany), AI inference (Anthropic, United States), payment processing (MTN MoMo and Flutterwave), and messaging infrastructure (Meta WhatsApp Cloud API). Each sub-processor handles data only as required to provide the relevant service and is bound by data processing agreements.
• Law enforcement. Where required by Rwandan law or a valid court or regulatory order.

7. International data transfers and storage

In accordance with Articles 48 to 52 of Rwanda Law No. 058/2021, YoPay has sought the necessary authorisations from the Data Protection and Privacy Office (DPO) to store and transfer personal data outside Rwanda.

Our servers are located in Frankfurt, Germany (European Union). Conversation data is processed for AI inference by Anthropic (United States). Payment processing involves MTN MoMo (Rwanda) and Flutterwave (Nigeria/United States). Each international sub-processor is bound by a Data Processing Agreement and is required to maintain security standards consistent with this policy. Standard contractual clauses are used where applicable to safeguard your data in transit.

By using the service, you acknowledge that your data may be stored and processed outside Rwanda under these safeguards.

8. Data retention

Conversation and order data is retained for up to 3 years to support merchant operations and dispute resolution, then securely deleted. Financial transaction records may be retained longer where required by Rwandan tax law. You may request earlier deletion (see Section 10).

9. Security

All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Access is restricted by role-based permissions and multi-factor authentication. We conduct periodic security reviews. In the event of a data breach that poses a risk to your rights, we will notify the relevant authorities and affected individuals as required by Rwandan law.

10. Your rights

Under Rwandan Law No. 058/2021, you have the following rights regarding the personal data we hold about you:

• Access. Request a copy of your data.
• Rectification. Ask us to correct inaccurate data.
• Erasure. Request deletion of your data (subject to legal retention requirements).
• Restriction. Ask us to limit how we process your data.
• Portability. Receive your data in a structured, machine-readable format.
• Objection. Object to processing based on legitimate interest.
• Withdraw consent. Where processing is based on consent, you may withdraw it at any time.

To exercise these rights, email info@yopay.africa or use our data deletion request form. We will respond within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection and Privacy Office (DPO), the national supervisory authority for data protection in Rwanda.

11. WhatsApp and Meta

YoPay operates as a Business Solution Provider on Meta's WhatsApp Business Platform. We deliver outbound and inbound WhatsApp messages on behalf of merchants using the WhatsApp Business Cloud API (provided by Meta Platforms, Inc.). Merchants grant YoPay access to their WhatsApp Business Account via Meta's Embedded Signup flow.

WhatsApp data we receive and store includes: your WhatsApp phone number, your WhatsApp profile display name (when Meta makes it available to the merchant), the content of your messages, attachments you send (images, audio, location), and the timestamps and delivery status of each message. We do not use this data to train AI models for third parties; AI inference uses the message content transiently to compose a single reply on behalf of the merchant and is discarded by the AI provider after the reply is generated.

Your use of WhatsApp is also subject to Meta's Privacy Policy and the WhatsApp Business Solution Terms. YoPay is an independent data controller for data we process on our own platform and a sub-processor on behalf of merchants for data they receive via WhatsApp. We are not affiliated with or endorsed by Meta Platforms, Inc.

12. Cookies

Our public website uses only essential session cookies required for authentication. We do not use tracking or advertising cookies.

13. Children

Our service is not directed to children under 16. We do not knowingly collect data from minors. If you believe we have inadvertently collected such data, contact us immediately and we will delete it without delay.

14. Changes to this policy

We may update this policy. Material changes will be announced on this page with an updated date and, where appropriate, by direct notification to active merchants. Continued use of the service after changes constitutes acceptance of the updated policy.

15. Contact

Questions about this policy or your personal data? Email us at info@yopay.africa. We aim to respond within 5 business days.