smallwondr Privacy Policy

1. Scope

This Policy covers data processed through the smallwondr website and application, wherever you're located, to the extent your data relates to an individual in Rwanda or is processed by smallwondr from Rwanda, in accordance with Law N° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy.

2. Who This Policy Covers

3. Information We Collect

1. Account information. Phone number, name, optional email, preferred language, for anyone who creates a Sender, Merchant, or Partner account.
2. Merchant business information. Business name, category, description, pricing information, business hours, settlement mobile money number, business registration number/TIN if provided, and any identity mark or logo you upload.
3. Staff information. A staff member's name and a PIN, which we store as a cryptographic hash, never as plain text.
4. Transaction information. Gift Card amount, recipient name and delivery contact as entered by the Sender, the phone number that actually paid, and payment/payout references from our payment processor.
5. Gift message content. A personal message a Sender writes to a Recipient. This is delivered to the Recipient and is not shared with the Merchant.
6. Admin and support information. For our own team accounts: email, and records of actions taken, kept in an append-only audit log.
7. Technical information. Session identifiers needed to keep you signed in, and standard server logs.

4. How We Use Your Information

• To create and operate your account, and to deliver, redeem, and reconcile Gift Cards;
• To process payments and payouts through our payment processor;
• To send you the notifications tied to your own transactions (OTP codes, gift-received messages, payout confirmations, dispute updates) by SMS, WhatsApp, or email;
• To investigate fraud, abuse, or disputes, and to enforce our Terms;
• To calculate and pay referral commission to Partners;
• To provide opt-in Merchant Insights (redemption trends, repeat-customer rate) to Merchants who choose to see them;
• To comply with a legal or regulatory obligation.

5. Legal Bases for Processing

We process most of your information because it's necessary to provide the Service you've asked for (performing our contract with you). Where we send anything beyond transactional notifications, we do so only with your opt-in consent. Fraud prevention and platform security are processed on the basis of our legitimate interest in keeping the Service safe, balanced against your rights.

6. Who We Share Information With

We don't sell personal data. We share it only with the service providers that make the Platform work, each only for the purpose stated:

We may also disclose information where required by law, to enforce our Terms, or to protect the rights, safety, or property of smallwondr, our users, or the public.

7. International Data Transfers

Some of the providers listed in Clause 6 process data outside Rwanda. Where that happens, we rely on your consent to our use of these providers, together with contractual safeguards in place with each of them, to keep your data protected consistent with Rwanda's data protection law.

8. Data Retention

We keep account and transaction data for as long as your account is active, and for 10 years afterward, matching the minimum period Rwandan tax law requires businesses to retain accounting and transaction records. A gift message is retained only as long as needed to deliver it and support a related dispute, then deleted on the same schedule as the transaction it belongs to.

9. Your Rights

Subject to Rwandan law, you may request access to, correction of, or deletion of your personal data, and may object to certain processing. You can delete your account directly from your account settings, or by contacting us at +250 799 530 691. Deleting your account does not delete records we're legally required to keep (e.g., completed transaction records for accounting purposes).

10. Security Measures

• Session credentials are stored in secure, httpOnly cookies, not accessible to page scripts;
• Staff PINs and admin passwords are stored as salted cryptographic hashes, never in plain text;
• Admin access to sensitive actions is role-gated and recorded in an append-only audit log;
• Admin accounts require two-factor authentication (TOTP) in addition to a password.

11. Recipients of Gift Cards

A Recipient's name and delivery contact (phone, email, or WhatsApp) are provided to us by the Sender, not by the Recipient directly. We use that contact information only to deliver the Gift Card and any directly related follow-up (e.g., a reminder to redeem it), and do not use it for marketing. A Recipient who wishes to have their contact information removed from our records after delivery can contact us at +250 799 530 691.

12. Children's Privacy

1. Account holders. Creating a Sender, Merchant, or Partner account means entering into a contract with us, which requires the legal capacity to do so. The Service is not directed to, and an account must not be created by, anyone under 18 years old. If we learn an account was created by someone under that age, we will close it and delete the associated personal data.
2. Recipients under 16. A Recipient does not create an account or agree to anything — their name and delivery contact are provided to us by the Sender. Where a Sender names a Recipient known to be under 16, Rwandan law (Law N° 058/2021, Article 9) requires the consent of that Recipient's parent or legal guardian before we may process their personal data. By naming a Recipient under 16, a Sender confirms they hold, or have obtained, that consent — we rely on the Sender for this, since we have no direct relationship with the Recipient to obtain it ourselves.

13. Cookies and Similar Technologies

We use only the cookies strictly necessary to keep you signed in and to remember your language preference. We do not currently use advertising or cross-site tracking cookies; if that changes, this Policy will be updated first.

14. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified through the Platform or the contact details on your account at least 30 days before they take effect.

15. Contact Us

Questions about this Policy, or a request relating to your data, can be sent to +250 799 530 691.