Privacy Policy

1. Introduction

We collect information from vendors who create stalls, customers who make payments, and visitors to our public pages. We are committed to protecting personal data and handling it consistently with Ugandan data protection principles.

2. Information We Collect

From vendors

Business name, slug, tagline, description, contact email and phone, WhatsApp number, address, banner and logo images, bank or provider connection identifiers (encrypted), and subscription details.

From customers

Name, email, phone number, and payment-related information needed to complete a purchase and deliver an invoice or receipt. Customers may pay as guests without creating an account.

Payment data

We do not store card numbers, CVVs, or Mobile Money PINs. Payment details are handled by the connected payment provider (for example Pesapal, MTN, or Airtel) under that provider’s own terms. We store only transaction references, amounts, status, and payment method needed to verify and document payments.

Usage data

IP addresses, browser type, pages visited, and interaction data collected automatically to operate, secure, and improve the service.

3. How We Use Your Information

• To create and operate vendor stalls and process payments.
• To verify payments and generate invoices and receipts.
• To deliver documents by email and WhatsApp.
• To bill vendor platform subscriptions and manage accounts.
• To communicate about your account, service notices, and receipts.
• To prevent fraud, meet legal obligations, and improve the platform.

4. Sharing and Disclosure

• Payment providers: transaction data is shared with the provider connected to the vendor’s stall (for example Pesapal, MTN, or Airtel) to initiate and verify payments.
• Email delivery: we use Resend to send invoices, receipts, and service emails.
• Messaging: we use Twilio (or Meta WhatsApp Business Platform) to deliver receipts by WhatsApp.
• Vendors: customer payment information relevant to a specific stall is shared with that stall’s vendor so they can fulfil orders and reconcile payments.
• Legal requirements: we may disclose information when required by law, regulation, or legal process, or to protect safety and rights.

We do not sell your personal data to third parties.

5. Data Security and Retention

Credentials and connection secrets are stored encrypted and never read from environment variables at runtime. Access is restricted to authorised personnel. We retain transaction records as needed to deliver documents, reconcile payments, and meet legal obligations, and we delete personal data when it is no longer necessary unless retention is required by law.

6. Cookies and Tracking

We use cookies and similar technologies for authentication, session security, and analytics. You can manage cookie preferences through your browser settings; some site functions may not work without them.

7. Your Rights

You may request access to, correction of, or deletion of your personal data, and you may object to or restrict certain processing. To exercise these rights, contact us at the address below. We will respond within a reasonable time and in line with applicable law.

8. Children’s Privacy

Mudaala is not directed to children under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us so we can delete it.

9. International Transfers

Your information may be processed by service providers located outside Uganda (for example email and messaging providers). We apply contractual and technical safeguards to protect it wherever it is processed.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the platform or by email. Continued use after changes take effect constitutes acceptance.

11. Contact Information

Mudaala is a product of Parah Exploits Limited (www.parahexploits.com). Privacy questions and requests may be sent to privacy@mudaala.com or support@mudaala.com.