Privacy Policy

1. Introduction

GILDA ("we", "our", or "us") is committed to protecting the privacy and personal data of every person who uses our platform. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have over your data.

GILDA is a social network and content sharing platform that enables Creators to share and monetise their own content and enables Fans to subscribe to and view the content of Creators. This policy applies to all users of the GILDA website and web application, including registered Creators, Fans, and visitors.

By accessing or using GILDA, you acknowledge that you have read, understood, and agree to the practices described in this policy. This policy is governed by and construed in accordance with the laws of the United Republic of Tanzania, including the Personal Data Protection Act, 2022 (Act No. 11 of 2022) (the "PDPA") and the Electronic and Postal Communications Act (Cap. 306) ("EPOCA").

2. Data Controller

The data controller responsible for your personal data is:

We have appointed a Data Protection Officer (DPO) as required under the PDPA 2022. You may contact our DPO directly for any data protection concerns or to exercise your rights.

3. Data We Collect

We collect personal data in the following categories:

3.1 Account and Identity Data

• Full name and display name
• Username (unique handle)
• Email address
• Age confirmation (must be 18+)
• Location (city/region, Tanzania)
• Profile photograph / avatar
• Biography and profile information you choose to provide
• Account type (Fan or Creator)

3.2 Financial and Payment Data

• Mobile phone number used for mobile money payments (Mpesa, Airtel Money, Tigo Pesa)
• Transaction records, payment amounts, and currency (Tanzanian Shillings – TSh)
• Subscription and purchase history
• Creator earnings records and wallet balances

Note: We do not store full mobile money account credentials. Payment processing is handled by ZenoPay, our third-party payment processor. Please review ZenoPay's privacy policy for their data practices.

3.3 Content Data

• Photos, videos, and other media you upload to the platform
• Captions, descriptions, and titles associated with content
• Comments, likes, and interactions with other users' content
• Messages sent through our private messaging system

3.4 Usage and Technical Data

• IP address and approximate geographic location
• Browser type and version, device type and operating system
• Pages visited, features used, and time spent on the platform
• Session data and authentication tokens
• Error logs and performance data

3.5 Age Verification and Consent Data

• Timestamp and record of age verification consent
• Acknowledgment of Terms of Service and this Privacy Policy

4. How We Use Your Data

4.1 Service Provision

• Creating and managing your account
• Enabling Creators to upload, share, and monetise their content
• Enabling Fans to discover, subscribe to, and view Creator content
• Processing payments and subscriptions through ZenoPay
• Facilitating private messaging between users
• Displaying profiles and content to other users

4.2 Safety and Legal Compliance

• Verifying that all users are 18 years of age or older
• Detecting, investigating, and preventing fraud, abuse, and illegal activity
• Enforcing our Terms of Service and Content Policy
• Complying with legal obligations under Tanzanian law, including TCRA requirements
• Responding to lawful requests from Tanzanian law enforcement and regulatory authorities

4.3 Communications

• Sending account-related notifications (registration, payments, policy updates)
• Notifying you of activity on your content or profile
• Important security alerts and account updates

4.4 Platform Improvement

• Analysing usage patterns to improve features and performance
• Troubleshooting technical issues
• Conducting internal research and analytics (using anonymised data where possible)

We do not sell your personal data to third parties. We do not use your personal data for automated decision-making or profiling that produces legal effects.

5. Legal Basis for Processing (PDPA 2022)

Under the Tanzania Personal Data Protection Act 2022, we process your personal data on the following legal grounds:

• Consent: For age verification, marketing communications, and optional profile information. You may withdraw consent at any time by contacting us.
• Contractual Necessity: To perform our obligations under the Terms of Service, including enabling account creation, content hosting, and payment processing.
• Legal Obligation: To comply with applicable Tanzanian laws, including TCRA regulations, the Cybercrimes Act 2015, and lawful law enforcement requests.
• Legitimate Interests: To prevent fraud, secure our platform, and improve our services, where such interests do not override your fundamental rights.

6. Data Sharing and Third Parties

We share your personal data only in the following limited circumstances:

6.1 Service Providers

• Supabase (Database & Authentication): Our cloud database and authentication provider. Data is stored on Supabase infrastructure with encryption at rest and in transit.
• ZenoPay (Payment Processing): Processes mobile money transactions. ZenoPay receives your phone number, name, email, and transaction amount to process payments. ZenoPay is bound by its own privacy policy and Tanzanian financial regulations.

6.2 Legal and Regulatory Disclosure

We may disclose your personal data to Tanzanian government authorities, law enforcement agencies, the Tanzania Communications Regulatory Authority (TCRA), or courts when:

• Required by a valid court order, warrant, or legal obligation
• Necessary to prevent or detect a crime or protect national security
• Necessary to protect the safety of any person
• Required by the TCRA in the exercise of its statutory functions

6.3 Between Users

Your public profile information (username, display name, avatar, bio, content) is visible to other users on the platform. Private messages are only visible to sender and recipient.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity, subject to the same protections described here.

7. Cross-Border Data Transfers

Our platform infrastructure is hosted on Supabase cloud services, which may involve storage and processing of data outside Tanzania. Where personal data is transferred outside Tanzania, we ensure adequate safeguards are in place in accordance with Section 45 of the PDPA 2022, including:

• Transfers to countries with adequate data protection laws as recognised by the Tanzanian Personal Data Protection Commission
• Contractual clauses binding the receiving party to PDPA-equivalent standards
• Your explicit consent where required

8. Data Retention

• Account data: Retained for the duration of your account, plus 5 years after account closure to comply with Tanzanian record-keeping requirements
• Payment records: Retained for 7 years as required by the Income Tax Act and Tanzania Revenue Authority (TRA) regulations
• Content: Retained until deleted by you or removed by us for policy violations
• Messages: Retained for 1 year from date of sending, unless earlier deletion is requested
• Age verification consent records: Retained for the lifetime of the account for compliance purposes
• Usage/technical logs: Retained for up to 12 months

When data is no longer needed, we securely delete or anonymise it.

9. Your Rights Under the PDPA 2022

As a data subject under the Tanzania Personal Data Protection Act 2022, you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion where there is no longer a legal basis for processing
• Right to Restriction: Request that we restrict processing in certain circumstances
• Right to Data Portability: Receive your data in a structured, commonly used format
• Right to Object: Object to processing based on our legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time without affecting prior processing
• Right to Lodge a Complaint: Lodge a complaint with the Tanzania Personal Data Protection Commission (PDPC)

To exercise any of these rights, contact our DPO at dpo@gilda.app. We will respond within 30 days.

10. Security Measures

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (TLS/HTTPS) and at rest
• Row-Level Security (RLS) policies ensuring users only access their own data
• Secure authentication via Supabase Auth with industry-standard session management
• Access controls limiting who within our organisation can access personal data
• Regular security reviews and monitoring

In the event of a personal data breach, we will notify the Tanzania Personal Data Protection Commission and affected users within 72 hours of becoming aware, as required by the PDPA 2022.

11. Cookies and Local Storage

We use cookies and browser local storage to operate our platform:

• Essential cookies: Authentication session tokens required to remain logged in. These cannot be disabled without affecting core functionality.
• Preference storage: Theme preferences (dark/light mode) stored locally on your device.
• Age verification consent: A record of your age verification stored locally to avoid repeated prompts (expires after 30 days).

We do not use third-party advertising cookies or tracking pixels. You can clear cookies and local storage through your browser settings, but this will log you out and reset your preferences.

12. Children's Privacy

GILDA is a platform strictly restricted to persons aged 18 years and older. We do not knowingly collect, process, or retain personal data from anyone under 18.

If we become aware that a user is under 18, we will immediately suspend their account and delete all associated personal data. If you believe a minor has registered on our platform, please report it immediately to safety@gilda.app.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify registered users by email and/or in-app notification at least 14 days before changes take effect
• Where required by law, obtain fresh consent

Your continued use of the platform after the effective date constitutes acceptance of the updated policy.

14. Contact Us & Data Protection Officer

You also have the right to lodge a complaint with the Tanzania Personal Data Protection Commission (PDPC) if you are not satisfied with our response.