Privacy Policy

1. Scope and Your Acceptance

By downloading kopalaini, opening an account, or using any part of the Services, you confirm that you have reviewed and understood this notice and accept the practices described in it. If you are unwilling to accept this notice, you should stop using the Services without delay.

2. Personal Data We Obtain

The information obtained by kopalaini varies according to the features you use. It can include the categories listed below:

• Personal Details: Your full name, date of birth, and gender.
• Contact Details: Your telephone number, email address, and emergency contact information.
• Financial Information: Your income range and bank account details.
• Employment Information: Your occupation, employer, and employment status.
• Verification Data: Selfies, photographs, and identification documents.
• Usage and Technical Data: Information about your interactions with the application, the features you use, and basic technical logs.

3. Collection Sources and App Access

Whenever information is obtained through the kopalaini application, the data will be encrypted through the HTTPS protocol and transmitted to our server at https://api.firstcreditz.com. Your information will not be provided to a third party unless you have consented to that disclosure.

Personal Identification Information (Tanzania)

When you use our application, we may ask you to provide, and may process, personal information including your full name, gender, date of birth or age, nationality or citizenship, residential address, and national identification details. The specific information requested may depend on the applicable onboarding process and relevant requirements.

Where it comes from: We obtain this information from the details that you enter into the application.

How and why we use it: We use this information to confirm your identity, carry out KYC (Know Your Customer) checks, prevent fraud, determine eligibility, and satisfy applicable legal and regulatory duties, including AML/CFT requirements.

Compliance note: Our processing of personal data is conducted in accordance with the data protection requirements applicable in Tanzania, including the Personal Data Protection Act, 2022 of Tanzania and any regulations or guidance that may apply from time to time.

User Profile and Application Data

We may collect further information that you choose to provide, including your education level, employment status, occupation, income, marital status, housing type, and other details entered in application forms or questionnaires.

How and why we use it: We use this information to assist with credit and risk assessments, adapt the Services, strengthen our risk-management models, and provide customer support.

Banking and Payment Information

To carry out financial processing, we may collect information such as your bank account details, the name of your bank, payment identifiers, transaction records, repayment history, and other payment-related information. Where relevant, this information may also include mobile-money payment details and transaction references, such as mobile network operator wallet identifiers and payment confirmations.

How and why we use it: We use this information to assess loan or credit applications, verify your ability to repay, administer disbursements and collections, reconcile payments, and comply with AML/CFT obligations.

Note: We do not use banking or payment information for advertising or for marketing activities that are unrelated to these purposes.

Camera Use for Identity Verification and Liveness

If you grant permission, the application may access your device camera exclusively to verify your identity and perform liveness detection. This may involve taking a selfie and/or scanning an official identification document.

How and why we use it: We use the camera for this purpose to confirm that the identity presented is genuine and to protect against document forgery and identity impersonation.

Protective measures: The application does not operate the camera in the background, and images captured for this purpose are not used for any unrelated activity.

Emergency Contacts

In some circumstances, we may ask you to provide the name, relationship, and telephone number of one or more emergency contacts selected by you.

Where it comes from: We obtain only the contact information that you manually select from your address book.

How and why we use it: We use this information to assist with identity-verification procedures and to make communication possible in emergency situations.

Important: We do not collect the complete list of contacts stored on your device.

Financial SMS Messages

If you give us your explicit consent, we may access and process only those SMS messages that relate to financial activity. The information processed may include the sender, the time the message was received, and the relevant content of the message.

How and why we use it: We use financial SMS information to improve credit scoring, evaluate financial capacity, examine patterns of income and expenditure, and prevent fraud.

kopalaini applies the following rules when filtering your SMS messages:

• We collect only financial SMS messages containing terms such as “loan,” “cash,” “kash,” “credit,” “debt,” “money,” “moni,” or similar words.
• We collect messages only from your SMS inbox.
• We access only financial SMS messages received during the most recent six (6) months, and we will not collect more than 2,000 messages.

You decide whether to grant kopalaini permission to access SMS messages, and you retain full control over enabling or disabling this permission through your device settings. We undertake to securely delete the financial SMS messages after completing the analysis. All such information is securely transmitted to our server at https://api.firstcreditz.com using SSL encryption. We also undertake not to disclose this information to any third party without your consent.

Installed Applications Information

When you authorise this access, we may collect limited information about applications installed on your device, including information such as an application's package name, category, and installation status.

How and why we use it: We use this information to improve device-risk assessment, assist in preventing fraud, and contribute to the analysis of credit risk.

Note: This information is used principally to detect risk patterns associated with financial abuse or fraudulent activity. It is not used for advertising.

Device and System Technical Data

While you use our Android application, we may collect technical information including your device model, hardware specifications such as memory and screen resolution, IP address, Android identifiers such as Android ID, mobile network operator, and operating-system version. When strictly necessary and legally permitted, we may also process certain device identifiers for security and fraud-prevention purposes.

How and why we use it: We use this technical information to reinforce security measures, prevent fraud, control risk, preserve device integrity, and maintain the compatibility and performance of the Services.

Note: We do not use these identifiers for advertising, marketing, or profiling you across different applications.

Approximate Location

If you grant permission, we may collect approximate location information, which may include general coordinates, an accuracy radius, a timestamp, and an indication of the address at regional level.

How and why we use it: We use approximate location information to support fraud-prevention measures, confirm consistency of the device being used, and meet applicable regulatory obligations.

Note: We will not collect your location while the application is operating in the background unless you have provided explicit consent.

Access and Interaction Logs

We may process information relating to your use of the Services, including account identifiers, encrypted credentials or authentication tokens, OTP verification events, session logs, events recording your interactions within the application, and related customer-support interactions.

How and why we use it: We use this information to maintain user accounts, provide secure authentication, process operations, support customers, and continuously improve the product.

Information Obtained from Partners or Third Parties

We may also receive information from authorised third parties and business partners, including the following:

• Licensed credit bureaus or credit-reference partners operating in Tanzania, where applicable.
• Identity-verification providers and providers that conduct sanctions or politically exposed person screening.
• Telecommunications operators or mobile network operators, where legally permitted and/or where consent has been provided.
• Payment partners, mobile-money providers, and banks.
• Marketing partners, but only where such processing is lawful and any required consent has been obtained.

How and why we use it: We use information obtained from these sources to verify the information submitted to us, conduct credit scoring, meet regulatory requirements, and prevent fraud.

4. Reasons We Use Personal Data

The personal data described above is handled for the following business and compliance purposes:

• Registering users and managing user accounts.
• Verifying identity and detecting fraudulent activity.
• Conducting credit assessments and providing the Services.
• Meeting legal and regulatory requirements.
• Maintaining system security, controlling risk, and monitoring operations.
• Communicating with customers and providing support services.

5. Treatment of Sensitive Personal Data

Tanzanian law may classify certain information covered by this notice as sensitive personal data. When information falls within that classification, we handle it under the following conditions:

• Providing sensitive personal data is voluntary unless its collection is required by law.
• We limit the processing of sensitive personal data strictly to legal compliance, fraud prevention, or risk-management purposes.
• We do not use sensitive personal data for advertising, profiling, or discriminatory decision-making.
• We apply enhanced security controls and restrict access to sensitive personal data.

If you choose not to provide sensitive personal data, your access to certain Services may be limited where that information is required for legal or operational reasons.

6. When Information May Be Disclosed

Personal data is never sold by us. We may share personal information only in the following situations:

• When disclosure is required by law, a court order, or a regulatory authority.
• With trusted service providers that support identity verification, regulatory compliance, or infrastructure operations.
• When disclosure is necessary to prevent fraud, security threats, or unlawful conduct.
• When the user has provided explicit consent to the disclosure.

7. Protection and Storage of Data

Appropriate organisational and technical controls are maintained to protect personal data from unauthorised access, disclosure, alteration, or loss. Personal data is sent through secure and encrypted transmission channels and is kept on protected servers.

8. How Long We Keep Information

Personal data remains in our records only for as long as required to achieve the purposes described in this Privacy Policy or to comply with applicable legal and regulatory requirements. When continued retention is no longer needed, we securely delete or anonymise the data.

9. Transfers Outside Tanzania

Where our operations make it necessary, personal data may be transferred to or processed in a country outside Tanzania. Whenever such a transfer occurs, we put appropriate safeguards in place to maintain compliance with the Personal Data Protection Act, 2022.

10. Choices and Data Protection Rights

Tanzanian data protection law gives you the following rights, subject to any applicable conditions or limitations:

• The right to request access to your personal data.
• The right to ask us to correct or delete personal data that is inaccurate or has been processed unlawfully.
• The right to object to, or request limits on, certain processing activities.
• The right to withdraw your consent when our processing is based on that consent.

You may submit a request to exercise any of these rights by using the contact information set out below.

11. Revisions to This Notice

This notice can be amended periodically. The latest version will be made available through the application or through another official communication channel.

12. How to Reach Us