Privacy Policy

• Account information: your name, email address, and password (we only ever store a one-way hash of your password, never the password itself). We only collect a phone number if you provide one — currently that happens if you pay by mobile money at checkout, since that's the number the payment and an SMS/WhatsApp receipt go to.
• Orders and tickets: what you bought, your ticket's scan code, any waiver you accepted, and — if an event uses NFC wristbands — your wristband's unique ID.
• Cashless wallet: your balance, top-ups, and what you spend with vendors at an event; if you top up or withdraw by mobile money, the phone number and network used for that transaction.
• Organizer, vendor, and sponsor information: if you run an event, a stall, or a sponsor activation on Chaap, your business name, contact details, and payout account details for settlements.
• Volunteers and waitlists: your name, phone number, and optionally email, if you sign up to volunteer at an event or join a waitlist.
• Support messages: anything you send us, or an event organizer, through in-app Support.
• Device information: an identifier your phone or tablet generates so gate-scanning and vendor devices keep working offline and can sync once reconnected, and basic sign-in activity for security.

We never see or store your card number, mobile money PIN, or banking credentials. Payments are processed by AirPay Tanzania — Chaap only ever receives a payment reference and a status (pending, paid, or failed); you confirm every mobile money charge yourself, directly on your own phone.

We also don't run any third-party advertising or analytics trackers — no Google Analytics, no Meta Pixel, nothing like it. The only analytics on Chaap are the first-party numbers an organizer sees about their own event.

• to create and run your account, process ticket purchases, and manage your cashless wallet;
• to let you check in at a gate and spend with vendors, including while offline;
• to send order confirmations, receipts, and service messages by email, SMS, or WhatsApp;
• to give event organizers what they need to run their event (see below);
• to detect fraud, keep the platform secure, and enforce our Terms of Service; and
• to meet our legal and accounting obligations, such as keeping financial records.

• Event organizers can see information about tickets bought for, and attendees checked in at, their own event — your name, order/ticket status, and anything you choose to share with them, like a support message. An organizer can't see your password or your activity on other organizers' events.
• Vendors and sponsors see only the wallet transaction (amount and item) when you tap your wristband with them, or that you visited a sponsor activation you scanned at — never your full account details.
• Service providers who process data on our behalf: AirPay Tanzania (payments), Africa's Talking (SMS and WhatsApp delivery), Resend (transactional email), Vercel (hosting and file storage for event photos and logos), and Neon (our database host). Each only receives what it needs to do its job for us and isn't allowed to use your information for its own purposes.
• WhatsApp groups: if an event has a WhatsApp group and you're opted in — either by choice or by the organizer's default for that ticket type, which you can always change afterward from your ticket — we send you the organizer's own group invite link. Chaap never creates a WhatsApp group or adds you to one itself; that can only be done by the organizer, on their own phone. Our part is relaying the invite link to attendees who are opted in.
• Legal requirements: if the law requires it, or to protect the rights, property, or safety of Chaap, our users, or the public.

We do not sell your personal information, to anyone, ever.

Chaap is built to keep working without a connection — at a gate with no signal, or a vendor stall in a dead zone. To make that possible, your phone or tablet keeps a local copy of the data it needs (your tickets, your wallet, recent transactions, and similar) in your browser's on-device storage, and syncs it back to our servers once you're reconnected. That copy stays on your device; clearing your browser's site data removes it from your device, but any already-synced copy remains on our servers as described in this policy.

We use one cookie: the sign-in session that keeps you logged in. We also use your browser's local storage to remember a few preferences on your own device — your chosen language, a high-contrast display setting, and whether you've already seen or dismissed a prompt like the install-this-app banner. None of this is used to track you across other sites, and we don't use third-party advertising or tracking cookies.

We keep your account information for as long as your account is active. If you delete your account (see “Your rights” below), we anonymize your profile immediately rather than deleting your orders and transactions outright — ticket, payment, and settlement records need to stay intact for accounting, tax, and fraud-prevention purposes, for organizers and for us. Once anonymized, those historical records are no longer linked to your name or contact details.

• View and update your account details at any time from your account settings.
• Ask us what information we hold about you.
• Delete your account directly from Account → Settings. This immediately anonymizes your name, email, and phone number, signs you out everywhere, and removes your saved password — it doesn't delete your order or ticket history, for the accounting reasons above, but that history is no longer linked to you by name once your account is anonymized. If you're the sole owner of an organization with a live or upcoming event, you'll need to transfer ownership or wait until the event ends first.
• Opt out of a WhatsApp group at any time from your ticket.

These rights are provided under, and this policy is written to meet, Tanzania's Personal Data Protection Act, 2022 (PDPA). [If Chaap has users in other countries with their own data protection laws, confirm with a lawyer whether this section needs more.]

Chaap isn't directed at children, and you must be at least 18 to create an account or make a purchase. If you're under 18, a parent or guardian needs to create the account and buy tickets on your behalf.

Our database and file storage run on our infrastructure providers (Neon and Vercel), which may store information outside Tanzania. [Confirm the exact hosting region(s) with your infrastructure team if you want to state it specifically here.]

We store your password as a one-way hash, never in plain text, and send data over encrypted connections. No system is perfectly secure, but we work to protect your information and will tell you if a breach puts your personal information at meaningful risk.

If we make a material change to this policy, we'll update the effective date above and, where appropriate, let you know directly.

Questions about this policy, or a request about your information? Reach us through Support in your Chaap account, or email [support contact email]. [Legal entity name and registered address, if you want them listed here.]