Who we are
Sherehesha is an online marketplace that connects people planning events in Tanzania with event service providers. This policy applies to our website (sherehesha.com), our web app (app.sherehesha.com) and our mobile apps (together, the Service).
Sherehesha, based in Dar es Salaam, Tanzania, is the data controller for the personal information described here. We process personal information in line with the Personal Data Protection Act, 2022 of Tanzania and its regulations.
What we collect
We collect the information you give us, information created when you use the Service, and a limited amount of technical information.
| Account | Your first and last name, email address and password. Passwords are stored only as a secure hash. If you sign in with Google, we receive your name, email address and profile photo from Google. |
|---|---|
| Profile | Your public display name, profile photo and bio, the region, district and ward you choose, and, if you add them, a contact phone number and a verified phone number. |
| Location | If you allow it, your device location. We round it to about one kilometre before storing it and never store your exact position. Location access is optional and can be turned off in your device or browser settings at any time. |
| Content | Ads you publish (text, prices, category details and photos), comments, ratings and reviews, reports, and messages you send. Photo location data (EXIF) is removed on your device before upload. |
| Activity | The ads you view, like or comment on, the searches you make, the providers you start a chat with and the phone numbers you choose to reveal. |
| Payments | The plan you buy, the amount, the payment method type, the status and the payment reference. The mobile money number you enter is sent to our payment partner to request the payment. Card details are entered on our payment partner's page; we never see or store card numbers. |
| Device and diagnostics | A push notification token, your platform and app version, and crash and error reports (for example device model, operating system and the error). On the web, error reports may include a short recording of the page with all text masked and all images and media blocked. |
| Verification and safety | Blue tick requests, reports you make or receive, and the outcome of moderation decisions. |
| Communications | Emails and messages you send to our support team and the service emails we send you. |
We do not collect national identity numbers, and we do not use your information to show you third party advertising.
How we use your information
- To create and run your account and let you publish ads, comment, rate, chat and call.
- To show relevant results. Your feed is ranked automatically using your area or approximate location, the categories and ads you interact with, ratings and what is popular. Trending lists rank providers by recent activity (views, likes, comments, chats, phone reveals) and ratings.
- To process payments, activate plans and send receipts and reminders.
- To send notifications in the app, by push notification and, for receipts, plan reminders, verification and moderation outcomes, by email.
- To keep the Service safe: reviewing reports (with help from an AI model that compares the reports), applying rate limits and preventing fraud, spam and misuse.
- To make search work, including converting ad text and search terms into search vectors so that similar words match.
- To find and fix errors and improve the Service.
- To comply with legal obligations and respond to lawful requests.
Automated decisions
Rankings and recommendations are automated. If several established accounts independently report the same account for the same concern, the reports are reviewed with the help of an AI model and the account may be suspended automatically. You can ask for a human review of any such decision by contacting us.
Legal bases
We rely on:
- Contract: to provide the Service you signed up for, including payments and plans.
- Consent: for device location and push notifications. You can withdraw consent at any time in your device settings.
- Legitimate interests: to keep the Service safe, prevent fraud, rank results and improve the Service, balanced against your rights.
- Legal obligation: where the law requires us to keep or disclose information.
Who can see your information
- Other users can see your public profile (display name, photo, bio, region and district, rating, blue tick and the date you joined), the ads you publish and the comments and ratings you leave, shown with your display name.
- Your phone number is shown only when someone chooses to reveal it and is allowed to: customers with an active chat plan can see a provider's number, and people who already have a conversation with you can see yours.
- Messages are visible only to the two people in the conversation. Our team may review content when it is reported or when required by law.
- Your email, location, payments and activity are never shown to other users.
We do not sell your personal information.
Service providers
We use trusted providers who process information on our behalf, under contracts that limit how they may use it:
| Supabase | Database, authentication and server functions |
|---|---|
| Cloudflare | Website hosting, content delivery, image storage and security |
| Google (Firebase) | Push notifications and app crash reports, and Sign in with Google |
| Sentry | Error monitoring for the web app |
| OpenAI | AI assisted review of reports, and search vectors for ad text and search terms |
| Snippe | Mobile money and card payments |
| Resend | Delivery of service emails |
We may also disclose information when required by law, to protect the rights and safety of our users or the public, or as part of a merger or sale of our business, in which case this policy will continue to apply.
International transfers
Some of our service providers store or process information outside Tanzania. When that happens we rely on appropriate safeguards, such as contractual commitments to protect the information to a standard equivalent to Tanzanian law.
How long we keep it
- Account, profile and content: for as long as your account exists.
- Records of ads viewed and phone numbers revealed: 35 days.
- Notifications you have read: 90 days.
- Cached search terms: 30 days after they were last used.
- Photos you remove from an ad, or from a deleted ad, are deleted from storage.
- When you delete your account, your profile, ads, photos, comments, ratings, messages, notifications and in app payment history are deleted. Information may remain in encrypted backups for a limited time before it is overwritten, and our payment partner keeps its own transaction records as required by law.
Your rights
Under Tanzanian data protection law you have the right to:
- access the personal information we hold about you and receive a copy of it;
- correct inaccurate information (most of it you can edit yourself in the app);
- delete your account and information (see Delete your account);
- object to or ask us to restrict certain processing;
- withdraw consent for location and notifications at any time;
- ask for a human review of an automated decision; and
- complain to the Personal Data Protection Commission of Tanzania.
To exercise these rights, email [email protected] from the email address on your account. We reply within 30 days.
Security
All connections to the Service are encrypted. Access to data is restricted by database rules so each person can only reach what they are allowed to, passwords are hashed, location is stored only approximately and our team's access is limited and logged. No system is perfectly secure, so please use a strong password and keep it private.
Children
The Service is for people aged 18 and over. We do not knowingly collect information from children. If you believe a child has created an account, contact us and we will delete it.
Changes to this policy
We may update this policy. If the changes are significant we will tell you in the app or by email before they take effect. The date at the top shows when it was last updated.
Contact us
Questions or requests about privacy: [email protected]. Sherehesha, Dar es Salaam, Tanzania.