Back to Home
Legal

Privacy Policy

Last updated: 1 June 2026 · Effective: 1 June 2026

Kilimo Box Ltd ("we", "our", "us") is committed to protecting your privacy. This policy explains how we collect, use, share, and protect your personal data when you use the Kilimo Box platform, including our web application, mobile apps, and WhatsApp services.

1Information We Collect

  • Account details: full name, phone number, email address, national ID (for KYC verification).
  • Farm data: location coordinates, crop types, farm size, soil and weather data voluntarily submitted.
  • Transaction data: order history, payment records, stock submissions, disbursements.
  • Device data: push notification tokens, app usage logs, crash reports (via Sentry).
  • Communications: WhatsApp message history via Twilio (for Msaidizi AI and notifications).

2How We Use Your Information

  • To verify your identity through our KYC review process and comply with Tanzania financial regulations.
  • To process orders, calculate disbursements, and manage your subscription or B2B standing orders.
  • To provide personalised agricultural advice through our Msaidizi AI assistant.
  • To match you with relevant funding opportunities, BDS providers, and market prices.
  • To send transactional notifications via WhatsApp, SMS, and email.
  • To generate anonymised impact reports for investors and development partners.

3Data Sharing

  • We do not sell your personal data to third parties.
  • We share data with B2B buyers and BDS providers only with your explicit consent.
  • Service providers (Twilio, Cloudinary, Supabase, Sentry) process data on our behalf under data processing agreements.
  • We may disclose data to comply with Tanzanian law or valid legal orders.
  • Anonymised, aggregated statistics may be shared with funders and development organisations.

4Data Storage & Security

  • Data is stored on Supabase (PostgreSQL) hosted on AWS in the EU-West region.
  • All data in transit is encrypted via TLS 1.3. Data at rest is encrypted using AES-256.
  • Access to production data is restricted to authorised staff via role-based access controls.
  • JWT tokens expire after 1 hour; refresh tokens after 30 days.
  • We conduct regular security audits and maintain an incident response plan.

5Your Rights

  • Access: You may request a copy of all personal data we hold about you.
  • Correction: You may update your profile, farm data, and preferences at any time via the app.
  • Deletion: You may request account deletion; we will erase personal data within 30 days (subject to legal retention obligations).
  • Portability: You may request your data in machine-readable JSON format.
  • Opt-out: You may disable WhatsApp notifications, marketing emails, or data sharing with BDS providers at any time.

6Cookies & Tracking

  • We use session cookies (kb_token, kb_role) strictly for authentication and portal routing — no third-party advertising or tracking cookies are set.
  • Analytics are collected server-side and do not use browser fingerprinting.
  • Error monitoring (Sentry) may store a small amount of local data on your device to help us diagnose crashes; it never runs in development and contains no ad-tracking identifiers.
  • You may clear your local cookies and cached data at any time using the control below; this will sign you out of the platform.

Manage Your Cookies & Local Data

This clears your session cookies, local cache, and any locally stored preferences on this device.

7Children's Privacy

  • Kilimo Box is not directed at children under 18. We do not knowingly collect data from minors.
  • If you believe a minor has registered, contact us immediately at privacy@kilimo.co.tz.

8Legal Basis & Compliance

  • We process your data in accordance with the Tanzania Electronic and Postal Communications Act (EPOCA, 2010) and its subsidiary regulations.
  • Processing is based on: (a) your consent at registration, (b) contractual necessity to deliver our services, and (c) compliance with Tanzanian financial and agricultural regulations.
  • We cooperate with the Tanzania Communications Regulatory Authority (TCRA) and the Bank of Tanzania (BoT) as required by law.

9Changes to This Policy

  • We will notify all users via WhatsApp and email at least 14 days before material changes take effect.
  • Continued use of the platform after the effective date constitutes acceptance of the revised policy.

10Contact & Complaints

  • Data Controller: Kilimo Box Ltd, Dar es Salaam, Tanzania.
  • Privacy enquiries: privacy@kilimo.co.tz or +255 712 000 001.
  • You may also lodge a complaint with the Tanzania Communications Regulatory Authority (TCRA).

Privacy Questions?

Our team responds to privacy requests within 5 business days.

privacy@kilimo.co.tz