01Who we are, and our two roles
Mlango is operated from Dar es Salaam, Tanzania. You can reach us at habari@mlango.co.tz.
We handle personal data in two different capacities, and it matters which one applies to you:
- Our own customers — the businesses and people who open a Mlango account. For their account, login and billing data we decide how it is used, so we are responsible for it (the "data controller").
- The people our customers message — for example a client who receives a payment reminder. Their phone number, name and messages are uploaded and sent by the business that uses Mlango. That business decides who to contact and why; we process the data on its behalf and on its instructions (as a "data processor"). If you received a message through Mlango, the business that sent it is your first point of contact — but you can always write to us as well.
02What we collect
From account holders:
- Account details: name, email address, phone number, company name.
- Sign-in and security data: a securely hashed password (we never store it in readable form), two-factor authentication settings, sign-in times, IP addresses, browser and device type, and failed sign-in attempts.
- Billing records: wallet top-ups, the payment method and reference (for example a mobile-money transaction ID), message charges and balances. We do not receive or store card numbers or mobile-money PINs.
- WhatsApp Business connection details: the WhatsApp Business account and phone number IDs, and the access token issued by Meta, which we store encrypted.
About message recipients, on behalf of our customers:
- Phone number and, where the business provides it, name and other details used to fill in a message (such as an amount due or an appointment date).
- The messages sent to them, delivery and read status reported by WhatsApp, and any replies they send back — including text, photos, voice notes, documents or locations they choose to share.
- Whether they have opted out of messages (for example by replying STOP or ACHA).
On our website: only the cookies needed for it to work — a session cookie that keeps you signed in, a security cookie that protects forms, and a cookie remembering your language. We do not use advertising or tracking cookies.
03How we use it
- To provide the service: sending messages, showing delivery reports, receiving and displaying replies in the Inbox.
- To bill accurately: Meta charges per delivered message, and we charge your prepaid wallet accordingly.
- To keep accounts safe: detecting unusual sign-ins, enforcing two-factor authentication, blocking abuse and fraud.
- To honour opt-outs: a recipient who replies STOP or ACHA is excluded from further campaigns and reminders from that business.
- To meet legal obligations, such as keeping financial records and responding to lawful requests from Tanzanian authorities.
- To support you when you contact us.
We do not sell personal data, use message content for advertising, or use it to train artificial-intelligence models.
04Legal basis
We process personal data in line with the Personal Data Protection Act, 2022 of Tanzania. Account data is processed to perform our contract with you and to meet our legal obligations; security monitoring is based on our legitimate interest in protecting the service. For message recipients, the business that sends the messages is responsible for having a valid basis — usually the recipient's consent or an existing customer relationship — and WhatsApp's own rules require businesses to have the recipient's permission before messaging them.
06Where data is stored
Meta's systems and our hosting provider's servers may be located outside Tanzania. When personal data leaves Tanzania we rely on providers that apply strong security and contractual protections, as the Personal Data Protection Act requires.
07How long we keep it
- Account data: while your account is open, and up to 12 months after it is closed, unless you ask us to delete it sooner.
- Messages, delivery reports and replies: up to 12 months, after which they are deleted or anonymised. Media files that customers send are kept by Meta for up to 30 days; copies we store follow the 12-month rule.
- Financial records (top-ups, charges): as long as Tanzanian tax and accounting law requires, generally five years.
- Security logs: up to 12 months.
- Opt-out records: kept for as long as needed to keep honouring the opt-out.
08How we protect it
- All traffic to Mlango is encrypted with HTTPS.
- WhatsApp access tokens and two-factor secrets are encrypted at rest; passwords are stored only as secure hashes.
- Two-factor authentication, automatic lock-out after repeated failed sign-ins, and step-up verification before sensitive actions such as going live or launching a campaign.
- Strict separation between businesses: every query is limited to the signed-in account's own data.
- Every incoming webhook from WhatsApp is checked against Meta's cryptographic signature before it is processed.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the Personal Data Protection Commission as the law requires.
09Your rights
Under the Personal Data Protection Act you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct data that is wrong or incomplete;
- delete your data — see How to delete your data;
- stop using your data for a particular purpose, or withdraw consent you gave;
- stop sending you messages — reply STOP or ACHA to any message from a business on Mlango.
Write to habari@mlango.co.tz. We reply within 7 days and complete requests within 30 days. If you are not satisfied, you may complain to the Personal Data Protection Commission (Tume ya Ulinzi wa Taarifa Binafsi) of Tanzania.
10Children
Mlango accounts are for businesses and adults aged 18 or over. We do not knowingly open accounts for children.
11Changes to this policy
If we change this policy we will update the date at the top of this page, and tell account holders by email or in the application before significant changes take effect.
12Contact
Mlango, Dar es Salaam, Tanzania — habari@mlango.co.tz