Privacy & Data Management

What we collect, why we collect it, how long we keep it, and the rights you have over it under Tanzanian law.

Version 2026-07-31

The short version

We collect the least we can get away with: enough to run your account, show you things worth seeing, and keep the market honest.

We do not sell your personal data. We do not run advertising trackers. You can ask us for a copy of your data, or ask us to delete it, at any time.

1. Who is responsible for your data

SokoVerse, of Dar es Salaam in the United Republic of Tanzania, is the data controller for the personal data described in this policy. That means we decide what is collected and why, and we are answerable for it.

Our contact point for anything to do with your data is customerCare@sokoverse.co.tz.

Businesses selling on SokoVerse are separate controllers of the data their own customers give them directly, such as a delivery address sent to them in a message.

2. What we collect

We group it into five kinds, so you can see exactly where each piece comes from.

Account data — your name, email address, and a securely hashed version of your password. We never store the password itself. If you sign in with Google or Apple, we receive your name and email address from them and nothing else.
Business data, if you sell — your storefront name, description, location, phone number, website and the listings and photos you publish. This is public by design.
Activity data — what you like, save, follow, comment on and report, and the collections you create. This is what makes your feed yours.
Technical data — your IP address, device type, browser and the pages you open, recorded by our hosting provider in ordinary server logs used for security and troubleshooting.
Messages — anything you send to customerCare@sokoverse.co.tz, kept so we can answer you and see whether a problem repeats.

3. Why we use it, and on what legal basis

Under the Personal Data Protection Act, 2022 we must have a lawful basis for every use. Ours are these:

To run your account, show your saved items and connect you to sellers — because it is necessary to perform the agreement between us.
To personalise your feed and recommend listings — with your consent, given when you accept these terms, and withdrawable at any time.
To keep the market safe: detect fraud, act on reports, prevent abuse — because we have a legitimate interest in a market people can trust, and so do you.
To answer your messages and provide support — to perform our agreement with you.
To meet legal obligations, respond to lawful requests from Tanzanian authorities, and keep the records the law requires.

5. Where your data is kept

Our hosting and email providers operate servers outside Tanzania. That means your personal data may be stored or processed abroad.

The Personal Data Protection Act allows this where the receiving country or provider offers adequate protection. We use established providers with recognised security standards and contractual data-protection commitments, and we will publish the details of any change to where data is held.

6. How long we keep it

We keep personal data only as long as it is doing a job, then delete or anonymise it.

Account data — while your account is open, and for 90 days after you close it, so you can change your mind and so we can settle any dispute.
Listings and public comments — while they are published; once deleted they are removed from the platform, though backups may retain them for up to 30 days.
Reports and moderation records — up to two years, so repeat patterns are visible.
Server logs — up to 90 days.
Records we are legally required to keep — for the period the relevant Tanzanian law specifies.

7. How we protect it

Passwords are hashed with bcrypt and never stored in readable form. Sessions use signed, httpOnly cookies that scripts on the page cannot read. All traffic runs over HTTPS. Access to the production database is limited to those who need it.

No system is perfect. If a breach happens that is likely to put your rights at risk, we will notify the Personal Data Protection Commission and tell you what happened, what we are doing, and what you should do.

8. Your rights over your data

The Personal Data Protection Act, 2022 gives you these rights, and we honour them free of charge:

Access — ask what personal data we hold about you and get a copy of it.
Rectification — have anything inaccurate or incomplete corrected.
Erasure — ask us to delete your data where we no longer have a reason to keep it.
Restriction — ask us to pause processing while a dispute about accuracy or lawfulness is resolved.
Objection — object to processing based on our legitimate interests, including personalised recommendations.
Withdraw consent — at any time, without affecting what we lawfully did before you withdrew it.
Complain — to us first, and to the Personal Data Protection Commission if we do not put it right.

9. How to use those rights

Write to customerCare@sokoverse.co.tz from the email address on your account and say what you want. We will confirm receipt and respond within 30 days. If a request is unusually complex we may need longer, and we will tell you why before that period runs out.

We may ask you to confirm your identity first — that protects you, not us.

10. Children

SokoVerse is not for children under 13, and we do not knowingly collect their personal data. Accounts require you to be 18 or older.

If you believe a child has given us personal data, write to customerCare@sokoverse.co.tz and we will delete it promptly.

11. Changes to this policy

This policy carries a version date, shown at the top of the page. When we change how we use your data in a way that matters, we will ask you to accept the new version and say plainly what changed.

12. Complaints

Tell us first: customerCare@sokoverse.co.tz. We would rather hear it from you than read it elsewhere.

If you are still unhappy, you may complain to the Personal Data Protection Commission of Tanzania, established under the Personal Data Protection Act, 2022, whose current contact details are published at pdpc.go.tz.