Data Processing Agreement

Last updated: 28 October 2026

This Data Processing Agreement ("DPA") is between Mwanzo Company Ltd ("Mwanzo", "we") and the customer that uses Mwanzo to build and run apps ("you"), usually through an organisation account. It forms part of our Terms of Service and applies whenever Mwanzo processes personal data on your behalf. For a signed copy, email support@mwanzo.dev.

1. Roles

• For the personal data of your app's users and customers (for example form submissions, bookings and payment requests that pass through Mwanzo), you are the data controller and Mwanzo is the data processor.
• For the personal data of your own team on Mwanzo (accounts, sign-ins, the audit log), Mwanzo is the controller under our Privacy Policy.
• Each party follows the data protection law that applies to it, including Tanzania's Personal Data Protection Act (Cap. 44, enacted as Act No. 11 of 2022) and the Personal Data Protection (Collection and Processing) Regulations, 2023.

2. What Mwanzo processes, and why

• Subject matter: hosting the tools you use to build apps, running your apps' previews, test copies and live copies, and the endpoints your apps call to save data and take payments.
• Data: whatever your app collects, typically names, phone numbers, email addresses, messages, orders and payment references. Mwanzo does not ask for special categories of data; if your app collects them, you are responsible for having a lawful basis.
• Where it is kept: data your app saves goes to the database you connect (your own Supabase or other Postgres). Mwanzo passes it through and keeps only short payment records (reference, amount, phone number, status) so you can follow orders.
• Duration: while you use Mwanzo, and until deletion under section 9.

3. Our obligations

• We process personal data only on your documented instructions: these Terms, this DPA, and what you set up in Mwanzo.
• Everyone at Mwanzo who can reach personal data is bound by confidentiality.
• We apply the security measures in section 5 and keep them up to date.
• We help you respond to requests from people exercising their rights (access, correction, deletion, objection), as far as the data is in Mwanzo.
• We help you with data protection impact assessments and with the Personal Data Protection Commission, where our processing is involved.

4. Your obligations

• You have a lawful basis for the data your app collects, and you tell your app's users how you use it (your own privacy notice).
• You register with the Personal Data Protection Commission as a data controller, as the Act requires.
• You keep your team's access appropriate: roles, removing people who leave, and SSO where you need it.

5. Security measures

• Credentials you store (database connection strings, payment keys, GitHub tokens) are encrypted with AES-256-GCM and never put in your app's public code.
• All traffic to Mwanzo and to published apps uses HTTPS.
• Mwanzo's own database uses row-level security; server code uses a separate service key that never reaches the browser.
• Organisations have roles, release rules, an append-only audit log, and SAML single sign-on.
• Apps can have a separate test copy with its own test database, so testing doesn't touch your customers' data.
• Each build runs in an isolated, temporary sandbox.

6. Subprocessors

You authorise Mwanzo to use these subprocessors. We tell organisation owners by email at least 30 days before adding or replacing one; you may object, and if we can't resolve it, you may stop using the affected part of the service.

• Anthropic: the AI (Claude) that plans, writes and reviews code; receives prompts and project files
• Google (Gemini): generates placeholder images from short descriptions
• E2B: temporary sandboxes that run apps while they are built
• Vercel: hosts Mwanzo and published apps (test and live copies)
• Supabase: Mwanzo's own database and sign-in, including SSO
• Resend: sign-in and service emails, and support email
• ClickPesa: mobile-money payments, through each customer's own account
• GitHub: code pushes and CI, when a customer connects their own account

7. Transfers outside Tanzania

Our subprocessors process data outside Tanzania, mainly in the United States. We transfer personal data only under the conditions of sections 31 and 32 of the Act and the regulations, including any authorisation the Commission requires, and our contracts with subprocessors require protection at least equal to this DPA.

8. Personal data breaches

If we become aware of a security breach affecting personal data we process for you, we tell your organisation's owners without undue delay and within 72 hours, even if no harm is apparent yet. We give you what you need for your own notice: a summary and assessment of the breach, its cause, the data and people affected, the measures taken and planned, and supporting records, and we update it as we learn more.

Under section 27(5) of the Act, the data controller must notify the Personal Data Protection Commission of any security breach without undue delay, in the Commission's format. The Act doesn't require telling the people affected, but we help you do so where it would protect them.

9. Deletion

When you delete an app, Mwanzo deletes its code, settings and records from our systems, and its published copies. When you ask us to close an organisation or your account, we delete or return the remaining personal data within 30 days, unless the law requires us to keep it. The audit log is kept for at least 2 years for accountability. Data in your own database, ClickPesa or GitHub accounts stays under your control.

10. Information and audits

We give you the information you reasonably need to show compliance, including your organisation's audit log (downloadable as CSV) and answers to security questionnaires, once a year or after a breach.

11. General

This DPA is governed by the laws of the United Republic of Tanzania. If it conflicts with the Terms on personal data, this DPA wins. Liability is as set out in the Terms.

This agreement may be updated as the service changes; organisation owners are told of material changes by email.