Privacy policy

Who we are

Herufi (Herufi), Mikocheni B, Dar es Salaam, Tanzania, is responsible for your personal data. We handle it in line with the Personal Data Protection Act, 2022 of Tanzania. For any privacy question or request, contact hello@herufi.co.tz.

What we collect

• Account details: name, email, phone number, password (stored only in encrypted, hashed form) and, if you add one, a profile photo.
• Order details: delivery addresses, items bought, order history, discount codes used and messages with our team.
• Payment details: payment method type, card brand and last four digits, mobile money number and transaction IDs. We never receive your full card number, CVV or PIN.
• Activity: products you view while signed in, your wishlist and bag, reviews and questions you post, and your language and marketing preferences.
• Technical data: device and browser type, and the cookies described in our Cookie policy. We don't use advertising or third-party tracking cookies.

Why we use it

• To create your account, take payment, and buy, ship, clear and deliver your orders (performing our contract with you).
• To give support, process returns and refunds, and prevent fraud (our legitimate interests and contract).
• To keep tax and accounting records (legal obligation).
• To recommend products based on what you've viewed, searched for, saved or bought, and how long you looked at them (legitimate interests). We keep this activity for up to 180 days. In the app you can turn personalisation off or clear your browsing history under Account → Settings.
• To send offers and newsletters, only if you opt in. You can unsubscribe at any time in Settings or from any email (consent).

Who we share it with

We never sell your personal data. We share only what's needed with:

• delivery couriers and pickup points in Tanzania (name, phone, delivery address);
• customs clearing agents, where the law requires import details;
• mobile money operators and our card processor, to take and refund payments;
• our technology providers, who host our database, store files and send emails on our behalf under contracts that protect your data;
• authorities such as the Tanzania Revenue Authority or the police, when the law requires it.

Factories in China receive product and quantity details only, not your name or address.

Storage outside Tanzania

Some of our technology providers store data on secure servers outside Tanzania. When this happens we make sure your data gets a level of protection that meets the requirements of the Personal Data Protection Act, through contracts and security safeguards.

How long we keep it

We keep your account data while your account is open. Order and payment records are kept for as long as Tanzanian tax and accounting law requires, even after you close your account. Marketing preferences are kept until you change them. When data is no longer needed we delete or anonymise it.

How we protect it

Encrypted connections (HTTPS), hashed passwords, strict access controls so that each team member can see only what their role needs, and row-level security in our database so customers can only ever see their own data.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, or stop using it for marketing or recommendations. You can update most details yourself in your account. To make any other request, email hello@herufi.co.tz. We'll reply within 30 days, and may need to verify your identity first.

If you're not happy with how we've handled your data, you can complain to the Personal Data Protection Commission (PDPC) of Tanzania.

Children

Our services are for adults. We don't knowingly collect data from children under 18 without a parent or guardian's consent.

Changes

We'll post any changes here and update the date at the top. If a change is significant, we'll tell you by email or in the app.