Privacy Policy

Draft for legal review. Written from what the Mhanzi app and portal actually collect, so a lawyer can check it against Zimbabwe's Cyber and Data Protection Act and the Google Play and App Store rules. Everything in [brackets] needs filling in.

Version 2026-11-01. Last updated: [date]

[Company legal name] ("Mhanzi", "we") runs the Mhanzi app and the Mhanzi portal. This policy explains what we collect, why, and your choices.

What we collect

Everyone with an account

• Email address, password (stored scrambled; we can never read it) and your name.
• Your city, if you choose one.
• When you agreed to these terms and this policy, and which version.

Listeners

• What you play: the song, when it started and ended, how long you listened, and your city at the time.
• 30-second previews you listen to in Discover (not counted as plays).
• Songs you like and artists you follow. Only you can see these; artists see only how many followers they have.
• The type of device (Android, iPhone, web) and a device identifier, used to detect fraudulent plays.
• Which banner ads were shown to you and whether you tapped them.

Artists

• Artist name, bio, city, banner, uploaded music, cover art and releases (EPs and albums).
• Credits you add to your songs (names of writers, producers and featured artists). These are shown to listeners.
• For each upload: your confirmation that you own the music or may release it, and your answer about whether any writer is a member of ZIMURA or another collecting society, with the time you gave them.
• Payout details: mobile money number or bank account, and the account holder's name.

People invited to share an artist's royalties

• An artist can invite you by email to a share of a song's royalties. We keep your email address with that invitation, even before you have an account, so we can match it when you sign up. You can decline the invitation, or leave the split later.

Businesses that advertise

• Business name, type of business, industry, city, physical address, contact person, contact phone and email, and logo.
• If you give them: company registration number, ZIMRA taxpayer number (TIN) and VAT number, used for tax invoices.
• Ads, images, and payment records (amount, method, reference).

We don't collect your precise location, contacts, photos or microphone audio, and we don't ask for national ID numbers.

Why we use it

• To run the service: sign-in, playing music, your library, Discover.
• To pay artists: counted plays decide each artist's share of advertising revenue, and royalty splits decide how that share is divided. Artists never see who you are.
• To show and measure ads: ads are chosen by city. Businesses see totals only (views, taps, cities), never who saw or tapped an ad.
• To prevent fraud: unusual listening patterns are checked by our team before royalties are paid.
• To meet the law: keeping payment and tax records, and records of who confirmed the rights to each song.
• To contact you about your account, payouts, ads or invitations.

Who we share it with

• Supabase (database, file storage and sign-in), hosted in [region].
• [Web host, e.g. Vercel] for the portal.
• Payment channels (EcoCash, OneMoney, InnBucks, banks) to pay artists and receive payments from businesses.
• ZIMRA and other authorities, when the law requires it.

We don't sell personal information.

How long we keep it

• Account details: while your account is open. When you delete your account, your name, bio, banner, payout details, likes, follows and business contact details are removed straight away.
• Play history, royalty statements, payment records and rights confirmations: [7] years, because they are financial and legal records. After you delete your account they are kept without your name.
• Ad views and previews: [24] months.

Your choices and rights

• You can see and edit your profile in the app or portal.
• You can delete your account yourself in the app (Profile) or the portal (Account). If an artist has royalties waiting to be paid, the account can be deleted once they're paid.
• You can ask us for a copy of your data, or to correct it, by emailing [privacy@…]. We answer within [30] days.
• You can complain to the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), the data protection authority.

Children

Mhanzi is not for children under [13/16]. [Confirm the age with your lawyer.]

Security

Data is encrypted in transit. Access is limited by role: listeners, artists and businesses can only see their own records, and only the Mhanzi team can see payout details, tax details and fraud reviews.

Changes

We'll post changes here and tell you in the app if they matter. The version you agreed to is recorded with your account.

Contact

[Company legal name], [address], [privacy@…]