Privacy Policy.

Zango SpendWise is built and operated by BISS Consult, a business based in Zambia. In this policy, “we”, “us”, and “Zango” mean BISS Consult.

For the personal data described here, we are the data controller: we decide what is collected and why. We process it in line with the Data Protection Act No. 3 of 2021 of Zambia.

You can reach us about anything on this page at chipopa@bissconsult.com.

This policy covers the Zango SpendWise mobile app on iOS and Android, and the servers behind it. It does not cover our other products — ZangoFinance, Treasurer, Docusecure, Smart Power, and Village Banking each handle data differently.

It also does not cover the mobile money providers and banks you deal with directly. When you approve a payment on an Airtel Money prompt, that interaction is governed by Airtel’s own terms and privacy policy, not this one.

Almost everything we hold is something you typed in or an action you asked us to take. We do not buy data about you, and we do not pull it from your device in the background.

Your password is stored only as a bcrypt hash. We cannot read it, and neither can anyone who obtains the database.

Being specific here matters more than being reassuring:

• —Your mobile money or banking PIN. Payments are approved on your provider's own USSD prompt, on your phone. The PIN never passes through the app or our servers.
• —Your bank or mobile money login credentials. There is no account-linking integration — you type in the accounts you want to track.
• —Your SMS messages. The app does not read, request, or parse your text messages.
• —Your location. The app does not request GPS or location permissions.
• —Your contacts, photos, calendar, or files.
• —Advertising identifiers or behavioural tracking data. There are no ad or analytics SDKs in the app.

We use what we collect to:

• —Run your account and keep you signed in securely.
• —Track budgets against your spending and show you where you stand.
• —Carry out the payments, transfers, wallet top-ups, and airtime purchases you initiate, and tell you what happened to each one.
• —Produce your analytics — spending by category, month, and merchant — visible only to you.
• —Send you the service messages you have switched on in Settings: budget alerts, payment reminders, low-balance warnings, and weekly summaries.
• —Keep an accurate, reconcilable financial record of every kwacha that moves, as any money service must.
• —Investigate faults, prevent fraud and abuse, and meet our legal and regulatory obligations.

We do not use your spending data to advertise to you, and we do not sell, rent, or trade it.

Under the Data Protection Act No. 3 of 2021, we rely on the following grounds:

• —Performance of a contract — we cannot run your budget or move your money without the data needed to do it.
• —Your consent — for optional notifications, which you can withdraw at any time in Settings.
• —Compliance with a legal obligation — financial record-keeping, tax, and anti-money-laundering requirements.
• —Our legitimate interests — keeping the service secure, preventing fraud, and diagnosing faults, weighed against your rights.

We share the minimum needed with the providers that make the service work. Each acts under contract, on our instructions, and for no purpose of their own.

Beyond these, we disclose personal data only where the law requires it — a court order, a lawful request from a regulator or law enforcement agency — or where it is necessary to establish or defend a legal claim. If our business is ever sold or restructured, your data may transfer to the acquirer, who would be bound by this policy until you are notified otherwise.

When you send money to another SpendWise user, that user sees the amount, any note you attach, and that it came from you.

Your data lives in a managed PostgreSQL database hosted by Neon, and our servers and email delivery run on cloud infrastructure that may be located outside Zambia. That means your personal data may be transferred to and processed in other countries.

Where that happens, we rely on providers that offer recognised safeguards — contractual data protection terms, encryption in transit and at rest, and audited security practices — so that your data keeps a level of protection equivalent to what it has under Zambian law.

We keep your account data for as long as your account is open. If you close it, we delete or anonymise your personal data within 30 days, with one exception.

That exception is financial records. Completed payments, transfers, deposits, and wallet ledger entries are retained for at least six years after the transaction, because Zambian tax and financial record-keeping law requires it and because a ledger that can be selectively erased is not a ledger. These records are kept in a restricted form, no longer linked to a usable login, and are not used for any other purpose.

Server logs containing technical information are kept for a short operational period and then discarded.

• —Passwords are stored as bcrypt hashes, never in a readable form.
• —Session tokens are held in your device's secure storage — Keychain on iOS, Keystore on Android — not in ordinary app storage.
• —Access tokens are short-lived and refresh automatically, so a stolen token has a narrow window.
• —All traffic between the app and our servers runs over encrypted HTTPS connections.
• —Every query is scoped to the signed-in account, so one user's data cannot be read through another's session.
• —The wallet is a double-entry ledger with enforced invariants: balances must reconcile to the sum of entries, which makes silent tampering detectable.
• —Error messages returned to the app are sanitised so internal details are not leaked.

No system is perfectly secure. If a breach ever affects your personal data, we will notify you and the Data Protection Commissioner as the Act requires. Keep your device locked and your password to yourself — that part is yours to hold.

Under Zambian data protection law you have the following rights over your personal data. Write to us and we will respond within 30 days.

Access

Ask what personal data we hold about you and get a copy of it.

Correction

Have anything inaccurate or incomplete put right. Most of it you can edit yourself in Settings.

Deletion

Ask us to erase your account and data, subject to records we are legally required to keep.

Objection & restriction

Object to a particular use of your data, or ask us to pause processing while a dispute is resolved.

Portability

Receive your data in a structured, commonly used format so you can take it elsewhere.

Complaint

Complain to the Data Protection Commissioner appointed under the Data Protection Act if we have not put things right.

Exercising a right costs nothing. We may ask you to confirm your identity first, so that nobody else can use these rights against your account.

To delete your SpendWise account, email us from the address on the account with the subject Delete my SpendWise account. We will confirm the request, withdraw any remaining wallet balance to a mobile money number you nominate, and then delete your profile, budgets, recorded transactions, linked accounts, and notification settings within 30 days.

Completed financial records are retained as described in section 09. Everything else goes.

SpendWise is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has created an account, tell us and we will remove it.

We update this policy when the app changes what it does with your data. The effective date at the top always reflects the current version. If a change materially affects your rights, we will tell you in the app or by email before it takes effect, rather than quietly editing this page.

For any privacy question, request, or complaint about Zango SpendWise, write to us:

If you are not satisfied with how we have handled your request, you may complain to the Data Protection Commissioner appointed under the Data Protection Act No. 3 of 2021 of Zambia.