Privacy policy

Last updated: 27 September 2026 · Effective for the FLOTIKA app and flotika.co.tz

1. Who we are

FLOTIKA is a float and financial-operations product for mobile-money agents in Tanzania. It is owned and operated by Pedima ("Pedima", "we", "us").

Website: https://flotika.co.tz
App package (Android): com.flotika.app
API: https://api.flotika.co.tz

2. Scope

This policy covers personal data processed when you:

• Install or use the FLOTIKA mobile application
• Create or sign in to an agent account (phone number + PIN)
• Submit KYC / identity details (including NIDA) for registration or bank account opening
• Contact us by email or through support channels
• Visit our public website at flotika.co.tz

Staff portals (Super Admin, Operations, Developers) are for Pedima personnel only and are covered by internal access controls; they are not consumer-facing services.

3. What we collect

Account and authentication

• Phone number in E.164 format (Tanzania numbers). This is your primary account identifier.
• PIN — we never store your PIN in plain text. We store an Argon2id hash only, used to verify sign-in.
• OTP challenges for registration (and similar flows). One-time codes are hashed; SMS delivery is handled by our SMS provider (currently Netnaunse for FLOTIKA registration OTP).
• Sessions and devices — refresh/access token hashes, device key, OS name, and app version when provided by the client, for session security.

Profile and KYC

• Full name, title, first/middle/last name, email, date of birth, gender, nationality
• Business name, physical address, region, district, ward, city, country
• Next-of-kin name, phone, and relationship (when collected for bank onboarding)
• National ID (NIDA) — stored for uniqueness in our database and for KYC / account-opening journeys. A NIDA conflict returns only a generic message ("This ID is already registered.") so we do not reveal other users' identities.
• KYC record status and the JSON payload you submit during capture

Bank account opening (when you use that flow)

• Application state we keep as our source of truth (status, application identifiers, provider state, verification references)
• Answers you provide to bank identity questions and bank OTP verification outcomes as required by the banking partner (Co-operative Bank Tanzania / Co-op ESB account-opening APIs)
• Co-op account number and status if and when the bank returns them and we link them to your agent record

Support and product assistance

• Support cases and messages you send to Pedima
• Optional in-app assistant (Mr. Flotika) conversation content, if you use it — treated as support/product data, not sold for advertising

Technical and security logs

• Audit logs of security-relevant actions (for example successful login)
• Provider interaction logs needed for troubleshooting and reconciliation
• Standard server logs (timestamps, request metadata) to operate and secure the API

Website

• If you use the contact / early-access form on flotika.co.tz: name, email, message, and language preference so we can reply from contact@flotika.co.tz

4. How we use data

• Create, authenticate, and secure your agent account
• Complete registration, KYC, and Co-op Bank account-opening journeys
• Send transactional SMS (OTP) required to verify your phone
• Prevent fraud, abuse, and unauthorized access
• Provide customer support and investigate issues
• Meet legal, regulatory, audit, and partner-contract obligations
• Improve reliability and security of the service (not for selling ads)

We do not sell personal data. We do not use your data for third-party advertising networks.

5. Legal bases

Depending on the activity, we process data because:

• Contract — to provide the FLOTIKA account and features you request
• Legal obligation — KYC, record-keeping, and responses to lawful requests
• Legitimate interests — security, fraud prevention, service integrity, balanced against your rights
• Consent — where a specific optional feature requires it (you may withdraw where applicable)

6. Sharing and processors

We share personal data only as needed to run FLOTIKA:

• Hosting / infrastructure — application and database hosting (API on Railway; public websites on Vercel)
• SMS — Netnaunse (or successor) to deliver FLOTIKA registration OTP messages to your phone
• Email — transactional mail for contact acknowledgements and support
• Banking partner — Co-operative Bank Tanzania, for account opening and related APIs you initiate (see below)
• Pedima staff — with role-based access (RBAC) for support, KYC review, and operations; access is audited
• Authorities — when required by Tanzanian law or a valid legal process

7. Banking partners

When you start Co-op Bank account opening in the app, the data required by that journey (including NIDA-related questions and mobile verification OTP issued by the bank) is processed with Co-operative Bank Tanzania under their systems and rules. FLOTIKA OTP for our registration is separate from the bank's OTP.

We minimise fields sent to the bank to what the official integration requires. Bank-side outages (for example temporary NIDA verification unavailability) may pause the journey; that does not change how we store the profile data you already gave us.

8. Security

• TLS for data in transit to our API and websites
• PIN hashing with Argon2id; session tokens stored as hashes
• Staff access controlled by permissions (not open agent access to admin tools)
• Audit logging for sensitive actions
• Production customer data is not used in development environments
• Idempotency and careful status handling for money-moving APIs when enabled

No method of transmission or storage is 100% secure. If you suspect account compromise, contact us immediately and change your PIN in the app when available.

9. Retention

• Active accounts — kept while your agent account remains open and for a reasonable period afterward to handle disputes and legal duties
• OTP challenges — short-lived; expired or consumed challenges are not kept as working credentials
• Audit / security logs — retained as needed for security and compliance
• Bank / KYC records — retained as required by law and banking partner obligations even after an app-level deletion request, where we are not permitted to erase them yet

10. Your rights & deletion

Subject to Tanzanian law, you may request to:

• Access the personal data we hold about you
• Correct inaccurate profile information
• Delete your FLOTIKA account and associated data we control
• Ask questions about how we process your data

Account deletion instructions: https://flotika.co.tz/delete-account

We aim to complete verified deletion requests within 30 days. Some records may be retained where the law or a banking partner requires it; those records are restricted and not used for marketing.

11. Children

FLOTIKA is built for adult mobile-money agents. It is not directed at children under 18. We do not knowingly create accounts for minors. If you believe we have data about a minor, contact us and we will take appropriate steps.

12. Changes

We may update this policy as the product or legal requirements change. The "Last updated" date at the top will change when we do. Material changes will be reflected on this page; continued use after an update means you should review the revised policy.

13. Contact

Privacy and data requests:
Email: contact@flotika.co.tz
Support: support@flotika.co.tz
General: info@flotika.co.tz

Operator: Pedima · Product: FLOTIKA · Country: United Republic of Tanzania

Related: Terms of use · Delete account