This Privacy Policy explains how Sephil Sapphire ("we", "us", "our") collects, uses, and protects your information when you use our website (sephilsapphire.co.tz), our mobile application, or interact with us to book an event hall or related services. It applies equally to the web platform and the mobile app, since both connect to the same account and booking system.
1. Information We Collect
We collect the following categories of information:
- Account information: full name, phone number, and, optionally, email address, alternate phone number, and physical address, when you register or book with us.
- Identity verification (optional): for certain bookings we may ask for an ID type and number (passport, national ID, or driving licence), used only to confirm your identity for the booking.
- Booking and event details: hall, date, time, guest count, catering/decoration/service selections, special requests, and e-card/ticket/RSVP information for your guests where applicable.
- Payment information: we do not store your card or mobile money details. Payments are processed by our licensed payment partner, Pesapal; we only keep the payment status, amount, and transaction reference they return to us.
- Photos and videos you choose to upload: for example, event photos, hall or package images, or short event videos, when you pick a file from your device using the upload feature in the app or admin tools.
- Communications: messages you send us, and SMS, WhatsApp and email notifications we send you about your bookings, via our messaging providers.
- Sign-in details: your email address and password when you sign in. The password is stored on our servers only in hashed (one-way encrypted) form.
- Technical information: standard web server logs (IP address, browser type) for security and troubleshooting. Our mobile app does not use analytics, advertising, crash-reporting or location-tracking services, and does not read your contacts.
2. How We Use Your Information
- To create and manage your account, and to process, confirm, and manage your bookings.
- To process payments through our payment partner and send you invoices, quotations, and receipts.
- To send booking confirmations, reminders, and updates by SMS or email.
- To respond to your enquiries and provide customer support.
- To maintain the security of our systems and prevent fraud or abuse.
- To improve our services based on how they're used.
3. How We Share Your Information
We do not sell your personal information. We only share it with:
- Pesapal, our payment gateway, to process payments you initiate.
- Our SMS provider and our WhatsApp Business messaging provider (360dialog), to deliver booking-related messages to your phone number.
- Our staff and administrators, strictly for the purpose of managing your booking.
- Authorities, where required by Tanzanian law.
When you choose to share something yourself (for example an invoice, ticket or report through your phone's Share menu, or a call, email, map or WhatsApp link from the app), the information goes to the app you choose. We do not control those apps.
4. Data Stored on Your Device (Web & App)
To keep you signed in and remember your preferences, our website and app store a small amount of data locally on your own device — not on our servers — including:
- Your login session (access token), stored securely on-device (Android encrypted storage / iOS Keychain in the mobile app).
- If you tick "Remember me": your email address and your password, so the sign-in form can be pre-filled. In the mobile app the password is kept in secure storage, and clearing "Remember me" or signing out of that option removes it.
- If you turn on fingerprint / face sign-in (mobile app): your email, password and account type are kept in secure storage so your device can sign you in after it verifies you. See "Biometric sign-in" below.
- Your theme preference (light/dark mode) and language choice.
- The server environment the app is using (a technical setting) and a short local record that you declined the fingerprint prompt, so we do not keep asking.
- Cached colors/branding, so pages load without flashing unstyled content.
- For safety, the mobile app signs you out automatically after about five minutes without activity.
We do not use third-party advertising cookies, tracking pixels, or analytics SDKs on the website or in the mobile app.
5. Mobile App Permissions
The Sephil Sapphire mobile app only requests access it actually needs:
- Internet access — required to connect to our booking system.
- Biometric (fingerprint / face) authentication — only if you enable it, to unlock sign-in on your device. The app never receives or stores your fingerprint or face data; your phone's operating system checks it and only tells the app whether it matched.
- Photo / video picker — only when you choose to upload or attach a photo or video (for example, to an event gallery); the app never accesses your photos without you actively picking one. On iOS the app also declares that it may use the camera to take such a photo.
The app does not request access to your location, contacts, or microphone.
Biometric sign-in
Fingerprint or face sign-in is optional and off until you accept the prompt after a successful sign-in. You can decline it, and you can turn it off later; doing so removes the saved sign-in details from your device. Your biometric data itself stays with your phone and is never sent to us.
6. Data Retention
We keep your account and booking information for as long as your account is active and for a reasonable period afterward, as needed for accounting, legal, and record-keeping purposes (for example, invoices and payment records).
7. Your Rights
You can ask us to:
- Give you a copy of the personal information we hold about you.
- Correct information that is inaccurate or out of date.
- Delete your account and associated personal information, subject to any records we're legally required to keep.
To make any of these requests, contact us using the details below. To ask for your account to be deleted, see our Account Deletion Request page.
8. Children's Privacy
Our services are intended for adults booking events. We do not knowingly collect personal information from children, except where a guest list or e-card RSVP submitted by a parent or guardian includes a child's name for event planning purposes.
9. Security
Passwords are stored encrypted (hashed), not in plain text. We use secure connections (HTTPS) between your device and our servers, and limit staff access to customer data to what's needed to do their job.
10. Changes to This Policy
We may update this Privacy Policy from time to time, for example as we add new features to the website or app. We'll update the "Last updated" date above when we do.
11. Contact Us
If you have any questions about this Privacy Policy or your data, contact us:
- Phone: +255 782 277 755
- Email: info@sephilsapphire.co.tz