Privacy Policy

Table of Contents

1. Data Controller & Contact Information

The legal entity responsible for the collection, stewardship, and processing of your personal data under this Privacy Policy is:

2. Scope & Applicability

This Privacy Policy applies to:

• The FundMeToo Android Mobile Application distributed via the Google Play Store under the package name com.elicatetechnologies.fundmetoo.
• The FundMeToo Web Platform accessible at https://www.fundmetoo.online and any subdomains thereof.
• All users, including donors/sponsors, beneficiaries/fundraisers, organizational representatives, and visitors who browse campaigns without creating an account.

This Policy does not apply to third-party websites or services linked from FundMeToo, including but not limited to payment gateway provider portals, social media platforms, or external charity verification services. Each of those services maintains its own independent privacy policy.

3. Categories of Information We Collect

Depending on how you interact with FundMeToo (whether as a sponsor/donor, a fundraiser/beneficiary, or an organizational representative), we collect and process the following categories of information:

A. Account & Identity Data

• Full Name & Display Name: To personalize your account, verify your fundraising identity, and display donor acknowledgments on campaign pages.
• Email Address: Used for account creation, secure sign-in (via password or Google OAuth 2.0), sending transactional donation receipts, password reset links, account verification, and critical privacy policy change notices.
• Phone Number: Required for account verification, two-factor authentication (SMS/WhatsApp OTP), and routing mobile money transactions on Zambian carrier networks (MTN, Airtel, Zamtel).
• Profile Photo / Avatar: Collected when you sign in via Google Authentication (from your Google profile picture) or when you voluntarily upload an avatar to personalize your FundMeToo profile.
• Account Designation: Whether you register as a Sponsor / Investor, Beneficiary / Fundraiser, or as a representative of an accredited Organisation.
• Authentication Credentials: Hashed password (bcrypt, never stored in plaintext), OAuth refresh tokens, and session identifiers managed by Firebase Authentication.

B. Financial & Contribution Records

• Mobile Money Accounts: Mobile subscriber phone numbers provided when initiating donations or requesting verified payout disbursements (MTN Mobile Money, Airtel Money, Zamtel Kwacha).
• Donation & Pledge History: Contribution amounts in Zambian Kwacha (ZMW) or converted donor currencies, campaign IDs, dates, fulfillment deadlines, and pledge statuses (pending, fulfilled, cancelled, failed).
• Transaction Identifiers: Gateway transaction reference numbers (e.g. FUND-*, EP-*, FLW-*) generated for payment reconciliation, dispute resolution, and fraud prevention.
• Payout Records: Disbursement amounts, recipient mobile money numbers, payout dates, and settlement reference numbers for funds transferred to campaign beneficiaries.

C. Campaign Verification & Proof of Authenticity (KYC)

To maintain platform legitimacy and prevent fraudulent fundraising, beneficiaries creating campaigns may be required to upload verification documentation:

• Personal Verification:Government-issued National Registration Cards (NRC), valid passports, driver's licenses, medical records, hospital admission letters, or school enrollment confirmations.
• Organisational Verification: PACRA certificates of incorporation, official registration documents, tax clearances, and authorised board representation letterheads.
• Campaign-Specific Evidence: Photographs, medical invoices, quotations, or supporting documentation relevant to the cause being fundraised for.

D. Device, Log & Notification Identifiers

• Firebase Cloud Messaging (FCM) Push Tokens: Unique device installation identifiers generated by Google Play Services used solely to dispatch real-time heads-up notifications (donation alerts, pledge updates, campaign approval decisions, and administrative broadcasts) to your Android device.
• Device Information: Operating system version (e.g., Android 13), device manufacturer and model, screen resolution, and app build version number.
• IP Address: Collected automatically during API requests for fraud detection, rate limiting, and geographic analytics (country-level only).
• Crash Reports & Diagnostics: Stack traces, error codes, and performance timing data automatically collected via Firebase Crashlytics to identify, reproduce, and resolve technical issues.

E. User-Generated Content

• Campaign Descriptions: Text titles, detailed descriptions, categories, funding goals, and deadline dates created by fundraisers.
• Campaign Images & Media: Photographs and cover images uploaded to represent campaigns on the platform.
• Donor Messages: Optional messages or notes attached to donations by sponsors.

4. Information We Do NOT Collect

For full transparency and in compliance with Google Play's Data Safety section requirements, FundMeToo explicitly confirms that we do NOT collect, access, or process the following categories of data:

5. How & When We Collect Information

We collect personal data through the following mechanisms:

A. Information You Provide Directly

• When you create an account (email/password or Google Sign-In)
• When you complete or update your user profile
• When you create a fundraising campaign and upload supporting documentation
• When you make a donation or pledge to a campaign
• When you submit a data deletion request or contact support

B. Information Collected Automatically

• FCM push notification tokens are generated when the app is installed and notification permission is granted
• Device metadata and crash diagnostics are collected passively via Firebase SDKs
• IP addresses are logged during API calls for security and fraud prevention
• App usage analytics (screen views, feature engagement) collected via Firebase Analytics in anonymized/aggregated form

C. Information Received from Third Parties

• Google OAuth: When you sign in with Google, we receive your name, email address, and profile photo URL from Google's authentication service
• Payment Gateways: Transaction outcome status (success/failure), masked card references, and settlement confirmations from Flutterwave and ElicatePay

6. Purposes & Legal Bases for Processing Data

We process your information under defined legal bases in accordance with international data protection standards:

7. Mobile Application Permissions (Android)

The FundMeToo Android application requests the following operating system permissions on your device, strictly for necessary app functionalities. No permission is used for purposes outside what is described below:

Note: FundMeToo does not request dangerous permissions such as ACCESS_FINE_LOCATION, READ_CONTACTS, CAMERA, RECORD_AUDIO, READ_PHONE_STATE, READ_CALL_LOG, READ_SMS, or READ_EXTERNAL_STORAGE.

8. Google Play Data Safety Declaration

In accordance with Google Play's Data Safety section requirements, the following table summarizes what data types our app collects and shares, whether each data type is optional or required, and the purposes for collection:

9. Third-Party Service Providers & Sub-processors

We partner with industry-leading, verified cloud infrastructure and payment processing partners to deliver secure services. These third parties only process data in accordance with our explicit instructions and under strict contractual data processing agreements:

10. Data Sharing & Disclosure

We may disclose your personal data only in the following strictly limited circumstances:

• With your explicit consent: When you voluntarily choose to share information, such as making a public donation that displays your name on a campaign page.
• To service providers: As described in Section 9, strictly limited to what is necessary for them to perform their contracted services on our behalf.
• For legal compliance: When required by applicable law, regulation, legal process, or enforceable governmental request (e.g., a valid court order or subpoena from Zambian authorities).
• To protect rights & safety: When necessary to investigate fraud, enforce our Terms of Service, or protect the rights, property, or safety of FundMeToo, our users, or the public.
• In corporate transactions: In connection with a merger, acquisition, reorganization, or sale of assets, your data may be transferred to a successor entity subject to equivalent privacy protections.

11. Data Retention Schedule

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law:

12. Account Deletion & Data Erasure

In strict compliance with Google Play Developer Data Deletion Policies, GDPR Right to Erasure (Article 17), and the Zambia Data Protection Act, every registered FundMeToo user has the complete, unconditional right to request the permanent deletion of their account and associated personal data.

13. Security Standards & Technical Safeguards

We employ defense-in-depth technical and organizational measures to safeguard user data from unauthorized access, alteration, disclosure, or destruction:

• Transport Layer Security (TLS 1.3): All network traffic between the FundMeToo Android app, web platform, and cloud APIs is strictly encrypted using modern HTTPS/TLS 1.3 ciphers. Certificate pinning is enforced on critical endpoints.
• Encryption at Rest: All databases, documents, and media files are stored with AES-256 server-side encryption on Google Cloud Platform and Cloudflare R2.
• Password Security: User passwords are never stored in plaintext. All passwords are hashed using bcrypt with appropriate salt rounds before storage in Firebase Authentication.
• Payment Card Encryption: Card details entered in-app are encrypted client-side using Triple-DES (3DES) and transmitted directly to PCI-DSS Level 1 certified processors. Raw card data never touches our servers.
• Granular Database Access Control: Governed by strict Firebase Security Rules ensuring donors, sponsors, and fundraisers can only read or mutate documents they own or have authorization to view.
• Access Control & Authentication: Multi-factor authentication for administrative access, principle of least privilege for all service accounts, and role-based access control for internal tools.
• Continuous Monitoring: Routine administrative auditing, automated security scanning, and real-time vulnerability tracking across all microservices and infrastructure.
• Incident Response: We maintain a documented security incident response plan. In the event of a data breach affecting user personal data, affected users will be notified within 72 hours as required by applicable data protection law.

14. International Data Transfers

FundMeToo is operated by Elicate Technologies Limited, registered in Lusaka, Zambia. However, our third-party service providers may process and store data in jurisdictions outside of Zambia, including:

• United States: Google Cloud Platform (Firebase), Vercel, Cloudflare
• Nigeria: Flutterwave Inc. (payment processing)

When your data is transferred to countries outside of Zambia, we ensure that adequate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) with data processors
• Data Processing Agreements (DPAs) with all third-party providers
• Encryption of all data in transit and at rest
• Selection of providers who maintain recognized certifications (SOC 2, ISO 27001, PCI-DSS)

15. Children's Privacy (COPPA & Google Play Families Policy)

FundMeToo is a general audience crowdfunding and charitable giving platform. The service is not directed toward children under 13 years of age (or under 16 where required by local law, including the EU). We do not knowingly solicit, collect, use, or disclose personal information from children under these age thresholds.

Specifically:

• We do not target or market our services to children under 13.
• We do not use age-screening mechanisms because our platform inherently requires financial payment methods (credit cards, mobile money) which are not accessible to minors.
• If a campaign is established to support a minor (such as for medical treatments, pediatric care, or school tuition), the campaign must be created, verified, and administered solely by a parent, legal guardian, or registered educational/charitable institution.
• If we discover that an account was created by an unsupervised child under 13, we will promptly terminate the account and purge all associated personal data within 48 hours.
• Parents or guardians who believe their child has provided personal information to FundMeToo without consent should immediately contact us at privacy@fundmetoo.online.

16. Your Rights as a Data Subject

Under applicable data protection legislation (including the Zambia Data Protection Act, GDPR principles, and Google Play policies), you possess the following enforceable legal rights regarding your personal data:

To exercise any of these rights, contact us at privacy@fundmetoo.online with the subject line including the specific right you wish to exercise. We will respond to verified requests within 30 calendar days.

17. Changes to This Privacy Policy

We may periodically update this Privacy Policy to reflect enhancements in our app, new regulatory standards, changes in payment gateway partner requirements, or evolving best practices in data protection. When revisions occur:

• The revised version will be posted on this page at https://www.fundmetoo.online/privacy.
• The “Last Updated” date at the top of this document will be updated accordingly.
• Where material changes impact your rights or our data processing practices, we will provide in-app push notifications and/or email notices to all registered users at least 14 days before the changes take effect.
• Continued use of FundMeToo after the effective date of any revised Policy constitutes acceptance of the updated terms. If you do not agree with the changes, you must discontinue use of the Service and may request account deletion as described in Section 12.

18. Contact Our Privacy Office

If you have questions, feedback, grievance reports, wish to exercise any of your statutory data rights, or need to submit a data deletion request, please contact our dedicated Privacy & Legal Compliance Team: