Privacy policy

Version 2026-10-23. Draft, to be reviewed by counsel. This policy completes the privacy policy of pay.fosiarw.com for the Fosia Connect service.

Who is responsible

Fosia Ltd, Kigali, Rwanda (infos@fosiarw.com), under Rwanda Law No 058/2021 on the protection of personal data and privacy.

What we keep, and why

• Your account: business name, contact e-mail, the versions of these terms and of this policy you accepted, and when — to provide the service and prove your consent.
• Your PawaPay key: encrypted (AES-256-GCM) before it is stored, never stored or logged in plain text, never sent to the assistant; only its last 4 characters are shown — to call PawaPay for you.
• Your transactions: references, amounts, statuses and, for deposits and payouts, the payer's or payee's phone number — to show you your activity and reconcile it. PawaPay's callbacks are kept for audit.
• Your assistant conversations and their usage (tokens, cost) — to answer you, and to meter the assistant.
• Security records: sessions, rate-limit counters (hashed), a log of sensitive actions.

No advertising tracker, no analytics cookie. The cookies are strictly necessary: your session (HttpOnly, Secure, SameSite) and a form-protection cookie.

Who processes data for us, and where

• Hostinger International — server hosting, France (Paris).
• PawaPay — your own provider, under your own contract with them; we call it with your key.
• Anthropic PBC — the assistant (United States): only what you write to the assistant and the facts its tools return, never your keys.
• BunnyWay d.o.o. (Bunny Storage) — encrypted off-site backups (European Union).
• Hostinger (pay.fosiarw.com, United States) — your Fosia account, purchases and support.

How long

• Transactions: 24 months. PawaPay callbacks: 90 days.
• Assistant conversations: 90 days. Assistant usage records: 24 months.
• Sessions: until they expire (14 days at most). One-time sign-in links: 7 days. Rate-limit counters: 24 hours. Security log: 12 months.
• Backups: hourly copies kept 10 days on our server; encrypted off-site copies kept up to 12 months.
• Your account and consents: as long as your account exists.

Your rights

From your dashboard (My data) you can export your data (a JSON file) and delete your account yourself at any time. You can also ask us to correct, restrict or object, at infos@fosiarw.com; we answer within 30 days. You may complain to the National Cyber Security Authority (NCSA) of Rwanda.