Privacy policy

Last updated: [DATE]

Template: this wording is a starting point. Fill in the bracketed details and have it reviewed by a Ugandan lawyer before launch.

TTu is an AI search app operated by Hadtah, a company registered in Uganda ([URSB registration number], [physical address], Kampala). Hadtah is the data controller for TTu. This policy explains what personal data we collect, why, and your rights under the Data Protection and Privacy Act, 2019 of Uganda and its Regulations (2021). Hadtah is registered with the Personal Data Protection Office (PDPO) under registration number [PDPO number].

1. Who can use TTu

TTu is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

2. Data we collect

Account data: your Gmail address, used to sign you in with a one-time code.
Usage data: the questions you ask, the answers and source links TTu returns, the number of questions you ask each day and the PDFs you download, so we can apply the daily and download limits.
Payment data: if you subscribe, our payment processor Flutterwave handles your card or mobile money details. We receive only the transaction reference, amount, currency and status — never your full card number or mobile money PIN.
Technical data: IP address and basic device/browser information, used for security and to prevent abuse.

3. Why we use it (lawful basis)

To provide the service you asked for (performance of our agreement with you).
To enforce fair-use limits, prevent fraud and keep TTu secure (legitimate interest).
To keep accounting and tax records (legal obligation).

4. Who we share it with

We do not sell your personal data. We share only what is necessary with service providers acting for us: our hosting provider [HOSTING PROVIDER], our email provider [Resend/SMTP provider] to send sign-in codes, Flutterwave for payments, and our AI provider (Google Gemini API) which receives your question and the public source text to write the answer. Your questions are also sent as search terms to open sources such as Wikipedia, OpenAlex, arXiv, Crossref, Bluesky, Mastodon, Reddit and YouTube.

5. Transfers outside Uganda

Some providers process data outside Uganda. Where this happens we rely on safeguards required by section 19 of the Act, such as the provider's data protection commitments.

6. How long we keep it

Account data is kept while your account is active. Questions and answers are kept for [12 months] so you can see your history, then deleted. Payment records are kept for the period required by Ugandan tax law. Sign-in codes expire after 10 minutes.

7. Your rights

Under the Act you may ask to access your data, correct it, have it deleted, object to processing, and know how it is used. Email privacy@hadtah.com. We will respond within the time set by law. You may also complain to the Personal Data Protection Office (pdpo.go.ug).

8. Security

Sign-in codes are stored only as one-way hashes, sessions use secure cookies, and connections use HTTPS. No system is perfectly secure, and we will notify the PDPO and affected users of any breach as the law requires.

9. Contact

Hadtah, [address], Kampala, Uganda · privacy@hadtah.com · [phone]