Privacy Policy
Effective 9 October 2026 · Ganza Lab Ltd
Who we are
Teza is a point-of-sale and business management app for shops, made and run by Ganza Lab Ltd, a company registered in Rwanda and based in Kigali. In this policy, “Teza”, “we” and “us” mean Ganza Lab Ltd.
This policy covers the Teza mobile and desktop apps, the website teza.rw, and the messages we send for Teza: codes, alerts, invitations, receipts and reminders. It explains what personal data we handle, why, who we share it with, and the choices you have.
Questions or requests: valentin@teza.rw.
What we collect
We collect what you give us when you use Teza, what your shop records in it, and a small amount of technical data needed to keep accounts secure.
| Kind of data | Examples | Where it comes from |
|---|---|---|
| Account | Name, phone number, email (optional), password (stored only as a one-way hash), language | You, at sign-up and in Account settings |
| Business | Business and shop names, TIN, addresses, logo, document settings, plan and billing status | The business owner |
| Team | Team members’ names, phone numbers, roles, permissions, invitations, activity in the app | The owner or managers who invite them, and the members themselves |
| Business records | Products, prices, stock, sales, payments, refunds, quotes, layaways, expenses, bills, money accounts, reports, and attachments such as receipt photos | People working in the shop |
| Customers, suppliers and partners | Names, phone numbers, emails, TINs, what they bought or owe, and whether they agreed to receive messages | Entered by the shop (see below) |
| Device and security | Device type and model, app version, sign-in history, IP address, push notification token, failed sign-in attempts | Your device, when you use Teza |
| Messages | Codes, alerts and documents we send, their delivery status, and replies sent to Teza’s WhatsApp number | Our messaging providers |
We do not collect your GPS location, your phone’s contact list (unless you choose to import contacts) or payment card numbers.
How we use it
- To provide Teza: run your account, your shops and your records, and show each team member what their role allows. This is necessary to perform our contract with you.
- To keep accounts safe: verify phone numbers and emails, confirm new devices, detect unusual sign-ins and tell you about important changes such as a new password. This is our legitimate interest and yours.
- To send what you ask for: receipts, invoices, statements, invitations and reminders, sent only when a person in the shop chooses to send them, and to customers only where the shop has their consent.
- To support you: answer questions and fix problems you report.
- To improve Teza: understand which features are used and where the app fails, using technical logs.
- To meet legal duties: keep records required by tax and company law, and respond to lawful requests from authorities.
We do not sell personal data, and we do not use it for advertising.
Data shops enter about their customers
A shop using Teza decides what it records about its own customers, suppliers and partners. For that data, the shop is the data controller and Ganza Lab Ltd processes it on the shop’s behalf, only to provide Teza. If you are a customer of a shop and want to see, correct or delete what it holds about you, contact the shop first. We will help the shop answer you.
A shop can remove a customer’s personal details from Teza. Records that tax law requires the shop to keep, such as issued invoices, stay but no longer show the person’s details where the law allows.
How we send messages
Teza sends messages through these channels, in this order of preference:
- WhatsApp, through the WhatsApp Business Platform of Meta Platforms, Inc. and its affiliates.
- Email, when you have added and confirmed an email address.
- SMS, only where a process cannot continue without it: a sign-in or verification code you choose to receive by SMS, a team invitation, or a critical account-security alert that could not be delivered another way. SMS is sent through Twilio Inc.
- Push notifications in the app, through Google Firebase Cloud Messaging and Apple Push Notification service. You can turn these off in your device settings or in Teza’s notification settings.
When you message Teza’s WhatsApp number, we receive your phone number, your WhatsApp profile name and your message, and use them to answer you and to deliver codes you asked for.
Who we share data with
We share personal data only as needed to run Teza:
- Service providers who work for us under contract: cloud hosting, messaging (Meta for WhatsApp, Twilio for SMS and email), push notifications (Google, Apple) and exchange rates (no personal data). They may use the data only to provide their service to us.
- Your business and team: what you record in a business is visible to its owners and to team members whose role allows it. Partner shops see only what your business chooses to share with them.
- Authorities, when Rwandan law requires it, such as the Rwanda Revenue Authority for tax records.
- A buyer of our business, if Ganza Lab Ltd is merged or sold, under the same protections as this policy.
Where data is stored
Teza’s data is stored on cloud servers run by our hosting provider, which may be located outside Rwanda. Some service providers, such as Meta, Twilio, Google and Apple, also process data outside Rwanda. Where data leaves Rwanda, we do so as allowed by Law No. 058/2021 relating to the protection of personal data and privacy, and with safeguards that protect it to the standard of that law.
How long we keep it
- Account and business data: while the account or business is active. After a business is closed, we keep its records for the period Rwandan tax and company law requires (at least 10 years for accounting records), then delete them.
- Verification codes: they expire within minutes and are deleted within a day.
- Sign-in history and security logs: up to 12 months.
- Message delivery records: up to 12 months.
- Backups: overwritten on a rolling basis within 35 days.
How we protect it
Data travels encrypted (HTTPS). Passwords are stored only as one-way hashes. Session tokens on your device are kept in the device’s secure storage. New devices must confirm a code before they can sign in, and owners are told about important account changes. Access inside Ganza Lab Ltd is limited to staff who need it to run and support Teza.
No system is perfectly secure. If a breach puts your personal data at risk, we will inform you and the National Cyber Security Authority as the law requires.
Your rights
Under Rwandan law you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct data that is wrong or incomplete;
- delete your data, unless we must keep it by law;
- stop or limit some uses of your data, or object to them;
- move your data to another service, where that is possible.
Many of these you can do yourself in the app: edit your profile in Account, export your business data in Settings, and sign out other devices in Sign-in history. For anything else, email valentin@teza.rw. We answer within 30 days. If you are not satisfied, you can complain to the National Cyber Security Authority (NCSA) of Rwanda.
Children
Teza is for businesses and is not meant for children under 18. We do not knowingly create accounts for them.
Changes to this policy
We may update this policy as Teza changes. We will post the new version here with its effective date, and tell account holders in the app or by message before important changes take effect.
Contact
Ganza Lab Ltd
Kigali, Rwanda
Email: valentin@teza.rw
Phone: +250 786 416 173
Website: teza.rw