Privacy Policy

1. Who We Are

Declara is an AI-powered tax compliance app for small and medium business owners in Rwanda, operated by Declara Ltd. Our platform, available on the web and as a mobile app, helps business owners monitor their EBM (Electronic Billing Machine) accounts, track their VAT position, prepare and file their VAT declarations with RRA through the MyRRA and eTax portals, and declare their trading license through the local government taxes portal. You can also chat with our AI assistant inside the app or on WhatsApp.

Declara Ltd is a private company. Declara is not operated by, affiliated with, or endorsed by the Rwanda Revenue Authority (RRA) or any government body.

Contact: info@declara.rw Address: Birembo, Kigali, Rwanda

2. What This Policy Covers

This policy explains what personal data we collect, why we collect it, how we use it, how we protect it, and what rights you have under Rwanda's Law No. 058/2021 on Protection of Personal Data and Privacy.

By using the Declara platform, you agree to the practices described in this policy.

3. Data We Collect

3.1 Data You Provide Directly

• Full name and business name
• Rwanda TIN (Taxpayer Identification Number)
• Email address
• MyRRA portal password, which is also the password you use to sign in to Declara
• eTax portal password (optional, only if different from MyRRA)
• Local government taxes portal password (optional, only if you use the trading license feature)
• Mobile money number you enter when you pay for a subscription with MTN Mobile Money
• Answers you give about your business to tailor your VAT filing (whether you sell to government institutions and whether you import goods)
• Messages you send to our support team, and the phone or WhatsApp number you give us for the reply
• WhatsApp number (optional, only if you choose to chat with the assistant on WhatsApp)
• Language preference (English, Kinyarwanda, or Kiswahili)

3.2 Data Collected From the RRA Portal on Your Behalf

With your authorisation (by providing your portal credentials), we access your MyRRA, eTax and local government taxes portal accounts and collect:

• Sales invoice records (invoice number, date, buyer TIN, amounts, VAT)
• Purchase invoice records (invoice number, date, supplier TIN, amounts, VAT)
• Tax declaration history (periods, due dates, submission dates, status)
• Payment records (amounts due, paid, and outstanding balances)
• eTax notices and assessments
• Trading license records (business units, quarters, amounts, status)
• Taxpayer profile information (name, email, phone number, registered tax types)

3.3 Data Generated by the Platform

• VAT position calculations and summaries
• Compliance status derived from your declaration history
• Records of declarations prepared and submitted to RRA on your behalf
• Chat conversation history with our AI assistant (in the app and on WhatsApp)
• Usage statistics about assistant conversations (language, response time, which tools were used, and any feedback you give on an answer)
• Subscription and payment records (plan, amount, date, payment method, payment reference, status)
• Records of each data sync and each filing attempt

3.4 Technical Data

• Login history: date and time, IP address, browser or device type, and an approximate location (country, region, city) looked up from the IP address on our own server
• Session tokens
• Error logs (for debugging and service improvement)

3.5 Data Stored on Your Device

The mobile app keeps your TIN and password in your phone's secure storage so that you stay signed in. They are removed from the device when you sign out.

4. Why We Collect This Data

We collect and process your data for the following purposes:

• Accessing your RRA account on your behalf - based on your explicit consent (providing credentials)
• Preparing and submitting your VAT declarations to RRA when you choose to file - based on your explicit consent
• Preparing and submitting your trading license declaration when you choose to file - based on your explicit consent
• Calculating your VAT position - to perform the core service
• Operating the AI assistant, in the app and on WhatsApp - to perform the core service
• Processing your subscription payments - to perform our contract with you
• Answering your support requests - to perform the core service
• Keeping your account secure and detecting unauthorised sign-ins - legitimate interest
• Improving our platform and fixing errors - legitimate interest
• Keeping billing and accounting records - legal obligation
• Complying with Rwandan law - legal obligation

We do not use your data for advertising, profiling, or any purpose beyond what is listed above.

5. How We Protect Your Data

5.1 Credential Encryption

Your MyRRA, eTax and local government taxes portal passwords are encrypted using Fernet symmetric encryption (AES-128-CBC with HMAC-SHA256) before being stored in our database. The encryption key is stored separately from your data and is never written to the database.

5.2 Data in Transit

All data transferred between your device and our servers is encrypted using HTTPS/TLS.

5.3 Access Controls

Only authorised Declara Ltd personnel with a legitimate need can access your data. Support staff may view your account to help you and may correct entries in your VAT working data inside Declara. Staff actions are recorded in an audit log.

5.4 Server Security

Our servers are hosted in Rwanda. We apply security updates regularly and restrict public access to only the ports required for our service.

6. Data Sharing and Third Parties

We do not sell your data. We do not share your data with advertisers or marketing companies.

6.1 AI Processing (Google Gemini)

Our AI assistant is powered by Google's Gemini API. When you use the chat feature, a summary of your account data (VAT balance, upcoming deadlines, recent invoices) is sent to Google's API to generate a response. This data is processed under Google's data processing terms. We minimise the data sent to Google to only what is necessary to answer your question.

6.2 WhatsApp Messaging (Meta)

If you connect WhatsApp, messages you send to and receive from the assistant are delivered through the WhatsApp Business Platform operated by Meta. Meta processes your WhatsApp number and message content to deliver these messages. We only enable this channel after you explicitly connect your WhatsApp number from the app.

6.3 Payment Providers (MTN Rwanda and IremboPay)

Subscription payments are processed by MTN Rwanda (Mobile Money) and IremboPay. To request a payment we send the provider the amount, a payment reference and, for Mobile Money, the mobile money number you entered. Card or bank details you enter on IremboPay's payment page are handled by IremboPay and never reach our servers.

6.4 Rwanda Revenue Authority

When you file a declaration through Declara, the declaration and its annexes are submitted to RRA through your own portal account.

6.5 IP Geolocation

To record roughly where a sign-in came from, we look up the IP address of the sign-in in a geolocation database (DB-IP) held on our own server, which gives a country, region and city. The IP address is not sent to any third party.

6.6 Push Notifications (Expo, Apple and Google)

If you allow notifications on the mobile app, we send deadline reminders and filing confirmations through the push service of Expo (650 Industries, Inc., United States), which hands them to Apple (iPhone) or Google (Android) for delivery to your device. Expo receives your device's push token and the text of the notification (for example the tax type, period, due date or amount to pay), deletes the notification once it has been handed over, and keeps the token only to address your device. Notifications never contain your passwords or your TIN. You can turn them off at any time in your phone's settings.

6.7 Error Reporting (Sentry)

When the app or our servers hit an error, a report with the technical details (what failed, the device and app version, and the steps leading up to the error) is sent to Sentry, an error-monitoring service operated by Functional Software, Inc. in the United States. Passwords and TINs are removed before a report is sent, reports never contain your invoices or messages, and Sentry deletes them after 90 days.

6.8 Legal Requirements

We may disclose your data if required to do so by Rwandan law, a court order, or a lawful request from a regulatory authority including RRA or NCSA.

6.9 Business Transfers

If Declara is acquired or merges with another company, your data may be transferred as part of that transaction. We will notify you before this happens.

7. International Data Transfers

Some of our processors - Google (AI processing), Meta (WhatsApp messaging), Expo, Apple and Google (push notifications) and Sentry (error reporting) - are based outside Rwanda, in the United States. Each of them receives only the data described in section 6 and is bound by written terms that restrict how it may use it. When your data is transferred to them, we ensure that appropriate safeguards are in place consistent with Rwanda's data protection law.

8. Data Retention

We keep your account and profile data for as long as your Declara account is active.

We retain invoice and tax data synced from RRA while the linked business account is active. During periodic sync, we remove sales and purchase records that fall outside our sync window.

Tax declarations, payments, and eTax notices are kept while the linked business account remains active.

Your MyRRA, eTax and local government taxes portal credentials are stored in encrypted form while the linked business account is active.

Subscription and payment records, login history, and records of syncs and filings are kept while your account is active and after deletion as described below.

Chat conversation history is stored while the linked business account is active.

Authentication tokens expire after 30 minutes. We do not store session tokens on our servers beyond what is needed for authentication.

Error and system logs are kept for up to 90 days for security monitoring and service improvement.

8.1 When You Delete Your Account

You can delete your account in the app (Account, then Settings, then Delete account) or by writing to info@declara.rw.

When you delete your account, we permanently delete:

• Your portal passwords
• All invoices, declarations and other tax data synced from the portals
• Your chat messages with the assistant
• Your WhatsApp connection
• Your name, email address and phone number

Any active subscription is cancelled and you are signed out.

We keep a limited record after deletion:

• Your TIN
• Subscription and payment records
• Login history
• Records of syncs and filings carried out for you
• The text of support requests you sent, with your contact number removed
• Usage statistics about assistant conversations, without the message text

We keep this record for accounting, tax, security and fraud-prevention purposes and to handle disputes. If you come back to Declara with the same TIN, it is linked to your new account. You can ask us to erase this record by writing to info@declara.rw, and we will do so unless the law requires us to keep it.

9. Your Rights

Under Rwanda's Law No. 058/2021, you have the following rights:

• Right to access - request a copy of the personal data we hold about you
• Right to correction - ask us to correct any inaccurate data
• Right to deletion - delete your account in the app, or ask us to delete your data within 30 days, except where required by law
• Right to withdraw consent - you can revoke our access to your RRA account at any time by deleting your account; this will not affect data already collected
• Right to object - object to processing based on legitimate interest
• Right to data portability - request your data in a machine-readable format

To exercise any of these rights, contact us at info@declara.rw. We will respond within 15 business days.

10. Cookies and Tracking

Our platform uses only technically necessary cookies required for authentication and session management. We do not use tracking cookies, advertising cookies, or analytics that identify you personally.

11. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will post the updated version here and change the date at the top of this page. Where a change significantly affects your rights, we will also notify you in the app or by email.

12. Contact Us

Declara - operated by Declara Ltd Birembo, Kigali, Rwanda info@declara.rw

If you are not satisfied with our response, you have the right to lodge a complaint with Rwanda's National Cyber Security Authority (NCSA) at www.ncsa.gov.rw.

This privacy policy is governed by the laws of Rwanda, including Law No. 058/2021 on Protection of Personal Data and Privacy.