Privacy Policy

1. Who We Are

Declara is an AI-powered tax compliance app for small and medium business owners in Rwanda, operated by Declara Ltd. Our platform helps business owners monitor their EBM (Electronic Billing Machine) accounts, track their VAT position, and prepare and file their VAT declarations with RRA through the MyRRA and eTax portals. You can also chat with our AI assistant inside the app or on WhatsApp.

Contact: info@declara.rw Address: Birembo, Kigali, Rwanda

2. What This Policy Covers

This policy explains what personal data we collect, why we collect it, how we use it, how we protect it, and what rights you have under Rwanda's Law No. 058/2021 on Protection of Personal Data and Privacy.

By using the Declara platform, you agree to the practices described in this policy.

3. Data We Collect

3.1 Data You Provide Directly

• Full name and business name
• Rwanda TIN (Taxpayer Identification Number)
• Email address
• MyRRA portal password
• eTax portal password (optional, only if different from MyRRA)
• WhatsApp number (optional, only if you choose to chat with the assistant on WhatsApp)
• Language preference (English, Kinyarwanda, or Kiswahili)

3.2 Data Collected From the RRA Portal on Your Behalf

With your authorisation (by providing your portal credentials), we access your MyRRA account and collect:

• Sales invoice records (invoice number, date, buyer TIN, amounts, VAT)
• Purchase invoice records (invoice number, date, supplier TIN, amounts, VAT)
• Tax declaration history (periods, due dates, submission dates, status)
• Payment records (amounts due, paid, and outstanding balances)
• eTax notices and assessments
• Taxpayer profile information (name, registered tax types)

3.3 Data Generated by the Platform

• VAT position calculations and summaries
• Compliance status derived from your declaration history
• Records of declarations prepared and submitted to RRA on your behalf
• Chat conversation history with our AI assistant (in the app and on WhatsApp)

3.4 Technical Data

• Login timestamps and session tokens
• Error logs (for debugging and service improvement)

4. Why We Collect This Data

We collect and process your data for the following purposes:

• Accessing your RRA account on your behalf — based on your explicit consent (providing credentials)
• Preparing and submitting your VAT declarations to RRA when you choose to file — based on your explicit consent
• Calculating your VAT position — to perform the core service
• Operating the AI assistant, in the app and on WhatsApp — to perform the core service
• Improving our platform and fixing errors — legitimate interest
• Complying with Rwandan law — legal obligation

We do not use your data for advertising, profiling, or any purpose beyond what is listed above.

5. How We Protect Your Data

5.1 Credential Encryption

Your MyRRA and eTax portal passwords are encrypted using Fernet symmetric encryption (AES-128-CBC with HMAC-SHA256) before being stored in our database. The encryption key is stored separately from your data and is never written to the database.

5.2 Data in Transit

All data transferred between your device and our servers is encrypted using HTTPS/TLS.

5.3 Access Controls

Only authorised Declara Ltd personnel with a legitimate need can access your data.

5.4 Server Security

Our servers are hosted in Rwanda. We apply security updates regularly and restrict public access to only the ports required for our service.

6. Data Sharing and Third Parties

We do not sell your data. We do not share your data with advertisers or marketing companies.

6.1 AI Processing (Google Gemini)

Our AI assistant is powered by Google's Gemini API. When you use the chat feature, a summary of your account data (VAT balance, upcoming deadlines, recent invoices) is sent to Google's API to generate a response. This data is processed under Google's data processing terms. We minimise the data sent to Google to only what is necessary to answer your question.

6.2 WhatsApp Messaging (Meta)

If you connect WhatsApp, messages you send to and receive from the assistant are delivered through the WhatsApp Business Platform operated by Meta. Meta processes your WhatsApp number and message content to deliver these messages. We only enable this channel after you explicitly connect your WhatsApp number from the app.

6.3 Legal Requirements

We may disclose your data if required to do so by Rwandan law, a court order, or a lawful request from a regulatory authority including RRA or NCSA.

6.4 Business Transfers

If Declara is acquired or merges with another company, your data may be transferred as part of that transaction. We will notify you before this happens.

7. International Data Transfers

Some of our processors — including Google (AI processing) and Meta (WhatsApp messaging) — are based outside Rwanda. When your data is transferred to them, we ensure that appropriate safeguards are in place consistent with Rwanda's data protection law.

8. Data Retention

We keep your account and profile data for as long as your Declara account is active.

We retain invoice and tax data synced from RRA while the linked business account is active. During periodic sync, we remove sales and purchase records that fall outside our sync window.

Tax declarations, payments, and eTax notices are kept while the linked business account remains active.

Your MyRRA and eTax portal credentials are stored in encrypted form while the linked business account is active.

Chat conversation history is stored while the linked business account is active.

Authentication tokens expire after 30 minutes. We do not store session tokens on our servers beyond what is needed for authentication.

Error and system logs are kept for up to 90 days for security monitoring and service improvement.

When you delete a linked business account, we permanently delete your portal credentials and all synced tax data, chat history, and other records associated with that account.

9. Your Rights

Under Rwanda's Law No. 058/2021, you have the following rights:

• Right to access — request a copy of the personal data we hold about you
• Right to correction — ask us to correct any inaccurate data
• Right to deletion — ask us to delete your data within 30 days, except where required by law
• Right to withdraw consent — you can revoke our access to your RRA account at any time by deleting your account; this will not affect data already collected
• Right to object — object to processing based on legitimate interest
• Right to data portability — request your data in a machine-readable format

To exercise any of these rights, contact us at info@declara.com. We will respond within 15 business days.

10. Cookies and Tracking

Our platform uses only technically necessary cookies required for authentication and session management. We do not use tracking cookies, advertising cookies, or analytics that identify you personally.

11. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will notify you via email at least 14 days before the change takes effect. The date at the top of this page always shows when the policy was last updated.

12. Contact Us

Declara — operated by Declara Ltd Birembo, Kigali, Rwanda info@declara.rw

If you are not satisfied with our response, you have the right to lodge a complaint with Rwanda's National Cyber Security Authority (NCSA) at www.ncsa.gov.rw.

This privacy policy is governed by the laws of Rwanda, including Law No. 058/2021 on Protection of Personal Data and Privacy.