Privacy policy

This policy explains what personal data Yewogen Derash collects, why we collect it, and the choices you have. We collect only what we need to verify identities, process donations and payouts, and keep the Platform safe.

1. Data we collect

• Account details — name, email, and phone number.
• Verification data — government identity documents and a live face capture, for campaign owners only.
• Payout details — bank or transfer information, accessible only to authorised administrators.
• Transaction records — donations and payouts associated with the relevant campaign.
• Technical data — limited log data such as IP address for security, fraud prevention, and audit purposes.

2. Biometric data & consent

A live face capture is used solely to verify a campaign owner's identity against their submitted documents. It is collected only with explicit consent recorded during onboarding, stored securely in a private, access-controlled location, and is never used for advertising or sold to third parties.

3. How we use your data

• To verify identities and prevent fraud and abuse.
• To process donations and administer payouts.
• To send transaction and campaign notifications you opt into.
• To maintain security, audit trails, and legal compliance.

4. Service providers

We share data only with the processors needed to run the Platform, under their respective terms: our database and file storage provider (Supabase), our payment gateway (Chapa) to process donations, and a messaging provider to deliver notifications you opt into. We do not sell your personal data.

5. Data retention

We keep personal and transaction data for as long as your account is active and as required to meet legal, accounting, and fraud-prevention obligations. Verification documents are retained only as long as needed to support the integrity of the campaigns they relate to.

6. Storage & security

Identity documents are stored in a private, access-controlled bucket and are never exposed through public URLs. Access is limited to authorised administrators and is logged. Sensitive credentials are held server-side only.

7. Your rights

You may request access to, correction of, or deletion of your personal data, and may withdraw consent for optional processing such as notifications, subject to legal record-keeping requirements. To make a request, use our contact page.

8. Children

The Platform is not directed to individuals under 18, and we do not knowingly collect their personal data.

9. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by an updated “Last updated” date above.

10. Contact

For any privacy question or request, reach us through our contact page.