Who this applies to.
This policy covers personal data SenteMe handles for three groups: people who create a campaign (coordinators), people who contribute to one (contributors), and visitors who browse public pages. SenteMe is operated by Mea Global Inc, a Delaware-registered corporation. Mea Global Inc is the data controller for everything described below. Where payment partners or service providers receive data, this notice describes the relevant categories of recipients and why the data is shared.
Governing law.
Mea Global Inc is a US legal entity, so this policy is governed in the first instance by US federal privacy and consumer-protection law and by the laws of the State of Delaware where the company is incorporated. Because SenteMe serves users across Africa, Europe, and other regions, additional privacy regimes apply on top of the US baseline based on where each user sits: the Uganda Data Protection and Privacy Act 2019 (and equivalent acts in Kenya, Rwanda, and the other countries we operate in) for African users; the EU and UK GDPR for European users and EU/UK residents in the diaspora; the California Consumer Privacy Act (CCPA / CPRA) for California residents. Where one of these regional regimes gives you stronger rights than the US baseline does, those stronger rights apply, local law tops US law in your favour, not the other way around.
What we collect.
When you create an account we collect your name, email, and password hash. When you create a campaign we collect the title, description, target, location, and any cover image you upload. When you contribute we collect the amount, the email address or mobile-money number used for the payment, and the name you choose to display publicly. We use protected internal identifiers and transaction records to apply fraud-prevention and risk-based verification controls without exposing contact information in public campaign data. Coordinators must complete identity and sanctions verification before withdrawal. Donors may be required to complete step-up identity and sanctions verification based on the amount, cumulative activity, or risk indicators. Verification may include a government-issued identity document, biometric liveness and face matching, device and network analysis, and AML and sanctions screening. We store the verification outcome and necessary extracted details, while specialist verification providers securely process the underlying evidence. Verification data is used for security and AML / CFT controls, never for marketing. When you visit any page, including a public event page, we log standard server access information such as IP address, user agent, page path, and timestamp for security and abuse detection. We also use privacy-protective analytics and, where configured, advertising measurement tools. Text input is masked and payment contact details are excluded from our custom analytics events. See our Cookies Notice for more information.
Why we use it.
Your email is used to send you transactional notifications about your campaign (contributions, withdrawals, milestones) and password resets. We do not send marketing email; if we ever start, you will get a clear opt-in first. Campaign content (title, description, contributor list, disbursement log) is published on the public event page that anyone with the link can see, that is the whole point of the product. Mobile-money numbers are kept private; they never appear on the public page. Server logs are kept for the minimum time we need to detect abuse and reconcile payments.
Who sees what.
Public event pages are visible to anyone with the link. Contributors who select "anonymous" appear as "Anonymous" on the public list but are still linked to their account internally so they can come back to pay a pledge or claim a refund. Coordinators and the SenteMe support team can see contributor names and emails on the dashboard for their own events. We do not share contributor lists with other campaigns, sell them to third parties, or use them for marketing on other platforms.
Who we share data with.
We share only the data necessary with defined categories of recipients: licensed payment and mobile-money providers that process contributions and payouts; identity, fraud-prevention, AML and sanctions-screening providers; cloud hosting, database and security providers; transactional email providers; and privacy-protective analytics or advertising measurement providers where those tools are enabled. Payment providers receive the contact, amount and reference information needed to process the transaction. Verification providers receive the identity evidence and account details needed to complete the requested checks. Analytics events exclude names, contact details, payment references and exact contribution amounts. We do not sell personal data. If a binding legal order requires disclosure to a government or law-enforcement agency, we will comply and, where the law allows, tell you first. You may contact [email protected] for more information about the providers applicable to your data.
Where we store it.
Account, campaign and transaction data is processed using cloud infrastructure in the European Union and other locations used by our service providers and payment corridors. Payment data may also be processed in the country of the relevant payment method. Database backups are encrypted and retained for thirty days. As a US-incorporated entity, Mea Global Inc uses standard contractual clauses and equivalent lawful transfer safeguards where personal data moves between countries, including data covered by EU or UK GDPR and applicable African data-protection laws.
How long we keep it.
Account data is kept for as long as you have an active account. Closed accounts are anonymised within ninety days, except where we need to keep specific records longer for accounting, tax, or anti-fraud reasons (typically seven years for transaction records). Public event pages and their contributor lists remain visible after the event ends so contributors can return to them; coordinators can request that a specific event be taken down via support.
Your rights.
Wherever you live, you can ask us to: tell you what we have on you, correct anything that is wrong, delete your account (subject to the retention rules above), or export a copy of your data in a standard format. Email [email protected] to make any of these requests; we aim to respond within thirty days. On top of this baseline, your local privacy regime may give you additional rights. Users in Uganda have the rights granted by the Data Protection and Privacy Act 2019, including access, rectification, erasure, objection, and complaint to the Personal Data Protection Office. Users in Kenya have the rights granted by the Data Protection Act 2019 (access, correction, deletion, objection, complaint to the ODPC). Users in Rwanda have the rights granted by Law N° 058/2021. Users in the EU and UK have the rights granted by GDPR and UK-GDPR (access, rectification, erasure, restriction, objection, portability, and complaint to your data-protection authority). Users in California have the rights granted by CCPA / CPRA. We honour the strongest rights you are entitled to under any law that applies to you, not the weakest.
Cookies and similar.
Cookies support sign-in, preferences and security. You can manage cookies in your browser; blocking essential cookies can affect sign-in. When enabled, analytics and advertising measurement tools help us understand product usage, visits and conversions. Our custom contribution events exclude names, contact details, payment references and exact amounts.
Security.
We use access controls, encryption, password hashing, environment-separated secrets, audit records and other organisational and technical safeguards appropriate to the sensitivity of the data. Access is limited to authorised people and systems that need it for a defined purpose. If we confirm a security incident involving personal data, we will notify affected users and regulators within the period required by applicable law.
Children.
SenteMe is intended for users 18 and older. We do not knowingly collect personal data from anyone under 18. If you become aware that a minor has created an account on SenteMe, email us and we will close the account and delete the data.
When we change this policy.
When we make a substantive change, a new category of data, a new partner, a new use, we will email all coordinators and post a banner on the dashboard at least seven days before the change takes effect. Less material edits (clarifications, typos) take effect when we publish them. The "Last updated" date at the top of this page changes any time the page changes.
How to reach us.
Email [email protected] for any privacy question, data-export request, formal access / rectification / erasure / restriction / objection / portability request, supervisory-authority complaint, or to report a suspected misuse of your data. The inbox is monitored by our Data Protection Officer and the compliance team. For account-specific issues sign in to SenteMe first so we can verify it is you asking before we act on the request.
