Privacy Policy

This Privacy Policy explains how [Company legal name], [registered address] ("Sela", "we", "us") collects, uses and protects personal data when you use the Sela website, Telegram bot and mini app (the "Platform"). We process personal data in line with the applicable Ethiopian law on personal data protection. [Counsel to name the applicable law and Sela's registration, if any, with the data protection authority.]

1. Data we collect

• Account data: email address, password (stored only as a secure hash), username, referral details, and your preferences (for example where security codes should be sent).
• Sign-in and security data: IP address, browser and device information, sign-in history, a cookie that remembers trusted devices, authenticator app settings (encrypted), passkey public keys, recovery codes and your security key (stored only as hashes), your anti-phishing code, and if you connect them, your Google account identifier and Telegram account identifier.
• Identity verification data: your full legal name, the type and number of your identity document (the number is encrypted, and a keyed fingerprint of it is kept to stop one document verifying several accounts), photos of the document, a live selfie, and the short liveness frames captured during the face check.
• Payment account data: the names and numbers of the Telebirr, M-Pesa and bank accounts you add, which are shown to your counterparties in trades.
• Trading and wallet data: ads, orders, trade chat messages and the images you send in them (such as payment receipts), dispute evidence, reviews, balances, deposits, withdrawals, transfers, and the blockchain addresses involved.
• Support and moderation data: messages with support, dispute decisions, strikes, appeals and internal notes about your account.
• Technical data: error reports from the Platform, which we use to fix problems. They do not include your password or codes.

The face check runs on your own device; only the selfie and the liveness frames are uploaded.

2. Why we use it

• To create and secure your account, sign you in, detect suspicious sign-ins and let you confirm sensitive actions.
• To verify your identity, prevent duplicate and fraudulent accounts, and apply trading limits.
• To run the marketplace: show your ads and public profile, operate escrow, process deposits, withdrawals and transfers, and keep an accurate ledger.
• To resolve disputes and enforce our Terms, including strikes, suspensions and appeals.
• To send you service messages and alerts by email, Telegram and in the app (you can turn off non-essential trade notifications; security messages are always sent).
• To meet legal obligations, including anti-money-laundering, record-keeping and requests from competent authorities.
• To keep the Platform working, secure and improving, including error monitoring and abuse prevention.

We do not sell your personal data and do not use it for third-party advertising.

3. Who can see your data

• Other users see your public profile (username, avatar, verification badge, trading statistics and reviews). Your counterparty in a trade sees the payment account details for that trade and, if you are the buyer, the seller sees your verified legal name so they can check the payment came from you.
• Sela staff see what they need for their role: identity reviewers see verification documents; moderators see trades, chats and evidence; finance staff see wallet activity. Access is role-based and logged.
• Service providers that process data for us under contract, such as: email delivery ([provider]), Telegram (for bot messages, if you connect it), Google (if you sign in with Google), Cloudflare (bot protection, and file storage if enabled), error monitoring ([provider]), and hosting ([provider and country]).
• Authorities where the law requires it, or where needed to prevent fraud or protect users.
• Public blockchains: deposits and withdrawals are recorded on public blockchains, where the addresses and amounts are visible to anyone.

Some providers may store data outside Ethiopia. Where that happens we take steps required by law to protect it. [Counsel to confirm cross-border transfer requirements.]

4. How long we keep it

We keep account, identity verification, trading and wallet records for as long as your account is open and then for [X] years after it closes, or longer if the law or an open dispute or investigation requires it. Sign-in history is kept for [X] months. Expired sessions, sign-up attempts and one-time codes are deleted automatically. [Counsel to set retention periods that meet anti-money-laundering record-keeping rules.]

5. How we protect it

Identity documents, chat images and dispute evidence are encrypted before they are stored, and can only be opened by you, your trade counterparty where relevant, and authorised staff. Identity numbers and authenticator secrets are encrypted; passwords, recovery codes and security keys are stored only as hashes. Connections use HTTPS, sessions use secure cookies, and staff accounts must use two-factor authentication. No system is perfectly secure, so please protect your own account too.

6. Cookies and similar storage

We use cookies that are necessary for the Platform: a session cookie that keeps you signed in, a device cookie that remembers trusted devices for 30 days, and short-lived cookies used during sign-up and Google sign-in. Your browser also stores your light or dark theme choice. We do not use advertising cookies.

7. Your rights

Subject to the law, you can ask to access the personal data we hold about you, correct it, or delete it, and you can object to or ask us to restrict some processing. Some data cannot be deleted while your account is open or while we must keep it by law. You can update much of your data yourself in Settings. To make a request, email [email protected] from the address on your account; we may ask for your security key or other proof of identity first. You may also complain to the competent data protection authority.

8. Children

The Platform is not for anyone under 18, and we do not knowingly collect their data.

9. Changes to this policy

We may update this policy. The date of the latest version is shown at the top. For material changes we will tell you by email or in the app.

10. Contact

Questions about this policy or your data: [email protected]. Data protection contact: [name / role, address].