Privacy Policy

This policy explains how Trustplot (trustplot.hopetuyishime.com) handles personal data. We wrote it with Rwanda's data protection law (Law No 058/2021 of 13/10/2021) in mind. Trustplot decides how this data is used and is responsible for it.

It works alongside our Terms of Use (version 0.1). Questions or requests: [contact email].

• Account details: your email address, your name if you give one, your password (stored only as a secure hash, never in readable form), and which version of the Terms of Use you agreed to and when.
• What you look up: the UPIs, points and areas you search or analyse, so we can return results. Site screening results are stored by parcel, not linked to your account.
• Usage data: which features you use, for example searching a plot, saving a property or downloading a report. It is linked to your account number, not your email, and can include the UPI you searched or viewed.
• Technical data: IP address, browser and device type, the time of requests and error details, kept in server logs.

We do not collect landowners' names, ID numbers or dispute records, and we do not ask for ID, payment or bank details.

Saved properties, recently viewed properties, your notes, and settings such as language and theme are stored in your browser, not on our servers. They stay there until you clear them or your browser data.

Uploaded survey files are read in memory for one analysis and then discarded. We keep no copy.

• To create and secure your account and sign you in.
• To return search, analysis and report results.
• To see which features are used and to fix problems, using usage and technical data.
• To keep the service secure and prevent abuse such as scraping.
• To tell you about important changes to the service or these policies.
• To meet legal obligations, such as a lawful request from a Rwandan authority.

If we ever want to use your data for something else, such as a newsletter, we will ask for your consent first.

We use one essential cookie to keep you signed in. Page scripts cannot read it, and it is removed when you log out or expires after a short time.

For product analytics we use PostHog, set up to record only specific actions (such as a search, with the UPI searched) and page addresses with parcel numbers removed. It does not record your screen, keystrokes or form contents, and it keeps its identifier in your browser's session storage rather than a cookie. We also use Vercel Web Analytics, which counts page visits without cookies.

We do not use advertising or tracking cookies.

Trustplot runs on cloud providers: the website on Vercel, the application and database on Render, and analytics on PostHog. These providers may store and process data outside Rwanda, including in the United States or the European Union.

Using these providers means your data is transferred outside Rwanda. We chose established providers that protect data with security measures and contracts.

• Account details: while your account is open. When you ask us to delete your account, we delete these details within 30 days.
• Usage data: deleted together with your account when you ask us to delete it.
• Server logs: kept by our hosting providers for a limited period that they set.

We may keep some information longer where the law requires it.

We do not sell or rent personal data, and we do not share it for advertising.

We share data only with the service providers named above, which process it for us under our instructions, and with authorities where Rwandan law requires it. If Trustplot is ever merged or sold, we will tell you before your data moves under a different policy.

You can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that is wrong;
• delete your data;
• stop or limit a particular use of your data;
• give you your data in a format you can take elsewhere;
• stop a use you agreed to, if you change your mind.

To use any of these rights, email [contact email] from the address on your account. We may need to confirm it is you, and we will reply within 30 days. If you are not happy with our answer, you can contact the National Cyber Security Authority (NCSA), which oversees data protection in Rwanda.

We protect data with reasonable safeguards, including encrypted connections, hashed passwords, a sign-in cookie that page scripts cannot read, and limited access to our systems.

No system is perfectly secure. If a breach puts your personal data at serious risk, we will tell you, and report it to the authorities where the law requires.

Trustplot is not meant for anyone under 18, and we do not knowingly collect children's data. If you think a child has created an account, contact us and we will delete it.

Each version has a number and a date at the top of this page. For important changes, we will tell account holders before the change takes effect.

Privacy questions and requests: [contact email].