Privacy policy

Last updated 3 November 2026

This policy explains what information LoroPay collects, why, who we share it with, and the choices you have. We collect only what we need to run payments and keep a reliable record of them.

Who is responsible for your information

LoroPay is operated by Swaply FinTech in Zimbabwe ("we", "us"). We handle personal information in line with Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]. You can contact us about privacy at admin@swaplygroup.com.

Information we collect

If you have a LoroPay account (a seller, organiser or anyone receiving money):

• Your email address, name or business name, and WhatsApp number.
• The wallets you add to receive money, such as EcoCash, OneMoney, O'mari and InnBucks numbers or merchant codes, and the name on each wallet.
• Your Paynow and EcoCash merchant details. Integration keys and PINs are stored encrypted and are never shown again or sent to customers.
• The links, products, collections and transport details you create, and photos you upload.
• If you link an Android phone for automatic confirmation: the wallet SMS messages it forwards. We store these with personal details masked, and use them only to match payments.

If you pay through LoroPay:

• The amount, currency, wallet or payment method, and the date and time.
• The mobile number you pay from, and the reference numbers from Paynow, EcoCash or your wallet.
• Your name and message, if you give them. For group collections your name is required so the organiser knows who contributed; you can choose to appear as "Anonymous" on the public list.

We do not receive or store your wallet PIN or your card number. You enter those with your wallet or with Paynow, not with LoroPay.

How we use it

• To start payments, confirm them, and show receipts.
• To show the person or business you paid a record of the payment, so they can confirm it and keep their books.
• To show group collection totals and contributor lists.
• To send sign-in links and important service messages.
• To prevent fraud and misuse, for example by limiting repeated payment requests.
• To fix problems and improve LoroPay.

We do not sell personal information, and we do not use it for advertising.

Who can see it

• The person or business you pay sees your payment details, including your name, number and message. Group collection organisers see contributors' real names even when they are shown publicly as Anonymous.
• The public, for group collections only: contributor names (unless Anonymous), amounts, messages and times appear on the collection page. Phone numbers are never shown publicly.
• Payment providers (Paynow, EcoCash and the wallet providers) receive what they need to process the payment.
• Our service providers, who host our database and website (Supabase and Vercel). They process data on our behalf and may store it outside Zimbabwe, with appropriate safeguards.
• Authorities, where the law requires it.

Your device

The payment page remembers a few things on your own phone, such as your name and the wallet you last paid from, so you don't have to type them again. These stay on your device and you can clear them in your browser settings. We use no advertising or tracking cookies.

How long we keep it

We keep payment records for as long as the account that received them is open, and afterwards for as long as needed for legal, tax and dispute purposes. Forwarded SMS messages that never matched a payment are kept only as long as they are useful for matching. You can ask us to delete your account information when it is no longer needed for these purposes.

Your rights

You can ask to see the personal information we hold about you, have it corrected, or have it deleted or restricted where the law allows. You can also object to how we use it. Email admin@swaplygroup.com; we may need to confirm who you are first. If you are unhappy with our answer, you can complain to the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), the data protection authority.

Security

Information travels over encrypted connections, sensitive keys are stored encrypted, and access to account data requires signing in. No system is perfectly secure, so please keep access to your email and phone safe.

Changes

If we change this policy we will update the date at the top, and tell account holders about important changes.