Privacy policy

Wellth is a product of Tall Grass Group (“Tall Grass”, “we”). We decide why and how your personal data is used in Wellth, so we are its controller. For anything in this policy, write to dev@tallgrasshq.com.

Wellth is software. It runs your circle's rules and keeps its records. It does not hold your money: licensed partners do (section 5).

• Account: your phone number (you sign in with a code sent to it), your name, and, if you give them, your email address, where you are based and your preferred language.
• Your circles: your membership and roles, contributions, loans, repayments, fines, grants, votes, motions, meeting attendance, goals and share-outs. Every money movement is a ledger line: who, what, how much, which ledger, the approvals and when.
• Votes: in a secret ballot we store that you voted apart from what was voted. The app can count votes but can never pair a vote with a voter.
• Identity checks: when identity checks are on in your country, a licensed identity provider checks your identity document and a selfie. We keep only the result: the provider's reference, the outcome and reasons, the document type, issuing country and expiry, your name and date of birth as the provider verified them, and a keyed hash of the document number (never the number itself). We never receive or store your document images or your selfie.
• Address and source of funds: only when needed (higher limits, or large payments). We record the type of evidence, its date, who reviewed it and the decision; the evidence itself is not stored in Wellth.
• Payments: amounts, currencies, the network or bank used, the partner's transaction reference and status, fees, and the payer and payee. For school fees: your learner's name, school and term.
• Cards: the card's last four digits and expiry, its status, and the transactions the issuing bank reports. Never the full card number. For a physical card: the delivery address and the phone number the courier calls.
• Help and support: your conversations with Meg, our in-app assistant, and with Tall Grass.
• Technical: a session cookie that keeps you signed in, and the logs our hosting provider keeps to run and protect the service. We do not use advertising cookies.

• To run the service you asked for: your circle, its ledgers, votes and share-out, payments, school fees and cards (performance of our contract with you).
• To tell every member of a circle about every money movement in it. This is a rule of how Wellth works, and the reason members can trust the books.
• To verify identity and support the anti-money-laundering duties of the licensed partners who hold and move money (legal obligation).
• To keep Wellth secure, prevent fraud and fix problems (our legitimate interests).
• To answer your questions and complaints.
• Identity checks use biometric data, which is sensitive. We ask for your explicit consent before any capture, and tell you who checks it, what we keep and how long the provider keeps the images.

A savings group works because members can see the books. Everything a member could see sitting in a group meeting, every member sees on Wellth: names, roles, who has paid this month, loan sizes and status, fines, totals, and the results of votes.

Private: your phone number, ID details and next of kin. Only the Secretary and the Auditor see them. Nobody sees how you voted.

We share only what each one needs to do its job, under a written agreement:

• Identity provider (Smile ID or Didit, or another licensed provider): your document and selfie, captured on its own page, to check who you are. It keeps the images under its agreement with us.
• Mobile-money networks and payment partners (MTN Mobile Money and Airtel Money in Uganda, M-Pesa and Airtel Money in Kenya, and partners such as Flutterwave for cards and banks for payments from abroad): the phone number or account and the amount, to move the money.
• The card-issuing bank, its card bureau and courier: your name, and for a physical card your delivery address and phone, to issue and deliver the card.
• SMS and email providers (such as Africa's Talking): your phone number or email and the message, to send sign-in codes, receipts and notices.
• Anthropic, the model provider behind Meg: your question (with phone numbers masked), your first name and country, the recent messages of the current chat, and the results of read-only lookups of what you can already see on your screens. Nothing you couldn't see yourself.
• Hosting: Vercel (the app) and Neon (the database) store and serve the data for us.
• Authorities: when the law requires it, for example a regulator, the Financial Intelligence Authority (Uganda) or the Financial Reporting Centre (Kenya), usually through the licensed partner that holds the money.

We do not sell your data, and we do not share it for advertising.

Wellth's servers and some of our providers are outside Uganda and Kenya, so your data may be transferred abroad. We transfer it only to providers bound by agreements that protect it to the standard Uganda's and Kenya's laws require, and, for members in the EU or UK, with the safeguards the GDPR or UK GDPR require (such as standard contractual clauses).

Money is held by the licensed partners, not by Wellth.

• Ledgers, payments and identity-check results: for as long as your circle uses Wellth, and then at least as long as anti-money-laundering law requires (in Uganda 10 years, in Kenya 7 years, after the account or transaction ends; counsel to confirm). A circle's audited books are part of its legal record.
• Chats with Meg: 90 days from the last message, then deleted. A chat attached to a support ticket is kept with the ticket.
• Support tickets: 2 years after they close, for complaints handling, then deleted.
• Identity images: never held by Wellth. The provider keeps them only as long as its agreement with us allows.
• Your session cookie: 30 days, or until you sign out.
• When you close your account, what the law doesn't need is erased at once, and what it does need is kept only for the periods above, then deleted: Delete your account.

In Uganda, under the Data Protection and Privacy Act 2019, you can ask to see the data we hold about you, have it corrected, have it deleted where we no longer need it, object to its use, and not be subject to a decision made only by automated means. You can complain to the Personal Data Protection Office.

In Kenya, under the Data Protection Act 2019, you have the right to be told how your data is used, to access it, to object, to have it corrected or deleted, and to receive it in a portable form. You can complain to the Office of the Data Protection Commissioner.

If you live in the EU or the UK, the GDPR or UK GDPR may also apply: access, rectification, erasure, restriction, portability, objection, and to withdraw consent at any time. You can complain to your data protection authority (in the UK the Information Commissioner's Office; in Italy the Garante per la protezione dei dati personali).

Some data can't be deleted while the law requires us to keep it (section 7), and a circle's ledger lines stay in its books. In the app, Account then Your data downloads a copy of everything we hold about you, and Close your account closes it (how closing works). Or write to dev@tallgrasshq.com; we answer within the time the law sets. You can also ask a person in the app from Help & support where it is on.

• Two keys on every outflow, checked on the server.
• Document numbers kept only as a keyed hash; no document images or selfies stored.
• Masked card numbers; phone numbers masked before a question reaches the model provider.
• Secret ballots stored so that votes and voters can never be paired.
• Each country's identity checks switch on only once we are registered with its data protection office.

Wellth accounts are for adults. A parent may add a learner's name, school and class to pay their fees or set up a Scholar account or card; the parent is responsible for that information.

We will post changes here and tell you in the app before a change that affects how we use your data takes effect.