SmartBills

Privacy policy

Last updated 29 September 2026

SmartBills is operated by Bushveld Technologies (Pvt) Ltd, Harare, Zimbabwe. It is a point-of-sale system used by staff at agent counters to pay bills on behalf of walk-in customers. This policy explains what the app collects, why, and what we do with it.

What we collect

Information	Why
Staff account details — name, username, work email, telephone number, the branch worked at and the role held	To sign a person in, apply the permissions of their role, and record who performed each action
Authentication data — password (stored only as a cryptographic hash), authenticator secret, session tokens	To keep accounts secure and support two-factor sign-in
Transaction records — the bill account or meter number entered, the amount, the currency, the payment method, and the name the utility returns for that account	To pay the bill, print the customer's receipt, and keep the financial record every payments business is required to keep
Device information — a notification token, and the app version and operating-system version	To deliver notifications to the right device and to diagnose faults
Diagnostic logs — request timings, error messages and an audit trail of actions taken	To keep the service working, investigate problems, and meet audit obligations

What we do not collect

• No card details are stored. Where a customer pays by card, the details are passed to the licensed payment provider and are never written to our records.
• No location data. The app does not request or use device location.
• No contacts, photos, files or microphone access.
• No advertising identifiers, and no data is sold or shared with advertisers or data brokers. We do not profile anyone.

Permissions the app asks for

Permission	What it is for
Internet	To reach the SmartBills service
Notifications	To tell a cashier that a sale completed, or that an approval is waiting
Biometric	To unlock the app with a fingerprint or face, if the user turns that on. Biometric data never leaves the device and is never sent to us.
Bluetooth	Only to print a receipt on a counter receipt printer. It is not used to locate anyone, and no scanning data is collected.

Who we share information with

To pay a bill, the account number and the amount must be sent to the bill payment provider we are integrated with, and on to the utility or service provider concerned. That is the purpose of the transaction and cannot be avoided. Beyond that, information is shared only with:

• the institution that employs the member of staff, for its own transactions;
• infrastructure providers who host the service on our behalf, under contract;
• a regulator, auditor or court, where the law requires it.

We do not sell personal information, and we do not transfer it to anyone for their own marketing.

How long we keep it

Financial records are retained for seven years, as Zimbabwean record-keeping requirements for payment businesses provide. Staff account records are kept while the account is active and for the retention period afterwards. Diagnostic logs are kept for a substantially shorter period and are removed on a rolling basis.

How it is protected

• All traffic is encrypted in transit (TLS).
• Passwords are stored only as salted hashes and are never recoverable.
• Two-factor authentication is required for every staff account.
• Access follows the role a person holds, and sensitive records are limited to the branch or institution they belong to.
• The financial ledger is append-only and every change is recorded in an audit trail.

Your rights

If you are a member of staff using SmartBills, or a customer whose payment was processed through it, you may ask us what information we hold about you, ask for a correction, or ask for it to be deleted where no legal retention period applies. Requests go to the address below, and we will respond within 30 days. For staff accounts, please also contact your own institution's administrator, who manages your access.

Children

SmartBills is a workplace tool for adult staff. It is not directed at children and we do not knowingly collect information from anyone under 18.

Changes

If this policy changes materially, we will update the date at the top of this page and, where the change affects how staff data is used, notify institutions directly.

Deleting your account

To have your account and the personal information held with it deleted, follow the steps on Delete your account. That page also sets out exactly what is removed and which records we are obliged to keep.

Contact

Bushveld Technologies (Pvt) Ltd
Harare, Zimbabwe
bushveld.engineers@gmail.com