Privacy notice

Who we are

45Agents provides reconciliation software for mobile-money and bank agents (wakalas) in Tanzania. It reads the transaction SMS that branch phones receive and works out float, cash and shortages for each branch, service and shift.

45Agents is a product of Hylen Technologies LLC, a company registered in Wyoming, United States. In this notice, “we” and “us” mean Hylen Technologies LLC.

For the accounts people create with us, 45Agents decides how the data is used. A business that uses 45Agents decides which branches, phones and staff to add; for the transaction messages and staff records that business puts into 45Agents, we process the data on its behalf.

You can reach us at [email protected].

What we collect

Business owners

• Your name, your business name and your phone number.
• Your email address, if you add one, and whether you have verified it.
• Your password, stored only as a one-way hash. We never see or store the password itself.
• Passkeys, if you add them: the public key, a name you give it and when it was last used. The private key stays on your device.
• If you sign in with Google: your name, email address and Google account ID (see “Sign in with Google” below).
• Security records: your sign-in sessions, one-time codes (stored only as hashes and expiring within minutes), failed sign-in attempts and a log of changes to your account.
• Your chats with the AI assistant in the dashboard, kept until you delete them. Files you attach to a question are used to answer it and are not kept.

Billing

• Your plan, how many branches it covers, your trial and renewal dates, and whether your payments are up to date.
• The references Stripe gives your customer record and your subscription.
• Card details go straight to Stripe, our payment provider. We never see or store your full card number or security code.

Staff

• The name and username the owner gives each staff member, and a PIN stored only as a hash.
• The branches they work at and their shifts: when each shift opened and closed, the cash counted, any notes, and cash entries made during the shift.

Branch phones (Android)

• Device details: manufacturer, model, Android version, app version, and the SIM slots with the service lines assigned to them.
• Health details, so the owner can see a phone is working: which app permissions are granted, the battery-saving setting, when the last SMS arrived and was sent, and how many messages are waiting to be sent.
• Transaction SMS from approved financial-provider senders only: the sender, the message text, when it was received and which SIM received it.

Branch iPhones

• The name, service and agent number the owner gives the iPhone.
• The Messages notifications the Shortcuts automation sends: the sender name and the message text.

Details of other people in transaction messages

Transaction SMS can include details of an agent's customers, such as names, phone numbers, amounts and transaction IDs. We use these only to reconcile that business's accounts.

The website

45agents.com uses no analytics, advertising or tracking cookies. The dashboard uses only the cookies it needs to keep you signed in and secure. Like most online services, our servers keep technical logs, such as IP addresses and the time and address of requests, to keep the service secure and to limit abuse.

What we do not collect

• Personal SMS. The phone checks each message's sender against a list of approved provider senders that we keep on our server, and sends only messages from that list.
• PINs, one-time codes and verification messages. The Android app deletes them on the phone before they are stored. Our server checks every message again and discards any code that reaches it, without storing it.
• Your contacts, photos, location or call history. The app does not ask for permission to read them.

A message that looks like a transaction but comes from an unknown sender shows a warning on the phone. On Android it is sent to us only if someone on the branch chooses to report it. If such a message reaches our server, we keep it marked as a suspected fake so the business owner can see the warning.

Once the Android app has sent a message, it deletes the message text from its own storage.

How we use it

• To reconcile float and cash for each branch, service and shift, and to show shortages and the staff member on duty.
• To read and process transaction SMS with AI.
• To check the balance chain, so a missed SMS is shown as a gap and not as a shortage.
• To warn about suspected fake SMS, low float and phones that stop reporting.
• To keep accounts secure: sign-in, email verification, two-step sign-in, password reset and protection against abuse.
• To send you service emails, such as verification and sign-in codes.
• To take payment for your subscription and keep your plan up to date.
• To support you when you contact us, and to improve how we read new provider message formats.

We use personal data to provide the service a business has asked for, to keep it secure, with consent where the law requires it, and to meet our legal obligations. When an owner pairs a phone or adds an iPhone, they confirm that the phone's user agrees.

We do not sell personal data and we do not use it for advertising.

Who we share it with

• Service providers that help us run 45Agents, such as hosting, email delivery and AI. We use AI to read and process transaction SMS, and to answer questions in the dashboard. They may use the data only to provide their service to us.
• Stripe, which processes subscription payments. It receives your business name, your email address if you have verified it, and the card details you enter on its payment page. Stripe handles them under its own privacy policy: https://stripe.com/privacy
• Google, only if you choose to sign in with Google.
• Within a business: an owner sees the data for their own branches, phones, staff and shifts. Staff see their own shifts.
• Authorities, when the law requires it.

Where data is stored

Data is stored on servers operated for 45Agents. Hylen Technologies is based in the United States, and some of our service providers, such as Stripe, process data outside Tanzania, including in the United States. Where that happens, we take steps so the data stays protected as this notice describes and as Tanzania's Personal Data Protection Act requires.

How long we keep it

• Account, staff and shift records: while the account is active.
• Transaction messages and the transactions read from them: for as long as the business needs them to reconcile, check for gaps and settle disputes, or as long as the law requires.
• One-time codes: they expire within minutes and are stored only as hashes.

When an owner removes a phone, it stops sending data. If an account is closed, we delete or anonymise its data within a reasonable period, unless the law requires us to keep it.

How we protect it

• All traffic between the apps, the website and our servers is encrypted (HTTPS).
• Passwords, PINs, one-time codes and device keys are stored only as one-way hashes.
• Each business's data is separated in the database itself, so one account can never read another's.
• Each phone has its own key, which the owner can revoke at any time.
• Sign-in and code attempts are limited, and changes to an account are logged.

Your rights

Under Tanzania's Personal Data Protection Act, 2022, you can ask us:

• whether we hold personal data about you, and for a copy of it;
• to correct data that is wrong or incomplete;
• to delete your data, or to stop or limit how we use it, where the law allows;
• to withdraw your consent, for example by having a phone removed from a branch.

Email [email protected]. We may need to confirm who you are before we act. If you are a staff member or a customer of a business that uses 45Agents, you can also contact that business, and we will help it respond. You can also complain to Tanzania's Personal Data Protection Commission.

Sign in with Google

If you choose to sign in with Google, we ask Google only for your basic profile: your name, your email address, whether Google has verified it, and your Google account ID. We use these only to sign you in and to link your Google account to your 45Agents account.

We do not ask for access to your contacts, Gmail, Drive or any other Google data, and we do not share the information we receive from Google with anyone. You can disconnect Google in the dashboard under Settings → Security, as long as you keep another way to sign in.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Children

45Agents is a business tool and is not meant for anyone under 18.

Changes to this notice

We may update this notice. When we do, we change the date at the top of the page, and for important changes we tell account owners by email or in the dashboard.

Contact us

For any question about privacy or your data, email [email protected].