Privacy
Last updated 12 August 2026
This describes what Sawiliy actually collects, why, and who it goes to. It describes the service as it works today — not what it might do later. The data controller is VUKUP LTD, a private company limited by shares registered in Rwanda under company code 156795861, with its registered office at Intwari, Rwezamenyo I, Rwezamenyo, Nyarugenge, Kigali, Rwanda. Questions about your data: hello@sawiliy.com.
If you only browse
Two things run on every page, and neither of them records your screen.
PostHog tells us which pages are opened and which buttons are tapped, so we can see what people come looking for and what is missing. Sentry tells us when a page breaks, so a fault reports itself instead of only ruining your afternoon. Session replay is switched off in both.
Neither stores anything in your browser. PostHog gives each page a random id that is forgotten as soon as you leave it, so we can count what was opened without knowing it was you, and without a cookie. It is never linked to your account. PostHog holds what it receives on servers in the European Union.
Our host also keeps standard server logs of requests, as every web host does.
If you join the waiting list
We keep the name, phone number, Instagram handle and category you enter, and which form you used. That is so we can contact you when we open in your area.
If you create an account
Your email address is your account — it is how you sign in and how we reach you. You can add a phone number and sign in with that instead; either one on its own is enough, and an account does not need both.
You may also add a name, a photo and a language preference. Nothing else is required.
When you ask a maker about a listing, we save the phone number on your account — if you have added one — with your question, and show it to that maker so they can reply on WhatsApp. It is not public and no other maker sees it. If you use the app and allow notifications, we also keep a token from Apple that identifies that installation, so we can send them. Removing the app, or turning notifications off, removes it.
If you sell
To be approved you give us your shop name, a description, your logo and cover photo, your area, your WhatsApp number, and an email address on your account.
We do not ask for an identity document, a passport or a national ID number, and we have no way to check one. Your email address and your commission rate are never shown to buyers — only you and our admin see them. Your WhatsApp number IS shown, because it is how a buyer reaches you.
What buyers can see about a seller
Your shop name, description, logo, cover photo, area, Instagram handle, listings — and your WhatsApp number.
Your WhatsApp number is public. It is how a buyer asks about a piece, because there is no messaging system on Sawiliy and none is planned before launch. If you do not want your number public, do not list.
Sign-in codes and abuse limits
When you request a sign-in code we record the phone number or email it was sent to, and a one-way hash of your IP address made with a secret key. The address itself is never stored. These records are deleted automatically after 24 hours and exist only to stop someone requesting thousands of codes.
When you open a listing we record that it was viewed, with the same kind of one-way hash of your IP address and the date — never the address itself, and never linked to your account. It exists so a maker can see that people are looking at their work, and so that one person opening a page twice is not counted as two. The maker sees a number, never who you are. These records are deleted after 90 days.
Who else sees your data
Only the companies that run the service for us, and only what they need to do it: Supabase (database, sign-in, file storage), Vercel (hosting), Twilio (sending SMS codes), Resend (sending email), Cloudflare (domain and email routing), PostHog (which pages are opened, on servers in the EU), and Sentry (error reports).
We do not sell your data, and we do not share it for advertising.
When you tap a WhatsApp link you leave Sawiliy and are messaging on WhatsApp, under Meta’s terms rather than ours.
How long we keep it
Your account and shop data for as long as your account exists. Sign-in abuse records for 24 hours. Waiting-list entries until we open in your area or you ask us to remove them. Which pages were opened, and error reports, for up to 12 months.
Your rights
You can ask to see what we hold about you, to correct it, or to delete it. Email hello@sawiliy.com and we will respond.
Deleting your account removes your profile, your shop and your listings. Some records may be kept where the law requires it.
Children
Sawiliy is not for anyone under 18. We do not knowingly collect data from children.
Changes
If this changes materially we will say so on this page and update the date above.