1. Who we are
Torpedo is operated by {{COMPANY_NAME}}, registered at {{ADDRESS}}, Mozambique, NUEL {{NUEL}}, NUIT {{NUIT}}, licensed by INTIC under no. {{INTIC_LICENCE}}.
Contact: hello@torpedo.co.mz · {{PHONE}}.
Person responsible for data protection compliance (Law 3/2017, art. 65): {{DATA_RESPONSIBLE}}, reachable at hello@torpedo.co.mz. Any request or complaint about personal data can be sent to this person.
2. Our role
Torpedo handles personal data in two different capacities:
- Controller: your account, company, billing, security and website or dashboard usage data. We decide what it is used for and we are accountable for it.
- Processor: data about the recipients of messages our customers send through the APIs — phone numbers, email addresses and message content. We handle it only to deliver the messages, on behalf of and following the instructions of the customer, who is the controller.
3. What we collect
- Account: name, email, password (we only store a hash), phone if you give it, preferred language and two-factor authentication settings.
- Company and billing: workspace name, billing details, plans, credits, invoices and transactions. Card and mobile-wallet details are handled by the payment providers; we never receive them.
- Security and technical: IP address, browser and device (user agent), sessions, API request logs, API keys (we only store the hash) and admin access logs.
- Content sent by customers: sender, recipients, subject, body, sender ID, WhatsApp templates, delivery events (delivered, bounced, complaint), suppression list, verification codes and webhook payloads.
- Domains: domain names and DNS records you set up for sending email.
- Usage: browsing and product events collected by our analytics service, and cookies (see section 12).
- Contacting us: whatever you write to us by email or through the contact form.
4. How we use data
We state the purpose before collecting and do not use the data for anything else (Law 3/2017, art. 63).
| Purpose | Data | Basis |
|---|---|---|
| Create and run the account, authenticate and secure access | Account, security | Performance of the contract |
| Deliver messages, record deliveries and apply suppressions | Content sent by customers | Contract, on the customer’s instructions |
| Charge, invoice and meet tax obligations | Company and billing | Legal obligation and contract |
| Prevent fraud, spam and abuse; respond to carriers and authorities | Security, content, logs | Legal obligation and legitimate interest |
| Keep traffic and subscriber records required by law | Security, delivery events | Legal obligation (Law 13/2026) |
| Improve the product with usage statistics | Usage | Consent (analytics cookies) |
| Send Torpedo product news | Account email | Consent; unsubscribe in every email |
| Answer support and contact requests | Contact | Legitimate interest |
5. Recipient data
We do not collect recipients’ numbers and emails directly: customers using the APIs give them to us. The customer must inform recipients and have a legal basis to message them, including prior consent for commercial messages (Law 3/2017, art. 40).
We use this data only to deliver messages, receive delivery receipts and keep the suppression list (addresses that bounced or complained), which blocks further sends to those addresses.
If you received a message sent through Torpedo and want to exercise your rights, contact the company that sent it. If you contact us, we forward the request to that company and help it respond.
6. Confidentiality of communications
Message content is private correspondence (Constitution, art. 68). So:
- We do not read, analyse, profile or sell message content, or use it for advertising or to train models.
- Staff only access content when the customer asks for support, or to investigate abuse or fraud, and that access is logged.
- We only disclose content or traffic data to third parties under a court decision or an order from a competent authority provided for by law (Law 3/2017, arts. 14 and 16; Law 14/2026).
7. Who we share data with
We use the sub-processors below to run the service. Each handles data only for the listed function and is bound by contractual confidentiality and security obligations. We remain accountable for data we pass to them (Law 3/2017, art. 65).
| Provider | Function | Data | Location |
|---|---|---|---|
| DigitalOcean | API servers and database | All categories | {{HOSTING_REGION}} |
| Amazon Web Services (SES, SNS) | Email sending and delivery events | Sender, recipients, content, events | Sweden (EU) |
| Mobile carriers in Mozambique | SMS delivery | Number, content, sender ID | Mozambique |
| Meta Platforms (WhatsApp Cloud API) | Sending codes over WhatsApp | Number, template content | USA and others |
| Cloudflare | Website hosting, bot protection, file storage | IP, request data, files | Global network |
| Lemon Squeezy | Card payments | Name, email, amount, country | USA |
| PaySuite | M-Pesa and e-Mola payments | Phone, amount | Mozambique |
| PostHog | Product usage analytics | Identifier, events, IP | EU |
We do not sell personal data. We tell customers by email before adding or replacing a sub-processor that handles message content.
8. International transfers
Some sub-processors are outside Mozambique, as shown in the table above. We only transfer the data each provider needs for its function and require contractual protection equivalent to Mozambican law. When the Mozambican personal data protection law comes into force, we will make whatever notifications or authorisation requests it requires.
9. How long we keep data
| Data | Period |
|---|---|
| Message content | While the account is active; deleted after the account is closed |
| Delivery events, IP addresses and subscriber data | At least 1 year (Law 13/2026) |
| Contracts | At least 2 years after the contract ends (Decree 59/2023) |
| Complaints | 5 years (Decree 59/2023) |
| Invoices and accounting records | 10 years (Commercial Code) |
| Suppression list | While the account is active, to block further sends |
| Usage analytics | Up to 1 year |
When you close your account we delete or anonymise the rest of your data, except what the law requires us to keep for the periods above.
10. Security
- Encrypted connections (TLS) on the website, dashboard and APIs.
- Passwords and API keys stored only as hashes; third-party tokens encrypted.
- Two-factor authentication available, revocable sessions and bot protection on sign-up and sign-in.
- Restricted, logged internal access, backups and an incident-response team.
11. Security incidents
If an incident affects personal data, we notify INTIC and the national incident-response team within the deadlines of Law 13/2026, tell affected customers without delay and, where there is a risk to the people concerned, tell them what happened and what they can do.
12. Cookies
- Session: needed to keep you signed in to the dashboard. You cannot sign in without it.
- Language (TORPEDO_LOCALE) and interface preferences such as theme and sidebar: remember your choices.
- Analytics (PostHog): product usage statistics. You can refuse them in your browser settings or with a blocker; the service keeps working.
- Bot protection (Cloudflare Turnstile) on sign-up and sign-in, and the Meta SDK only when you connect a WhatsApp account.
13. Your rights
You have the right to know whether we handle your data, to access it, correct it, object to its use, ask for it to be deleted and withdraw any consent you gave. If we refuse a request, we explain why (Constitution, art. 71; Law 3/2017, art. 63).
To exercise any right, write to hello@torpedo.co.mz from your account email. We answer within 20 working days, free of charge. We may ask for proof of identity before answering.
You can view and correct much of your account data directly in the dashboard.
14. Minimum age
Torpedo is for people aged 18 and over and for businesses. We do not open accounts for minors. If we learn an account belongs to a minor, we close it.
15. Complaints
If you are not satisfied, talk to us first at hello@torpedo.co.mz. You can also complain to INTIC (the national ICT regulator), to INCM for SMS matters, or go to court.
16. Changes to this policy
When we change this policy, we update the version and date at the top and, for significant changes, tell customers by email before they take effect. We will review the policy when the Mozambican personal data protection law is published.