Sub-tree — Privacy Policy

Effective date: 2 October 2026
Last updated: 2 October 2026

This Privacy Policy explains what personal data the Sub-tree platform (the “Platform”) collects, why, who we share it with, how long we keep it, and the rights you have. Sub-tree is operated by Marketiffy Technologies Limited, a company incorporated in Uganda (“Sub-tree”, “we”, “us”), which is the data controller for the personal data described here.

We process personal data in line with Uganda's Data Protection and Privacy Act, 2019 and its regulations. This policy forms part of our Terms of Service and should be read with our Cookie Policy.

1. Who this policy covers

  • Creators — people who have a Sub-tree account and page;
  • Supporters — people who send a gift or donation to a Creator, with or without an account; and
  • Visitors — anyone who views the Platform or a Creator's page.

2. What we collect

Account and profile

Your email address, username, password (stored only as a secure hash, never in readable form), and, if you sign in with Google, your Google account email and name. What you add to your page: display name, photo, bio, links, template choice and country.

Connected accounts

If you add a link by connecting a platform (for example YouTube, Spotify, TikTok, Twitch or GitHub), you sign in to that platform and it shares your basic public profile with us: your account ID, username and profile link. We use this only to add and keep that link tied to your account. We don't post anything, read your messages or keep the platform's access token. Deleting the link removes the connection.

Contact and payout details

Your phone number, the mobile money number you receive and withdraw to, and, if you add one, your bank name, account name and account number.

Payments and wallet

Records of gifts and donations you send or receive (amount, date, payment method, status, the supporter's name and message if they give one, and the supporter's mobile money number where that method is used), withdrawals, fees, invoices and receipts. We do not receive or store full card numbers — card payments are handled entirely by our payment partner.

Identity verification (verified badge)

If you apply for the verified badge, you photograph your national ID (front and back) and take a face scan through our verification partner, Smile ID. Smile ID checks them and tells us the result. We keep the result, the date, and the full name shown on your ID. We do not keep your ID number or date of birth. See section 6 for how long ID photos are kept.

Security and device information

When you sign in or request a code, we record the device and browser type, the time, and an approximate location (city and country) worked out from your IP address. We use this to show you sign-in alerts and to detect suspicious activity. We also keep one-time codes, which expire within minutes.

Usage and messages

Page views and link clicks on Creator pages (shown to the Creator as totals), messages you send to our support team, and — only if you agree — analytics about how the Platform is used (see our Cookie Policy).

3. Why we use it

  • To provide the Platform — run your account and page, process gifts, show your balance, and send withdrawals (performance of our contract with you).
  • To keep accounts and money safe — sign-in codes, withdrawal codes, alerts about password, email, number and bank changes, and fraud prevention (our legitimate interest and your security).
  • To verify identity — only when you apply for the verified badge (your consent, which you give when you start the check).
  • To send you messages — receipts, gift notifications, billing reminders and service updates by email, and codes or security alerts by SMS.
  • To meet legal obligations — keeping financial records, responding to lawful requests, and anti-money-laundering requirements of our payment partners.
  • To improve the Platform — understanding usage through analytics, only with your consent.

We do not sell your personal data, and we do not use it for advertising.

4. What is public

Your Creator page is public by design: your display name, username, photo, bio, links and verified badge can be seen by anyone and may appear in search engines. Your email, phone numbers, bank details, balance and transaction history are never shown on your page.

5. Who we share it with

We share personal data only with service providers who need it to run the Platform, under contracts that require them to protect it:

  • Payment partners — Pesapal and OpenFloat (both regulated by the Bank of Uganda), and MTN and Airtel mobile money — to collect gifts and payments and to send withdrawals;
  • Smile ID — identity verification for the verified badge;
  • Resend — sending emails;
  • eSMS Africa — sending SMS codes and security alerts;
  • Supabase — Google sign-in;
  • Vercel — hosting, file storage for profile photos, and analytics (with consent); and
  • Railway — database hosting.

We may also disclose data where the law requires it, to protect the rights and safety of our users or the public, or as part of a merger or sale of our business (in which case this policy continues to apply).

6. How long we keep it

  • Account and profile — while your account is open. When you delete your account, your page and profile are removed and your username is freed.
  • Payment, withdrawal and invoice records — for as long as tax, accounting and financial regulations require, even after your account is deleted.
  • ID photos and face scans — normally not kept by Sub-tree at all. If Smile ID asks for a person to review your check, we keep encrypted copies only so our team can decide, then delete them as soon as the decision is made, and in any case within 30 days.
  • One-time codes — expire within 10–15 minutes.
  • Support messages and security logs — for as long as needed to help you and keep the Platform secure.

7. Where it is stored

Some of our service providers store or process data outside Uganda. Where that happens, we rely on providers that offer adequate protection for personal data, as required by the Data Protection and Privacy Act.

8. How we protect it

Passwords are hashed; connections are encrypted; ID review photos are encrypted at rest; sensitive actions (withdrawals, bank details, email changes) need a one-time code; and only authorised team members can access admin tools. No system is perfectly secure, so please keep your password and codes private — see clause 2.3 of the Terms of Service.

9. Your rights

Under the Data Protection and Privacy Act, you can ask us to:

  • tell you what personal data we hold about you and give you a copy;
  • correct data that is wrong or incomplete — most of it you can edit yourself in Settings;
  • delete your data — you can delete your account yourself in Settings, subject to the records we must keep (section 6);
  • stop or limit processing, or withdraw a consent you gave (for example, analytics cookies); and
  • object to processing based on our legitimate interests.

Email admin@sub-tree.com to make a request. We will reply within 30 days and may need to confirm your identity first. If you are not satisfied, you can complain to the Personal Data Protection Office of Uganda.

10. Children

The Platform is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. We will post the new version here and update the “Last updated” date, and tell you directly about significant changes.

12. Contact

Questions about privacy or your data: email us at admin@sub-tree.com or visit marketiffytechnologies.com. Sub-tree is operated by Marketiffy Technologies Limited.