Terms of Service

1. Introduction

Welcome to WaveTalk, operated by WaveTalk Ltd. ("we", "us", "our"). These Terms of Service ("Terms") govern your use of WaveTalk's apps + services. By using WaveTalk, you agree to these Terms. If you don't agree, don't use WaveTalk.

These Terms incorporate by reference:

• The Privacy Policy, which describes how we handle your personal data.
• The Security Policy, which describes how we protect it.

The Privacy Policy is a contractually-binding part of these Terms; the Security Policy is informational + describes our commitments without itself creating new ones beyond those listed in §10 below.

2. Eligibility

You may use WaveTalk if:

• You are at least 16 years old (the default minimum across Tanzanian + EU data-processing-consent rules; see PRIVACY.md §12).
• You are legally able to enter a binding contract in your jurisdiction.
• You are not barred from using WaveTalk's services under applicable law (sanctions lists, etc.).
• For business accounts: you are an authorised representative of the business you register.

We may suspend or terminate accounts that don't meet these criteria.

3. Your account

3.1 Account creation

To use WaveTalk you create an account using a Tanzania-issued mobile number (or a number we explicitly support in your jurisdiction). We verify the number via an OTP sent over SMS. You are responsible for the security of the device + SIM card associated with your number.

3.2 Authentication

You set a password. We store it hashed (bcrypt). Don't share your password with anyone. Don't reuse a password from another service. If you suspect your account has been compromised, change your password from Profile → Security and contact us.

WaveTalk also issues a refresh token that's rotated on every silent re-authentication. If someone steals your phone, the in-app Logout from all devices action revokes every active session server-side; access tokens become useless within seconds.

3.3 Account responsibility

You are responsible for everything that happens on your account. If you let someone else use your phone unlocked, anything they do is treated as you doing it for the purposes of these Terms.

3.4 Multiple accounts

Each person gets one account per phone number. Operating multiple accounts to evade rate limits, fraud blocks, or content moderation is grounds for termination.

4. Acceptable use

You agree not to use WaveTalk to:

• Send messages that are illegal under Tanzanian law, defamatory, harassing, threatening, hateful, or sexually explicit (incl. CSAM — automatic report to relevant authorities).
• Process payments for illegal goods or services, money laundering, sanctions evasion, or terror financing.
• Build mini-apps that exfiltrate user data, circumvent the capability sandbox, masquerade as another developer's app, or implement functionality you've explicitly declined to disclose.
• Spam other users.
• Probe, scan, or test the vulnerability of WaveTalk infrastructure without explicit written authorisation from us. (Security research is welcomed under SECURITY.md → Reporting a vulnerability, which provides safe-harbour and is the authorised path.)
• Reverse engineer, decompile, or disassemble WaveTalk's clients except as expressly permitted by applicable law (e.g. EU interoperability rights).
• Use automated tools (bots, scrapers, mass-creation accounts) without our prior written permission.
• Impersonate another person or organisation.
• Resell or sublicense WaveTalk's services without our prior written permission.

We may suspend or terminate any account that violates this section. For severe / irreversible violations (e.g. CSAM, terror financing) we report to the relevant authorities.

5. Messaging

WaveTalk offers real-time messaging across users + groups. You're responsible for what you send.

• Delivery is best-effort. Messages typically deliver in under a second, but we cannot guarantee delivery (e.g. if your recipient is offline indefinitely).
• Messages are stored on our servers until you or the recipient deletes them, subject to retention windows in PRIVACY.md §10. Deleted-on-one-device-doesn't-mean-deleted-from-the-other; deletion-from-our-servers is what makes a message unrecoverable.
• Messages are not end-to-end encrypted in v2.0.0-rc.1. They are TLS-encrypted in transit and WaveTalk can technically read them; we don't, except under legal compulsion (see PRIVACY.md §6.2). An opt-in E2E mode is on the roadmap.
• Group messages are visible to every group member. Don't send a message to a group expecting it to stay private from any member.

6. Payments

6.1 What we are (and are not)

WaveTalk operates a wallet + payment-orchestration surface over Tanzania's licensed mobile-money providers (M-Pesa, Airtel Money, TigoPesa) + payment aggregators (Selcom, AzamPay, ClickPesa). We are NOT a licensed bank. The actual funds movement is performed by the underlying PSP under its own licence.

Counsel review — the specific regulatory category WaveTalk falls under (mobile-money agent, payment-services provider, electronic-money issuer) is jurisdiction-specific and determines disclosure language. Counsel must confirm WaveTalk's classification under the Bank of Tanzania's mobile-money framework and the Tanzania National Payment Systems Act before this section is published.

6.2 Your wallet

When you receive money into WaveTalk, it credits your in-app wallet balance. The wallet is denominated in TZS (Tanzania Shillings). At any time you can withdraw to a supported PSP, or use the balance to pay another WaveTalk user, businesses, or mini-app developers.

The wallet balance is your money, custodied by WaveTalk (or by an underlying licensed party — counsel review).

6.3 Charges + reversibility

• You authorise each charge by confirming it in the in-app payment-confirm sheet.
• Idempotency. WaveTalk uses per-charge idempotency keys; a retry of the same intent returns the same transaction and never double-debits.
• Reversal of a completed charge is at the PSP's discretion + subject to their dispute window. Some channels (M-Pesa STK) allow same-day reversal under specific conditions; others don't. Once a charge has cleared the PSP, WaveTalk cannot unilaterally reverse it.
• Disputes with a counterparty: try to resolve directly first. If you can't, contact payments-support@wavetalk.co.tz — we'll mediate where we can. For high-value or fraud-suspected cases we may escalate to the PSP + cooperate with law enforcement.

6.4 Fees

WaveTalk charges fees for some operations. The current schedule:

Operation	Fee
Receive money into wallet	None (WaveTalk), PSP fees may apply
Send to another WaveTalk user (P2P)	None (rc.1) — may introduce a small fee at GA, disclosed 30 days in advance
Send to a Tanzanian mobile-money number (off-platform)	Pass-through PSP fee + a small WaveTalk service fee, disclosed at confirm time
Withdraw to PSP	Pass-through PSP fee + a small WaveTalk service fee
Cross-border payment (if/when supported)	FX margin + remittance fee, disclosed at confirm time
Business account fees	Per the business-account agreement
Mini-app payments.intent	No additional WaveTalk fee; the underlying P2P or PSP fee schedule applies

WaveTalk reserves the right to update the fee schedule with 30 days' advance notice for any fee that affects you. The notice will go via in-app banner + (if you have them enabled) push notification.

6.5 Fraud + AML

WaveTalk runs server-side fraud detection on every charge: velocity, blocklist, pattern heuristics. We may:

• Decline a charge that scores above the fraud threshold (you see a 422 "transaction blocked" — appeal at payments-support@wavetalk.co.tz).
• Hold funds for up to 72 hours for review if a charge is suspect.
• Freeze an account for AML / sanctions review under legal obligation. Frozen accounts cannot transact; you retain visibility of the balance + are notified of the freeze unless prohibited by law.

These actions exist to protect you + the broader user base from fraud + to keep WaveTalk compliant with Tanzania's AML / CFT requirements + international sanctions obligations.

6.6 Limits

Per-transaction + per-day + per-month limits apply, calibrated to PSP limits + WaveTalk's internal risk policy. Current limits are visible at Profile → Wallet → Limits.

7. Mini-apps

7.1 As a user

You can install mini-apps from the WaveTalk Mini Apps store. Each mini-app declares the capabilities it needs at install time. You grant capabilities per app; you can revoke them per app from Profile → Mini Apps.

WaveTalk does not endorse mini-apps. Read each app's developer-supplied description + permission rationale before installing. You can review your full grant + activity history in Mini Apps → My Apps → that app.

7.2 As a mini-app developer

You may publish a mini-app to the WaveTalk store subject to:

• Developer account in good standing. We may require identity verification + a business registration.
• Manifest accuracy. Your manifest must accurately declare every capability your app uses + provide a meaningful developer-reason string for each. Manifests that under-declare (asking for capabilities at runtime that aren't in the manifest) fail — the sandbox makes such calls unreachable, not "denied".
• No sandbox circumvention. Any attempt to escape the quickjs-ng sandbox, the capability broker, or to use a side-channel (e.g. timing attacks on payments) to learn about user data you weren't granted is grounds for immediate developer-account termination + a permanent ban.
• Per-user data handling: anything you store in your app's storage.kv lives on the user's device — but if you use the network.fetch capability to send data to your own backend, you become a data controller for that data + must comply with applicable privacy law independently of WaveTalk's Privacy Policy.
• Disclosure: you must publish your own privacy policy + terms applicable to your mini-app. WaveTalk will link to them from the install screen.

7.2.1 Revenue + payouts

Mini-apps that monetise via payments.intent receive payment to a developer wallet that you withdraw to your business PSP account. Revenue share:

Transaction type	WaveTalk platform fee
In-app virtual goods + subscriptions	15% (the WeChat / Stripe-style platform-fee posture). Reviewed before GA.
Pass-through to a payment recipient	0% WaveTalk fee. The standard P2P or PSP fee applies.

Developer payouts run weekly on a 7-day rolling settlement window; payouts to a Tanzanian PSP land same-day. WaveTalk may withhold a payout pending fraud investigation up to 30 days.

7.3 IP

You retain ownership of your mini-app's code + content. You grant WaveTalk a worldwide, royalty-free, non-exclusive licence to host, distribute, and execute it on user devices for the purpose of operating the WaveTalk mini-app platform.

You represent that your mini-app does not infringe third-party IP, doesn't include unlicensed content, and doesn't violate applicable law.

8. Business accounts

A separate Business Account Agreement governs the verified-business surface (48-hour messaging window, QR receivables, business profile, team members, etc.). Where the Business Account Agreement conflicts with these Terms, the Business Account Agreement governs for business activities.

9. Intellectual property

9.1 WaveTalk's IP

The WaveTalk app + back-end + brand are owned by WaveTalk Ltd. or its licensors. We grant you a personal, non-exclusive, non-transferable, revocable licence to use the WaveTalk apps on devices you own + operate, for the purpose of using WaveTalk as a user.

You may not:

• Copy, modify, distribute, sell, or lease WaveTalk's apps.
• Decompile or reverse-engineer them, except as expressly permitted by applicable law.
• Remove proprietary notices.

9.2 Your content

You retain ownership of everything you send, post, or upload through WaveTalk (messages, profile photo, business listings, mini-app content). You grant WaveTalk a worldwide, royalty-free, non-exclusive licence to host, transmit, display, and process it solely to operate the service — including delivering your messages to recipients, syncing them to your devices, and indexing for search.

This licence terminates when you delete the content + WaveTalk's retention window for it expires (see PRIVACY.md §10).

10. Disclaimers

10.1 Service "as is"

WaveTalk is provided "as is" and "as available". To the maximum extent permitted by law, we disclaim all warranties — express, implied, or statutory — including merchantability, fitness for a particular purpose, and non-infringement. EU consumers retain whatever statutory warranties are non-waivable under their local law; nothing here purports to override those.

10.2 Uptime

We aim for 99.5% monthly availability of the realtime messaging service + 99.9% for the wallet API but do not contractually guarantee these levels for individual users. If our published transparency report shows we fell below 99.0% for messaging or 99.5% for the wallet for a calendar month and you can show a direct loss, contact payments-support@wavetalk.co.tz for review.

10.3 Third-party services

PSPs, AI providers, push providers, and other third parties may have outages, behaviour changes, or unilateral policy changes that affect WaveTalk. We don't control them + aren't liable for their behaviour, except as required by Tanzania's payment-services framework for transaction settlement.

10.4 Mini-apps

WaveTalk is not the developer of third-party mini-apps + makes no warranty about their behaviour. Your remedy for a defective or harmful mini-app is against its developer; we will cooperate with reasonable requests to identify the developer.

11. Limitation of liability

To the maximum extent permitted by law, WaveTalk Ltd.'s aggregate liability to you for any claim arising from these Terms or your use of WaveTalk is capped at the greater of:

• The total fees you paid WaveTalk in the 12 months before the claim arose; OR
• TZS 500,000 (approx US$200).

This cap does not apply to:

• Liability that cannot be excluded under applicable law (e.g. for death or personal injury caused by negligence, for fraud, or for breaches of mandatory consumer protection in the EU).
• WaveTalk's own negligent loss of funds from your wallet (we take responsibility for our own operational errors — within the cap defined above).
• WaveTalk's intentional violation of the Privacy Policy.

We are not liable for indirect, consequential, special, or punitive damages, lost profits, or lost data, except where applicable law forbids that exclusion.

12. Indemnification

You agree to indemnify and hold WaveTalk Ltd. harmless from any claim, loss, or expense (including reasonable legal fees) arising from:

• Your violation of these Terms.
• Your violation of applicable law in your use of WaveTalk.
• Your content (messages, mini-app content, business listings) where it infringes a third-party right.

We will give you prompt notice of any indemnifiable claim + reasonable cooperation; we retain control of the defence + settlement.

13. Termination

13.1 By you

You may close your WaveTalk account at any time from Profile → Account → Delete account. Closure follows PRIVACY.md §10 for data retention.

Closing the account does not refund pre-paid fees, doesn't terminate pending payment obligations (the wallet balance settles to your nominated PSP at the time of closure), and doesn't release you from outstanding indemnities under §12.

13.2 By us

We may suspend or terminate your account if:

• You violate these Terms or the Privacy Policy.
• We are legally required to (e.g. court order, sanctions listing).
• Your account is involved in fraud or abuse.
• We discontinue WaveTalk in your country (in which case you get at least 90 days' notice to withdraw your wallet balance + export your data).

For termination not driven by your violation, we will give you at least 30 days' notice + an opportunity to download your data + withdraw your balance.

13.3 Survival

Sections that by their nature should survive termination do — including Acceptable Use violations as a defence to indemnity claims, IP licences in content already sent, payment settlement of pre-termination charges, retention obligations under the Privacy Policy, dispute resolution under §15, and limitation of liability under §11.

14. Changes to these Terms

We'll update these Terms as WaveTalk evolves. Material changes (changes that introduce new fees, shrink rights or remedies, or expand obligations materially) require:

• 30 days advance notice by in-app banner + push notification (if enabled) + a notice on the Terms page.
• Where applicable law requires it (e.g. for EU consumers), affirmative re-acceptance before the new terms apply to you.

Non-material changes (clarifications, typo fixes, contact addresses) take effect on publication.

The Last updated date at the top reflects the most recent revision. Older versions are archived + available on request.

15. Dispute resolution

15.1 Try to resolve directly

If you have a dispute with WaveTalk, contact us at support@wavetalk.co.tz first — most issues resolve at this step.

15.2 Mediation

If direct resolution fails, you + WaveTalk agree to attempt mediation by a neutral mediator agreed by both parties.

15.3 Arbitration (Tanzania)

If mediation fails, the dispute is settled by binding arbitration under the Tanzania Institute of Arbitrators Arbitration Rules by a single arbitrator. The seat of arbitration is Dar es Salaam, Tanzania. The language is English. The arbitrator's decision is final + enforceable in any court of competent jurisdiction. Costs are allocated by the arbitrator.

15.4 EU consumers

If you are an EU-based consumer, the arbitration clause in §15.3 does not strip you of the right to bring a claim in your local courts under your local consumer-protection law. You may also use the EU Online Dispute Resolution platform.

15.5 No class action

You + WaveTalk agree to resolve disputes individually, not as part of a class action, except where the prohibition is unenforceable under applicable law (notably the EU).

16. Governing law

These Terms are governed by the laws of Tanzania, without regard to conflict-of-laws principles. For EU consumers, your mandatory local consumer-protection law applies in addition.

17. Severability

If a provision of these Terms is held invalid or unenforceable, the rest remains in effect. We may replace the invalid provision with one that achieves the same intent as closely as the law allows.

18. Entire agreement

These Terms (together with the Privacy Policy and any business-account or mini-app-developer agreement you've signed) are the entire agreement between you + WaveTalk for your use of the service. They supersede any prior agreements or statements.

19. Assignment

You may not assign these Terms or your account without our prior written consent. We may assign these Terms (e.g. in a business transition — see PRIVACY.md §6.4) on 30 days' notice.

20. Contact

• General support: support@wavetalk.co.tz
• Payments support: payments-support@wavetalk.co.tz
• Mini-app developer support: developers@wavetalk.co.tz
• Business account support: business@wavetalk.co.tz
• Privacy + data-rights requests: privacy@wavetalk.co.tz
• Security disclosures: security@wavetalk.co.tz
• Legal notices to WaveTalk: legal@wavetalk.co.tz + postal to WaveTalk Ltd., [address TBD], Tanzania.

---

Counsel-review checklist

When counsel reviews this draft, please specifically validate:

• [ ] WaveTalk's classification under the Bank of Tanzania's mobile-money framework + the Tanzania National Payment Systems Act (§6.1) — affects mandatory disclosures + dispute timelines.
• [ ] §6.4 fee-schedule changes notice timeline (30 days) meets Tanzania consumer-protection requirements for financial-services fee changes.
• [ ] §6.5 freeze + hold timelines align with Tanzania's AML / CFT regime + Financial Intelligence Unit reporting obligations.
• [ ] §7.2.1 mini-app revenue-share percentages are enforceable + meet platform-fee competition norms in the region.
• [ ] §11 limitation-of-liability cap (TZS 500,000 / 12 months of fees) is enforceable under Tanzania consumer law + survives EU unfair-terms scrutiny.
• [ ] §15.3 arbitration clause is enforceable + the institutional choice (Tanzania Institute of Arbitrators) is workable; alternative seats / institutions if a deployment outside Tanzania is contemplated.
• [ ] §15.5 class-action waiver is consistent with both Tanzania practice + the EU-consumer carve-out.
• [ ] §10.1 statutory-warranty disclaimers are correctly carved out for EU consumers (mandatory EU consumer warranties are non-waivable).
• [ ] §4 acceptable-use enforcement actions (incl. CSAM auto-report) align with Tanzania's reporting obligations + the Communications Act.
• [ ] §13.2 WaveTalk-discontinuation 90-day notice is sufficient for Tanzanian users + meets EU consumer-protection minimums.
• [ ] §17 severability + §18 entire-agreement clauses are drafted in the form Tanzania courts customarily enforce.
• [ ] Any other jurisdiction WaveTalk launches into (Kenya, Uganda, Rwanda) gets its own appendix or localised Terms.