Tanzania PDPA s.45 disclosure

Cross-border data transfers

LitFin uses outside providers to run the platform, and most AI requests are now handled outside East Africa. This page explains, in plain terms, where your data goes, what is and is not done to it before it leaves, and what protects it. For the full list of providers and where each one sits, see our sub-processor list.

Last updated: 2026-08-08.

Data Processing AgreementSub-processor listPrivacy policy

How your data is protected

Three things hold true whenever your data leaves East Africa:

  • Your data is encrypted while it moves and while it is stored inside LitFin.
  • Most AI processing now happens outside East Africa, and content is sent as written rather than anonymised first. Our sub-processor list names each provider and the country it works in, so you can see exactly where a request goes.
  • Your rights travel with the data. You can ask us for a copy, object to a use, or withdraw consent through the privacy portal, and we act on it wherever the data was handled.

Providers we use

We rely on outside AI, voice, search, and infrastructure providers to deliver LitFin. Each one is named on our sub-processor list, together with what it handles, the region it sits in, and how long it keeps anything. That list is the single source we keep up to date.

See the full sub-processor list

Lawful basis and safeguards

  • Most providers named on our sub-processor list are bound by an executed data-processing agreement. The AI inference providers added in August 2026 are not yet, and the list names them and records that the 30-day notice was not issued before they received data.
  • Content leaves as written, personal details included, because redacting it damaged the documents institutions rely on. The limit is purpose: a provider may use the content only to answer that request, never to train on it or build a profile. Where an agreement is executed that limit is contractual, and where one is not yet executed our sub-processor list records that plainly.
  • Your data is encrypted while it moves and while it is stored inside LitFin systems.
  • You can withdraw consent at any time through the privacy portal. Withdrawal stops any new transfers within 24 hours.

For the technical detail, see our data-protection page. Data-protection page.