Privacy Policy

1. What we collect

Account details: your name, Safaricom phone number, email address and password (stored as a salted hash — we can never read it).

Loan application details: your national ID number, a photo of your ID document, date of birth, location, occupation, income and the purpose of your loan.

Activity: your loans, repayments, wallet transactions, notifications and security settings such as whether a PIN is set (the PIN itself is stored only as a hash).

2. How we use your information

To operate your account: verifying your phone number by SMS, processing loan applications, disbursing funds to your wallet and handling withdrawals and repayments.

To verify applications: your application details, including the ID photo, are reviewed by automated checks (which may include AI-assisted review) to confirm they are plausible and consistent before a loan is approved.

To keep you informed: sending verification codes, loan decisions and withdrawal status updates by SMS and in-app notification.

To protect the service: preventing fraud, enforcing our Terms of Service and meeting legal obligations.

3. Who we share it with

SMS delivery partners (currently HostPinnacle) receive your phone number and the message content in order to deliver texts to you.

Payment providers (Safaricom M-Pesa) receive the details needed to collect fees and disburse withdrawals.

Automated verification providers receive the application details being checked. We do not sell your personal information to anyone.

4. How long we keep it

We keep your information for as long as your account is active and for the period required by Kenyan law for financial records after it closes. SMS verification codes expire after 5 minutes and are kept only as an audit record of the code having been used.

5. Security

Passwords and PINs are stored only as salted scrypt hashes. Sessions are protected with httpOnly cookies, and the session tokens themselves are stored hashed. ID photos are stored separately from your profile and are used only for verification.

6. Your rights

Under the Kenya Data Protection Act, 2019, you have the right to access the personal data we hold about you, to have inaccurate data corrected, and to request deletion where we are not legally required to retain it. Use the Help & support link in the app to make a request.

7. Changes to this policy

If we make material changes to how we handle your data we will notify you in the app before the changes take effect.