Privacy Policy

1. Information we collect

We collect information in three broad categories:

• Account and business information — name, email, phone number, business registration details, and identity documents you provide when creating a merchant account, as required for KYC (Know Your Customer) and AML (Anti-Money Laundering) compliance.
• Transaction data — payment references, amounts, currencies, timestamps, and provider-side confirmations (e.g. M-Pesa, Airtel Money, card networks, bank rails) needed to process, reconcile, and settle payments. KesPay does not store full card numbers or mobile money PINs.
• Usage data — pages visited, browser/device type, and approximate location (derived from IP address), collected via cookies and analytics tooling described in Section 5.

2. How we use information

• To process collections, disbursements, and settlements you request.
• To verify merchant identity and meet KYC/AML and other regulatory obligations.
• To detect, investigate, and prevent fraud, unauthorized transactions, and abuse.
• To provide customer and merchant support, including through our on-site AI assistant.
• To operate, maintain, and improve our website, dashboard, and APIs.
• To send service notices, security alerts, and — where you've agreed — product updates.

3. How we share information

We share data only where necessary to deliver the service:

• With payment networks and providers (e.g. mobile network operators, card schemes, banks) required to complete a transaction you or your customer initiated.
• With identity-verification and fraud-prevention partners, to meet compliance obligations.
• With regulators and law enforcement where required by applicable law.
• With infrastructure and analytics subprocessors who act under contract and only on our instructions.

We do not sell personal information.

4. Security

KesPay maintains PCI DSS–aligned controls, encrypts data in transit using TLS 1.2+, signs webhook payloads, and authenticates API access via client credentials and HMAC. Access to production data is limited to personnel who need it, and access is logged and reviewed.

5. Cookies and analytics

Our website uses strictly necessary cookies to operate, and — only if you accept the cookie banner — analytics cookies (Google Analytics) to understand aggregate traffic patterns. You can withdraw consent at any time by clearing your browser's local storage for this site and reloading the page, or by using your browser's cookie controls.

6. Data retention

We retain transaction and KYC records for the period required by applicable financial regulation in the markets we operate (typically five to seven years), and other account data for as long as your account is active plus a reasonable period thereafter for legal and audit purposes.

7. Your rights

Depending on your jurisdiction, you may have the right to access, correct, or request deletion of your personal information, and to object to certain processing. Contact us at privacy@kespay.africato exercise these rights; we may need to verify your identity and may be unable to delete data we're legally required to retain.

8. International transfers

As KesPay operates across multiple African markets, data may be processed in a country other than where you or your customer are located. We require subprocessors to apply security and confidentiality protections consistent with this policy wherever data is processed.

9. Changes to this policy

We may update this policy as our services or legal obligations evolve. Material changes will be reflected by updating the “Last updated” date above.

10. Contact us

Questions about this policy or your data can be sent to privacy@kespay.africa or support@kespay.africa.