1. Who is the data controller
Ahadi.App is the data controller for personal information you give us. You can reach our privacy team at privacy@ahadi.app.
2. What we collect
- Identity data — name, phone number, email, date of birth, and government ID details submitted for KYC.
- Account data — display name, role (Sender / Receiver / Chama member), login history, device information.
- Transaction data — deal amounts, M-Pesa references, payout accounts, ledger entries, dispute evidence you upload.
- Support and communication data — messages you send us, notification preferences, satisfaction ratings.
- Technical data — IP address, browser, cookies (see the Cookie policy), diagnostic logs.
3. Why we use it
- To run the escrow service — accepting funds, releasing payouts, resolving disputes.
- To meet legal obligations — KYC, sanctions screening, tax and record-keeping rules.
- To prevent fraud and abuse — risk scoring, device checks, watchlist matches.
- To communicate — receipts, security alerts, product updates you've opted into.
- To improve the product — aggregated, non-identifying analytics.
4. Legal bases
We rely on contract (to deliver escrow you asked for), legal obligation (KYC / AML rules), legitimate interest(fraud prevention, product improvement) and consent where required (e.g. marketing emails).
5. Who we share with
- The other side of your deal — a Receiver sees the Sender's display name and amount; a Sender sees the Receiver's display name.
- Payment partners — M-Pesa (Safaricom) and any card/bank processors we use to move money.
- Infrastructure vendors — hosting, email delivery, error monitoring, KYC verification providers.
- Regulators and law enforcement — when we're legally required to disclose.
We never sell personal data.
6. How long we keep it
Account data: while your account is open. Transaction and KYC records: for the period required by Kenyan financial law after the last transaction (currently seven years). Support tickets: up to three years. Analytics: in aggregated form only after 24 months.
7. Your rights
You can ask us to:
- Access the personal data we hold about you.
- Correct anything that's wrong.
- Delete data we no longer need to keep for legal reasons.
- Restrict or object to certain uses.
- Export your data in a common format.
Email privacy@ahadi.app. We reply within 30 days.
8. Security
We use encryption in transit, hashed credentials, role-based access controls, audit logs on sensitive actions, and multi-factor authentication for staff. No system is perfectly secure — report suspected issues to security@ahadi.app.
9. Children
Ahadi is not for anyone under 18. We don't knowingly collect data from minors.
10. Changes to this policy
We'll post changes here and, for material updates, notify you in-app or by email before they take effect.