Privacy Policy

AutoPayKe Limited ("AutoPayKe", "we", "us", "our") is committed to protecting the privacy of our users. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the AutoPayKe mobile application, web application, and related services (the "Service").

This policy complies with the Kenya Data Protection Act 2019 (DPA), the EU General Data Protection Regulation (GDPR) where applicable, and other applicable privacy laws.

By using the Service, you consent to the collection and use of information as described in this Privacy Policy. If you do not agree, please do not use the Service.

2.1 Information you provide directly:

• Phone number : required for account creation and transaction routing;
• Email address : optional, used for account recovery and communications;
• Identity documents : collected for KYC/AML compliance when required;
• Transaction details : recipient phone, amounts, notes, and purpose of transfer.

2.2 Information collected automatically:

• IP address : captured at account creation, login, and transaction submission;
• Device information : browser type, OS, device model, and screen resolution;
• Session data : login times, session duration, and navigation within the app;
• On-chain data : all transactions are recorded publicly on the Avalanche blockchain, including wallet addresses and amounts (but not personal identity).

2.3 Information from third parties:

• Transaction status and confirmation data from mobile money operators (Safaricom M-Pesa, MTN MoMo, etc.);
• KYC/identity verification results from regulated compliance partners.

We use your personal data to:

• Provide the Service : process transactions, verify your identity, and maintain your account;
• Comply with legal obligations : AML/KYC reporting, tax requirements, and responses to lawful regulatory requests;
• Fraud prevention and security : detect, investigate, and prevent fraudulent transactions and account takeovers;
• Communications : send transaction confirmations, OTPs, security alerts, and service updates;
• Customer support : respond to your inquiries and resolve disputes;
• Service improvement : analyse usage patterns (using anonymised or aggregated data) to improve the Service;
• Legal proceedings : establish, exercise, or defend legal claims.

We do not sell your personal data to third parties for marketing purposes.

For users in the European Economic Area or where GDPR applies, we process your data on the following legal bases:

• Contract performance : processing necessary to provide the Service you requested;
• Legal obligation : compliance with AML, KYC, and reporting requirements;
• Legitimate interests : fraud prevention, security, and service improvement;
• Consent : where explicitly requested (e.g., marketing communications).

We share your data only as necessary to provide the Service:

• Pretium : payment gateway for local currency funding and settlement;
• Safaricom / M-Pesa, MTN MoMo, Wave, Orange Money : for mobile money settlement of transfers;
• Twilio : SMS delivery of OTPs;
• Resend : email delivery of OTPs and notifications;
• Neon / PostgreSQL : encrypted database hosting;
• Avalanche Foundation : the public blockchain on which wallet transactions are recorded;
• Regulatory authorities : the Financial Reporting Centre (FRC) of Kenya, Central Bank of Kenya, and equivalent bodies where required by law.

All third-party processors are bound by data processing agreements and are required to maintain appropriate security standards.

We retain your personal data for as long as your account is active and for a period thereafter as required by law:

• Account data : retained for 7 years after account closure (AML record-keeping requirements);
• Transaction records : retained for 7 years (POCAMLA requirement);
• Session and access logs : retained for 12 months;
• OTP / authentication logs : retained for 90 days.

Data retained solely for legal compliance purposes is restricted to authorised personnel and not used for any other purpose.

We implement technical and organisational security measures appropriate to the risks involved, including:

• End-to-end encryption of data in transit (TLS 1.3);
• Encryption of sensitive fields (phone numbers, wallet keys) at rest;
• Phone number hashing before any on-chain registration;
• Multi-factor authentication (OTP + PIN) for account access;
• Access controls limiting staff access to production data;
• Regular security reviews and penetration testing.

No method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee its absolute security.

Under the Kenya Data Protection Act 2019 and applicable law, you have the right to:

• Access : request a copy of the personal data we hold about you;
• Rectification : request correction of inaccurate or incomplete data;
• Erasure : request deletion of your data (subject to legal retention obligations);
• Restriction : request that we restrict processing of your data in certain circumstances;
• Portability : receive your data in a structured, machine-readable format;
• Object : object to processing based on legitimate interests;
• Withdraw consent : where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact our Data Protection Officer at privacy@autopayke.com. We will respond within 30 days. We may need to verify your identity before fulfilling the request.

AutoPayKe uses the Avalanche public blockchain to process transactions. Transaction data recorded on-chain (wallet addresses, amounts, timestamps) is public and cannot be deleted: this is an inherent property of public blockchains.

We minimise on-chain personal data: your phone number is never stored on-chain; instead, a one-way cryptographic hash (keccak256) of your number is used to link your wallet address to your account in the AutoPayKe registry contract.

The Service is not directed to children under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us at privacy@autopayke.com and we will take steps to delete it promptly.

Your data may be processed in countries outside Kenya, including the United States (Neon, Resend, Twilio) and the European Union. We rely on appropriate safeguards (standard contractual clauses, adequacy decisions) to ensure such transfers comply with applicable law.

We may update this Privacy Policy from time to time. Material changes will be notified via the app and/or email. The "Effective date" at the top of this page indicates when the current version was last updated. Continued use of the Service after changes constitutes acceptance of the updated policy.

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices:

• Email: privacy@autopayke.com
• Website: https://www.autopayke.com

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya (ODPC) at odpc.go.ke.