Privacy Policy
- We collect what's needed to route payments and keep accounts secure. That's it.
- Passwords are bcrypt-hashed, API keys hashed, secrets encrypted at rest.
- Your Customers' data is yours. We process it for you, as your processor.
- No selling data, no ad trackers, no third-party analytics.
- You have rights under Kenya's Data Protection Act 2019. Email us to use them.
The summary is a convenience. The full text below is what actually applies.
01Who we are
Paytrack is operated by Geninworld Limited, Kenya. This policy explains what personal data we process when you use the API, dashboard and docs, and what you can do about it. It's written against Kenya's Data Protection Act, 2019. Contact for anything privacy-related: esliehh@gmail.com.
02Controller or processor? It depends whose data
| Data about | Our role | What that means |
|---|---|---|
| You (account owners and users) | Controller | We decide how it's used, as described in this policy. |
| Your Customers (people who pay you) | Processor | You're the controller. We process their data only to run payments for you. Customers should contact the merchant they paid first. |
03What we collect
Only what's needed to make payments work and keep them secure:
| Category | Examples | Why | Source |
|---|---|---|---|
| Account | Business name, owner email, password (stored as a bcrypt hash, never in plain text), email verification state | Running your account, signing you in, contacting you | You |
| Google sign-in | Google account ID, email, and the name Google shares | Signing you in with Google, if you choose it | |
| Sessions & security | IP address, user agent, session and trusted-device records, sign-in and security events | Keeping accounts secure, detecting abuse, rate limiting, audit trail | Your browser |
| API keys | Key name, prefix, a one-way hash of the key, created and last-used times | Authenticating your backend | You |
| Channels | Destination type, bank code, PayBill or Till number, account numbers | Routing payments where you told us to | You |
| Payments | Customer phone number, amount, account reference, description, your metadata, Safaricom IDs, receipt numbers, result codes | Sending STK pushes, tracking outcomes, webhooks, your dashboard | You, your Customers, Safaricom |
| Webhooks | Webhook URL, signing secret (encrypted at rest), delivery attempts, response codes, errors | Delivering and replaying events to your backend | You, your server |
| Messages we send you (verification, security alerts, product notices) and delivery status | Account and security communication | Us | |
| Logs | Request IDs, paths, status codes, timings | Debugging, incident response, capacity planning | Your requests |
Never collected: M-Pesa PINs, card numbers, bank login credentials or your customers' account balances. Those stay between your Customers, Safaricom and their banks.
04Why we're allowed to (lawful bases)
- Contract: running your account and the payments you ask for.
- Legitimate interests: security, fraud prevention, abuse detection, debugging and improving the Service, balanced against your rights.
- Legal obligation: keeping records and responding to lawful requests from authorities.
- Consent: optional things like Google sign-in, which you can stop using at any time.
05Things we don't do
- We don't sell personal data or rent it out. Ever.
- We don't run ad trackers or third-party analytics scripts in the dashboard or docs.
- We don't contact your Customers for our own purposes or build profiles of them.
- We don't use your payment data to compete with you or to market to anyone.
07International transfers
Some providers above may store or process data outside Kenya. Where that happens, we rely on providers with strong security and contractual safeguards, as Kenyan data-protection law requires for cross-border transfers.
08Security, in actual technical terms
- TLS on every connection to the API and dashboard.
- Passwords hashed with bcrypt. API keys stored only as one-way hashes, so we can't show you a key again, and nobody else can either.
- Webhook signing secrets and other sensitive credentials encrypted at rest with a dedicated key.
- Session refresh token in an
httpOnlycookie that page JavaScript can't read. The access token lives only in memory. - Rate limiting, sign-in checks for unrecognised devices, and an audit log of security events.
- Least-privilege access to production, with secrets kept outside the codebase.
09How long we keep it
Account, channel and payment records are kept while your account is active. After closure we keep payment and transaction records only as long as we need them for legal, accounting, tax or dispute purposes, then delete or anonymise them.
Session, device and security records are kept for a limited period for security and then purged. Revoked API keys keep their metadata (never the key itself) so your audit trail stays intact.
11Your rights
Under the Data Protection Act, 2019 you can ask to:
- be told what data we hold about you, and get a copy;
- correct inaccurate data (most of it you can edit yourself in the dashboard);
- delete data we no longer have a reason to keep;
- object to or restrict processing based on legitimate interests;
- get your data in a portable, machine-readable format (JSON, naturally).
Email esliehh@gmail.com from your account email and we'll respond within the time the law allows. If you're not happy with our answer, you can complain to the Office of the Data Protection Commissioner (ODPC) in Kenya.
12Children
The Service is for businesses and developers. It isn't aimed at anyone under 18, and we don't knowingly create accounts for them.
13If something goes wrong
If we have a personal-data breach that's likely to put you at risk, we'll notify the ODPC and affected account owners without undue delay, explaining what happened, what data was involved, and what we're doing about it.
14Changes to this policy
This policy is versioned (see the top). We'll give you advance notice of material changes by email or in the dashboard. Related reading: Terms of Service and the Non-custodial Disclaimer.