Terms of Service

01The agreement

These Terms of Service (the "Terms") are a contract between you and Geninworld Limited ("we", "us"), the company behind Paytrack. They cover the API, the dashboard at paytrack.pesagrid.co.ke, the docs, and anything else we ship under the Paytrack name (together, the "Service").

By creating an account, ticking the box at sign-up, or sending an authenticated request, you accept these Terms, the Privacy Policy and the Non-custodial Disclaimer. If you're accepting for a company, you confirm you're authorised to bind it, and "you" means that company.

02Definitions

03What the Service does

Paytrack lets your software ask Safaricom M-Pesa to prompt a Customer for payment, routes that payment to your Channel, tracks it to a final state, and notifies your backend with signed webhooks. The behaviour is documented in the API docs. Treat them as part of these Terms for technical matters.

04Your account

• Give accurate registration details and keep them current, especially your email, which is how we reach you about security and incidents.
• Verify your email before using transacting features. Some endpoints refuse unverified accounts.
• You're responsible for everything done through your account and its API keys, by you or anyone you let in.
• Use a strong, unique password. Turn on the extra sign-in checks we offer.
• Tell us promptly at esliehh@gmail.com if you suspect unauthorised access.

05API keys and integration hygiene

API keys (ptk_…) are bearer credentials. Whoever holds one can act as your account. So:

• keep keys server-side, and never ship them in web pages, mobile apps or public repos;
• revoke any key you think has leaked, then create a new one;
• verify webhook signatures and dedupe on event ID, as described in the webhook docs;
• send a stable Idempotency-Key on every payment so retries don't double-charge.

Losses caused by a leaked key, unverified webhooks or missing idempotency on your side are your responsibility.

06Acceptable use

Don't use the Service to:

• break any law, including Kenyan anti-money-laundering, counter-terrorism-financing, consumer-protection and data-protection law;
• sell illegal goods or services, or run fraud, scams, pyramid schemes or unlicensed gambling or lending;
• send STK prompts to people who haven't asked to pay you, or spam prompts to pressure anyone into paying;
• impersonate another business, or misdescribe what a Customer is paying for;
• breach Safaricom's M-Pesa terms or your bank's terms;
• probe, scan, load-test or attack the Service, get around rate limits, or access accounts that aren't yours;
• resell or white-label the Service without our written agreement.

Responsible security research is welcome. Email us first, don't touch other people's data, and give us reasonable time to fix issues before disclosing.

07You are the merchant

• The sale is between you and your Customer. You handle pricing, delivery, receipts, refunds, complaints and disputes.
• You're responsible for any licences, tax registrations and invoicing your business needs.
• You check that your Channel details are correct. Money goes exactly where you configure it, and we can't redirect or recover it.
• You tell your Customers how you process their data, including that you use a payment-routing provider.

08Fees

Safaricom M-Pesa and bank charges apply according to their own tariffs, and those are between you, your Customers and those providers. If we introduce Paytrack fees, we'll publish them and give you at least 30 days' notice before they apply to your account.

09Availability and changes

We aim for high availability and design for failure (retries, reconciliation, idempotency), but we don't promise the Service will be uninterrupted or error-free. It depends on Safaricom, hosting providers and the public internet, none of which we control.

We may add, change or remove features. For breaking API changes to /v1 we'll give reasonable advance notice, except where a change is needed urgently for security or legal reasons.

10Data protection

We handle personal data as described in the Privacy Policy. For your Customers' data, you're the data controller and we process it on your instructions, to provide the Service. You confirm you have a lawful basis to share that data with us. You own Your Data. You give us the licence we need to host, process and transmit it to run the Service.

11Intellectual property

The Service, its code, design, docs and brand belong to Geninworld Limited. We grant you a limited, non-exclusive, non-transferable right to use it while your account is in good standing. You can copy code samples from the docs into your own integration freely. If you send us feedback, we may use it without owing you anything.

12Suspension and termination

You can stop using the Service and close your account at any time. We may suspend or close an account, or block specific Channels or keys, if we reasonably believe it's needed to stop fraud, a breach of these Terms, a security risk, or harm to Customers, Safaricom or us. Where we safely and lawfully can, we'll tell you why.

Because we hold no funds, closing an account never traps your money. Payments already in flight still finish at Safaricom, and we'll keep records as required by law (see the Privacy Policy).

13Disclaimer of warranties

Beyond the commitments written in these Terms, the Service is provided "as is" and "as available". To the fullest extent the law allows, we disclaim implied warranties of merchantability, fitness for a particular purpose and non-infringement. Payment statuses are information, not a guarantee of funds; see the Disclaimer.

14Limitation of liability

To the fullest extent the law allows:

• we aren't liable for indirect, incidental or consequential losses, or for lost profits, revenue, goodwill or data;
• we aren't liable for acts or failures of Safaricom, banks, hosting providers or other third parties;
• our total liability for all claims in any 12-month period is capped at the greater of the fees you paid us in that period and KES 10,000.

Nothing here limits liability that the law says can't be limited, such as liability for fraud.

15Indemnity

You'll defend and indemnify Geninworld Limited against third-party claims arising from your products or services, your dealings with your Customers, your breach of these Terms, or your breach of law. That includes claims from Customers about goods, refunds or prompts they didn't ask for.

16Changes to these Terms

We version these Terms (see the version at the top). For material changes we'll notify you by email or in the dashboard at least 14 days before they take effect. If you keep using the Service after that, you accept the new version. If you don't agree, close your account before the change takes effect.

17Governing law and disputes

These Terms are governed by the laws of Kenya. Before going formal, email us and we'll try to resolve things in good faith within 30 days. If that fails, the courts of Kenya have exclusive jurisdiction.

18The boilerplate

• If one clause turns out to be unenforceable, the rest still applies.
• Not enforcing a clause right away doesn't mean we've waived it.
• You can't transfer these Terms without our consent. We may transfer them as part of a merger or sale of the business.
• These Terms, the Privacy Policy and the Disclaimer are the whole agreement about the Service.
• Contact: esliehh@gmail.com.