Privacy Policy

• Account information — name, email address, phone number, ID number for KYC verification.
• Payment data — M-Pesa transaction IDs, rent payment records, wallet balances and withdrawal history.
• Usage data — feature interactions, screen views, crash logs and performance metrics.
• Device information — device model, operating system version, IP address and push notification tokens.
• Location data — property addresses you add or manage (we do not track GPS location).

• Service delivery — processing rent payments, managing tenancies and property listings.
• Payment processing — integration with Safaricom's Daraja API for M-Pesa transactions.
• Communication — sending payment receipts, account updates, support responses and important notices.
• Security — fraud detection, account protection, session management and device verification.
• Analytics — platform improvement, usage trends and crash reporting (anonymized).

We only share your data when necessary and never sell personal information to third parties:

• Payment processors — Safaricom (M-Pesa) for processing transactions.
• Cloud infrastructure — Supabase for database hosting and file storage.
• Legal authorities — when required by Kenyan law or a valid court order.

We protect data through encryption in transit (HTTPS/TLS) and at rest within our Supabase database. Access controls, audit logs, and server-side security functions enforce data integrity. Multi-factor authentication is required for all administrative access. Security practices are reviewed regularly. We do not sell user data to third parties and limit third-party tracking where possible.

When you delete your account, your account data is removed immediately. Transaction records required by Kenyan financial regulations are retained separately as required by law (up to 7 years). Usage logs are anonymized after 12 months. You may request earlier deletion of personal data by contacting us.

Under the Kenya Data Protection Act, 2019, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Deletion — request deletion of your personal data (subject to legal retention requirements).
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing of your data for specific purposes.
• Complaint — lodge a complaint with the Office of the Data Protection Commissioner (ODPC) Kenya.

We use essential cookies for authentication and platform functionality — these are required for the app to work. Analytics cookies help us understand usage patterns and improve the platform. You can control cookie preferences through your browser settings. Third-party tracking is limited to our payment partners (Safaricom).

kodiipay is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will delete it immediately. Guardians who believe their child has provided data should contact us at kodiipay.support@gmail.com.

Your data is primarily stored on servers within Kenya. When data is transferred internationally (e.g., to Supabase infrastructure), we ensure adequate safeguards including Standard Contractual Clauses and compliance with the Kenya Data Protection Act, 2019.

We will notify you of material changes via email and in-app notification at least 30 days before they take effect. The date at the top of this policy reflects the latest revision. Your continued use after changes take effect constitutes acceptance of the updated policy.