Privacy Policy

This Privacy Policy explains what information we collect when you use Payzaapi, how we use it, who we share it with, and what rights you have over your data. By creating an account or using any Payzaapi service, you agree to the practices described in this policy.

Payzaapi is operated by a business based in Nairobi, Kenya, and we comply with the Kenya Data Protection Act, 2019 and applicable international data protection standards.

We collect information you provide directly to us, information generated through your use of the platform, and in some cases, information from third-party services.

We do not store raw card numbers, CVVs, or full M-Pesa PINs. Sensitive payment credentials are handled by our certified payment partners (Korapay, Tuma.co.ke) under their own security standards.

We use the information we collect to provide, operate, and improve Payzaapi. Specifically:

• Provide our services — operate your dashboard, process transactions, manage your store and inventory
• Send notifications — email receipts, withdrawal confirmations, security alerts, and important account updates
• Security and fraud prevention — monitor for suspicious activity, protect accounts, and investigate fraud
• Customer support — respond to your queries, resolve disputes, and improve our service
• Platform improvement — analyse usage patterns, fix bugs, and develop new features based on how merchants use Payzaapi
• Legal compliance — meet our obligations under Kenyan law, financial regulations, and tax requirements
• Personalisation — tailor your dashboard experience, default currency, and recommended features to your country and usage

We will never sell your personal data to third parties for marketing purposes. We do not send unsolicited commercial emails without your consent.

We only share your information where necessary and with trusted parties:

• Payment processors — Korapay and Tuma.co.ke receive transaction data required to process your payments and payouts
• Email service providers — to deliver transactional emails (receipts, confirmations, alerts)
• Hosting & infrastructure — our servers and cloud services store your data securely in Kenya
• Legal authorities — we may disclose information if required by Kenyan law, court order, or to protect the rights and safety of users
• Business transfers — in the event of a merger or acquisition, user data may be transferred as part of business assets, with notice provided

All third-party partners we work with are contractually required to protect your data and use it only for the purpose we specify.

When you or your customers make payments through Payzaapi:

• All connections are encrypted using TLS 1.2+ (HTTPS)
• M-Pesa STK push requests are processed directly by Tuma.co.ke — your PIN never touches our servers
• Korapay handles all card and bank payment data under their own PCI-DSS Level 1 certification
• Withdrawal bank account numbers are encrypted at rest in our database
• We store only the minimum payment data required for transaction records and dispute resolution

We implement multiple layers of security to protect your data:

• All passwords are hashed using bcrypt with unique salts — we cannot see your password
• Sensitive settings and API keys are encrypted in our database
• Session tokens are rotated on every login and expire automatically
• Rate limiting and brute-force protection on all login and payment endpoints
• Comprehensive audit logs track all admin actions and financial transactions
• Regular security reviews and vulnerability assessments

While we employ strong security measures, no system is 100% impenetrable. We encourage you to use a strong unique password and enable two-factor authentication on your Payzaapi account.

We retain your data for as long as your account is active and for a period after closure to meet legal and financial obligations:

• Account data — retained for 7 years after account closure to comply with Kenyan financial record-keeping requirements
• Transaction records — retained for a minimum of 7 years for tax and regulatory compliance
• Support communications — retained for 3 years
• Usage logs — retained for 12 months for security monitoring
• Marketing data — deleted immediately upon unsubscribe request

When data is no longer required, it is securely deleted or anonymised so it can no longer be linked to you.

Under the Kenya Data Protection Act, 2019 and applicable regulations, you have the following rights:

• Right of access — request a copy of all personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your data (subject to legal retention obligations)
• Right to object — object to how we use your data for specific purposes
• Right to portability — receive your data in a structured, machine-readable format
• Right to withdraw consent — withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. Some requests may be limited where we have a legal obligation to retain data.

Payzaapi uses cookies and similar technologies to operate the platform and improve your experience:

• Session cookies — essential for keeping you logged in. These expire when you close your browser
• Security cookies — CSRF tokens and security identifiers to protect your account from attacks
• Preference cookies — remember your settings and preferences between visits
• Analytics cookies — help us understand how the platform is used so we can improve it (anonymised)

We do not use third-party advertising cookies. You can disable non-essential cookies in your browser settings, though this may affect certain platform features.

Payzaapi is a business management and payments platform intended for adults and registered businesses. We do not knowingly collect personal data from anyone under the age of 18.

If you believe a minor has created an account or provided us with personal data, please contact us immediately at [email protected] and we will delete the information promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. When we make significant changes, we will:

• Update the "Last updated" date at the top of this page
• Send an email notification to all registered account holders
• Display a prominent notice on the dashboard for 30 days after the change

Continued use of Payzaapi after changes become effective constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please reach out to us: