Privacy contact: HauzPay, Rose Avenue, Kilimani, Nairobi, Kenya. Email support@hauzpay.africa or call +254 720 114 111. You can request account and data deletion without signing in.
1. Who this policy covers
This policy applies to account holders, business owners, administrators, staff, payment approvers, payees and people who contact HauzPay. It covers the HauzPay Android app (package com.africa.hauzpayapp), iOS app and websites.
HauzPay determines how information is used to operate accounts, secure the platform and provide its services. When your employer or another business provides information about you or manages your access, that business also determines how it uses that information. Ask its administrator about its own employee, customer and payment-record practices.
2. Information we handle
- Account and profile information: name, email address, telephone number, profile picture if supplied, account identifiers, authentication and verification information, preferences and support communications.
- Business and verification information: business name and contact details, registration or identity documents and identifiers where required for business activation or payment services, staff invitations, membership, roles, wallet access and approval permissions.
- Payment and financial records: wallet balances and activity; payee names, phone numbers, bank or payment account details, till and paybill numbers; payment amounts, currency, fees, references, status, receipts, statements, expense categories, notes, approvals and audit records. This includes details supplied by your business or returned by a payment provider to verify recipients and reconcile transactions.
- Content you choose to provide: profile images, receipts, payment attachments, documents, payment batches and information you send to support. Business users should only provide information about other people when authorized to do so.
- Contact selection: if you grant contacts access, names and phone numbers from your device are read to help you select a recipient. The current mobile contact picker keeps its address-book list in app memory; it does not upload the whole address book. Details you select and use in a payment or save as a payee are sent to the service for that action.
- Technical, security and diagnostic information: IP address, device and operating-system information, app version, session identifiers, timestamps, request and error details, crash reports, and records of sign-in and account or payment actions. Diagnostics may include user or account identifiers and context associated with an error.
We obtain information from you, authorized business users, your device when you allow access, and payment or verification providers as needed to deliver the service. We do not require access to your entire photo or video library to select an attachment.
3. Device permissions and optional features
- Contacts: used when you choose a recipient from your phonebook. You can enter a recipient manually instead and revoke contacts permission in device settings.
- Camera and selected photos/files: used when you take a profile photo or choose an image or document to upload. The system picker grants access to the item you select. Your chosen content is uploaded only as part of the relevant profile or attachment action.
- Notifications: used for service updates, payment activity and approvals where enabled. You can manage notification preferences in the app or device settings.
- Device security: where a device authentication feature is available, the operating system handles its biometric check. HauzPay does not receive your fingerprint or face template.
The app does not need microphone recordings, SMS message contents, call logs or precise GPS location for its current payment and expense-management functions. Denying an optional permission may prevent the related feature, but does not require you to grant unrelated access.
4. Why we use information
- Create and authenticate accounts, verify contact details and manage business access.
- Set up businesses and wallets, verify payees, process payments and airtime purchases, and provide receipts and reconciliation.
- Apply business approval rules, spending controls and role permissions; provide expense records, transaction history and statements.
- Send verification codes and service notifications, respond to support requests and resolve payment disputes.
- Detect fraud, prevent unauthorized access, investigate failures and improve reliability.
- Meet applicable legal and financial-record obligations and enforce service terms.
Depending on the activity and applicable law, processing is necessary to provide the requested service, meet legal obligations, protect legitimate interests such as security and fraud prevention, or act on your consent for optional access. You may withdraw consent for optional features; this does not reverse processing already lawfully performed.
5. Who receives information
Information is disclosed as needed for the purposes above:
- Your business and authorized staff: account, payee, payment, attachment and approval information is available according to their business roles and permissions. A business administrator may manage your access and view actions taken on the business account.
- Payment and verification providers: banks, mobile-money providers (including M-PESA/Safaricom for M-PESA transactions), airtime providers and other providers selected for your transaction receive the details required to process, verify, reconcile or investigate it. They may also retain information under their own legal duties and privacy notices.
- Service providers: hosting, database and file-storage providers, delivery services for email/SMS/push notifications, and security and diagnostic services support the platform. Sentry receives application error and crash diagnostics. In controlled staging or testing builds, session replay may be enabled for troubleshooting; it is disabled in the current production mobile configuration.
- Legal and business obligations: information may be disclosed to authorities, professional advisers or other parties when required by law, to investigate fraud or disputes, or in a business restructuring subject to appropriate confidentiality and data-protection requirements.
- At your direction: receipts, statements or documents you export or share go to the recipients you select.
HauzPay does not sell personal information. Payment data, contacts and uploaded files are used for service purposes, not to build advertising profiles.
6. Storage, international processing and security
Information is stored in service databases, file storage, operational records and limited device storage. Service providers may process data outside Kenya. Where applicable, we use contractual and other safeguards for international processing and limit access to the people and providers who need it.
Controls include encrypted network connections, authentication, business-scoped access controls, restricted roles, approval and verification checks for sensitive actions, and audit records. Authentication secrets must not be shared with other users. No system can guarantee complete security; contact support promptly if you suspect unauthorized access.
7. Retention and deletion
We retain account and business information while needed to provide the service and fulfill the purposes described here. Retention depends on the type of record, whether your account is active, outstanding transactions or disputes, security needs, applicable legal requirements and payment-provider obligations. We do not apply one universal retention period to all records.
You can request deletion of your HauzPay account and associated personal information by following the account and data deletion instructions or emailing support@hauzpay.africa. No app login is required to submit a request. We verify ownership before deleting information to prevent unauthorized requests.
After verification, personal account information and content that no longer needs to be retained will be deleted or anonymized. Records needed for payment reconciliation, accounting, legal obligations, fraud prevention or an unresolved dispute may be retained, with restricted use, for as long as the relevant reason applies. Business transaction records may also need to remain available to the business and payment providers. Account deletion does not erase their independent legal obligations.
We will explain any required retention or unresolved matter when handling your request and confirm the outcome. Residual backup copies may remain until the applicable backup cycle expires and are not used for ordinary service operations. Temporary suspension or disabling access is not the same as deleting your account.
8. Your choices and rights
Subject to applicable law and verification of your identity, you may request access to, correction of or deletion of your personal information, object to or restrict certain processing, withdraw optional consent, and request a copy of information where applicable. You can update available profile fields and permissions in the app or contact support.
If you use a business-managed account, requests may need coordination with its administrator to protect other users and preserve records the business is required to keep. We may ask for the minimum information necessary to verify your request. Do not email passwords, PINs or one-time verification codes.
You may raise a privacy concern with support@hauzpay.africa and, where applicable, complain to Kenya's Office of the Data Protection Commissioner or your local data-protection authority.
9. Cookies and local storage
Web and mobile services use session cookies or tokens and local storage to maintain sign-in, protect requests, remember preferences and cache information needed by the interface. Logging out or clearing app/browser storage removes some local information; it does not by itself delete your server-side account or financial records. The website may load assets such as fonts and scripts from external providers, which receive the network information needed to deliver them.
10. Children
HauzPay's business financial services are intended for adults aged 18 or older and are not directed at children. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.
11. Policy updates and contact
We may revise this policy when functionality, providers or requirements change. We will publish the updated version and date here, and provide additional notice or obtain consent when required. For questions, requests or complaints, contact HauzPay at support@hauzpay.africa, +254 720 114 111, or Rose Avenue, Kilimani, Nairobi, Kenya.