How we collect, use, and protect your personal and financial data.
Endelea Finance Limited ("Endelea", "we", "us", "our") is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, share, and safeguard information about you when you use our mobile application, web platform, and related services (collectively, the "Services").
This policy is written in compliance with the Kenya Data Protection Act 2019 (DPA) and the Kenya Data Protection (General) Regulations 2021. By using our Services, you consent to the collection and use of your information as described in this policy.
The data controller for your personal data is:
When you register, we collect your full name, email address, phone number (in E.164 format, e.g. +254โฆ), and a securely hashed password.
With your explicit permission, we collect M-Pesa transaction data via SMS message content on Android devices. This includes: transaction amounts (stored as integer cents in KES), merchant or payee names, transaction types (send, receive, buy goods, pay bill, withdraw), and transaction timestamps. We do not have access to your M-Pesa PIN or Safaricom account credentials.
Data you manually enter including budget categories, goal targets, contribution amounts, and notes attached to transactions.
We collect app usage patterns, feature usage frequencies, device type and operating system version, and app version โ for the purpose of improving the platform and debugging issues.
If you connect with a financial advisor through the platform, the advisor's name, credentials, and your consent to share your data with them are recorded and stored.
We use your data for the following purposes, each grounded in a lawful basis under the DPA 2019:
Endelea accesses M-Pesa SMS messages on your Android device only to extract transaction details. This permission is granted explicitly by you during setup. We do not read, store, or process any other SMS messages on your device. The raw SMS message text is processed locally on your device and the extracted structured data is sent to our servers โ the raw SMS text is never transmitted or stored.
Endelea is not a payment service provider. We do not initiate, hold, or transfer funds on your behalf. M-Pesa integration is solely for subscription payment collection and transaction data capture.
Our AI features are powered by backend language models. We employ a privacy-first, federated learning architecture which means:
We do not sell your personal data. We may share data in the following limited circumstances:
We retain your data for as long as your account is active. If you cancel your subscription, your data is retained for 90 days to allow account reactivation, after which it is permanently deleted. If you request account deletion, your data is deleted within 30 days. Transaction records may be retained for up to 7 years in anonymised form for regulatory compliance purposes.
We protect your data using industry-standard security measures including:
Under the Kenya Data Protection Act 2019, you have the following rights:
To exercise any of these rights, submit a request through the app (Settings โ Privacy โ Data Requests) or email dpo@endeleafinance.com. We will respond within 30 days.
Our mobile app does not use cookies. Our marketing website uses essential cookies for session management, and optional analytics cookies (which you may decline). A full Cookie Policy is available separately.
Our Services are intended for users aged 18 and above. We do not knowingly collect personal data from anyone under 18. If you believe a minor has registered, please contact us immediately at dpo@endeleafinance.com and we will delete the account.
We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email and in-app notification at least 14 days before the changes take effect. Your continued use of the Services after the effective date constitutes acceptance of the updated policy.
For any privacy-related queries, data requests, or complaints:
If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya at www.odpc.go.ke.