Your group's data stays with the group.

Identity is a verified phone number — we never collect identity documents. Here is what we collect, how M-Pesa works, and how advertising uses your data.

Last updated: 11 June 2026

[PLACEHOLDER — this privacy policy is a structural draft and requires legal review before launch.]

This Privacy Policy explains how Chama ("we", "us") collects, uses, and protects your information. [PLACEHOLDER — draft for review.]

Information we collect

To operate groups, we collect the following:

Your phone number — used as your identity and to send alerts. We do not collect national ID, passport, or other identity documents.
Group profile — name, type (social, savings, ROSCA), and settings your group chooses.
Transactions — contributions, loans, repayments, and adjustments recorded in the ledger.
Device and usage data — basic logs needed to keep the service working and secure.

We do not collect identity documents (KYC). Identity is a verified phone number only.

Mobile money (M-Pesa)

When you pay via M-Pesa, payment details are processed by Safaricom and our payment provider. We store confirmation records (amount, status, reference) so the ledger stays accurate. We do not store your M-Pesa PIN or full financial account credentials.

How we use your information

We use your information to:

create and operate your groups and memberships;
record and reconcile the ledger;
send transaction and group notifications;
keep the service secure and prevent abuse.

Advertising and your data

Chama is free for groups because financial institutions may show relevant, clearly labelled offers. We use limited group-level context (such as group type) to make offers relevant. We do not sell your personal data, and your individual financial activity is never shared with advertisers.

Sharing

We share information only:

with payment and messaging providers needed to run the service;
with other group members, as required for group records;
where required by law.

Data retention

Ledger records are kept as long as your group exists because they are the source of truth and are append-only. Other data is kept only as long as needed to provide the service or as required by law. You can request deletion of your account where applicable.

Your rights

You can access your own data, request correction of inaccurate information, and ask about deletion where applicable. [PLACEHOLDER — exact rights and process to be confirmed by legal review.]

Contact

Privacy questions can be sent to privacy@yourchama.com.