Privacy Notice

How Intelli-Cash protects personal data

Intelli-Cash digitises savings groups, so we handle personal and financial records with the same discipline the groups themselves practice. This notice explains what we collect, why, and your rights under the Kenya Data Protection Act, 2019.

What We Collect

Only what the service needs

Group membersName, phone number, group role, meeting attendance, savings and loan records, hashed national ID
Purpose: Running group meetings, passbooks, and credit readiness on behalf of your group
Store buyers and booking visitorsName, email, phone number, county, group or business name
Purpose: Reviewing product credit requests and arranging VA / CBT field support
Partner and programme contactsContact name, work email, work phone, organization details
Purpose: Operating partner programmes, funding, and reporting
Platform usersLogin email, password (stored as a bcrypt hash), role, session records
Purpose: Authenticating you and scoping what your account can see

How We Protect It

Protection built into the platform

These controls are part of the software itself, not just policy on paper. They are documented for partners and auditors in our data protection protocol.

ControlPasswords, meeting PINs, and OTPs are stored only as strong one-way hashes; national ID numbers are stored hashed, never in plain text.
ControlPIN and OTP SMS content is encrypted at rest, and phone numbers are masked in operational screens and SMS delivery logs.
ControlPayment and SMS provider credentials are stored encrypted; webhooks and payments carry references, not card or wallet secrets.
ControlAccess is role-scoped: members see their own records, group accounts see their group, partners see their programmes, and only platform administrators see cross-programme data.
ControlPublic pages and public API responses never include member records, and staff contact details (agents, suppliers, partner contacts) are limited to names and coverage areas.
ControlRequest logs carry trace IDs, not request bodies, and sensitive query values are redacted before logging.
ControlFinancial records are append-only with an audit trail, so changes are attributable and reviewable.

Your Rights

You stay in control of your data

Under the Kenya Data Protection Act, 2019 you can, at any time:

RightAsk what personal data we hold about you and receive a copy
RightAsk us to correct inaccurate or outdated details
RightAsk us to delete data we no longer need for the purposes above
RightWithdraw consent for a request you submitted through a public form
RightComplain to the Office of the Data Protection Commissioner (Kenya) if you believe your data is mishandled

To exercise any of these rights, contact support@intellicash.co.ke or call +254 700 000 000. We respond within 14 days. Retention: public store and booking requests are kept for 24 months after closure; group financial records are kept for the life of the group plus statutory retention periods; server logs are kept for 90 days.