Privacy Policy

1. About this policy

This Privacy Policy explains how KapuLetu Systems ("KapuLetu Systems", "we", "us" or "our") collects, receives, uses, stores, shares, protects and deletes personal data when you use KapuLetu, our treasury platform product, and its website, applications, WhatsApp or chatbot services, customer support and related services.

It applies to account holders, administrators, assistant treasurers, contributors and other people whose information is submitted to or processed through a customer workspace. It operates alongside our Terms of Service and any notices provided when particular information is collected.

KapuLetu is a product of KapuLetu Systems. This Policy applies to the personal data processing described below when you use our services.

2. Our role in processing

KapuLetu may act as a data controller for information where we decide why and how it is processed, such as account, billing, security, support, website and service-management information.

When an organization uses KapuLetu to manage its contributors, members, transactions or fundraising records, that organization may decide the purposes and means of processing and act as the controller. KapuLetu may process that information on the organization's behalf under the applicable customer arrangement. Roles depend on the service and customer relationship.

Service providers may process data for KapuLetu under appropriate contractual and security controls.

3. Information we may collect

• Account and identity information, such as name, email address, phone number, role, workspace membership, authentication information and account identifiers.
• Organization and workspace information, including group or organization names, campaign details, role assignments, settings, profile information and workspace configuration.
• Transaction and financial records, such as transaction references, amounts, dates, payment methods, contributor details, notes, group or campaign associations, approval status, splits, pledges, cash records and ledger information.
• Communications, including support requests, feedback, platform messages and information submitted through WhatsApp or chatbot services.
• Technical and usage information, such as IP address, device and browser details, operating system, application version, access timestamps, logs, security events, feature usage, errors and performance information.
• Billing information, such as subscription plan, invoices, payment status and transaction references. A payment provider may handle payment credentials directly; in that case, KapuLetu may receive only limited related information.
• Information contained in messages, receipts, screenshots, documents or other material you choose to upload or forward for processing.
• Information reasonably needed to provide support, verify an account, investigate an incident, respond to a request or record marketing preferences.

4. Information about contributors and other people

A customer may submit information about contributors, members, donors, committee participants or other people who do not have a KapuLetu account. Customers are responsible for having the authority and lawful basis to submit that information and for providing any notices required by law.

KapuLetu processes this information for authorized service purposes under the applicable customer arrangement and this Policy. Do not submit information about another person unless there is a lawful and legitimate reason to do so.

5. Sensitive information

The service is not intended to collect sensitive or special-category personal data unless it is necessary for a lawful, supported service purpose. Do not include unnecessary sensitive information in free-text fields, messages or uploads.

If sensitive information is submitted inadvertently, we may restrict access, delete it or take other appropriate steps, subject to applicable law and legitimate retention requirements.

6. How information is collected

• Directly from you when you register, create a profile or workspace, configure the service, contact support or use the platform.
• From customer organizations or authorized administrators who create or manage workspace records.
• From transaction messages, files and other information submitted through the platform or supported messaging channels.
• Automatically from devices and browsers through service logs, security controls, analytics and similar technical mechanisms.
• From service providers where needed to authenticate users, communicate, process payments, provide infrastructure or maintain the platform.

7. Why we use information

• Create and administer accounts and workspaces, authenticate users and apply role-based access.
• Receive, interpret, organize and display transaction information submitted through supported channels.
• Maintain ledgers, transaction histories, approvals, reports, dashboards and other requested treasury functions.
• Provide support, troubleshoot issues, communicate about the service and administer subscriptions and invoices.
• Protect the platform, detect fraud or abuse, investigate incidents and maintain security.
• Monitor service reliability and performance and develop or improve the service, subject to applicable law and appropriate safeguards.
• Meet legal, regulatory, contractual and record-keeping obligations.
• Send service, operational or marketing communications where permitted by law and, where required, with your consent or another lawful basis.

8. Legal bases

Depending on the activity and applicable law, processing may be based on your consent, the performance of a contract, compliance with a legal obligation, our legitimate interests or another lawful basis recognized by law.

Where we rely on consent, it should be freely given, specific and informed, and may be withdrawn subject to legal limitations and the consequences of withdrawal. Where we rely on legitimate interests, those interests must be considered against the impact on individuals and applicable legal requirements.

9. Automated transaction processing

The platform may use automated processing to interpret transaction messages and extract information such as amounts, dates, references and contributor details. Automated results may be inaccurate, incomplete or ambiguous.

The service supports review and approval workflows; it does not guarantee that every parsed record is correct. Users remain responsible for reviewing records before approval, reconciliation, reporting or other consequential use. Source messages and processing records may be retained for auditability and service operation, subject to applicable retention rules.

To improve how KapuLetu reads payments and understands requests, we may use receipts you approve, corrections you make and messages you send to our assistant (Letu) to measure and train our own models. Before messages are kept for this purpose, names and phone numbers are masked. This information is used only to improve KapuLetu and is not sold or shared with third parties for their own purposes.

This is on by default. You can switch it off at any time under Settings > Automation & AI ("Help improve Kapuletu AI"). Switching it off stops your future receipts, corrections and messages being used for this purpose and does not affect how the service works for you.

To check and improve its answers, authorized KapuLetu staff may read masked copies of what is asked of our assistant and how it replied, without the name of the account they came from. These copies are deleted after 180 days. Masking is automated and may not catch every detail, so please do not share passwords, PINs or similar secrets with the assistant.

If you use the assistant on our public website, we keep a masked copy of your question and its answer for the same purpose, linked only to a random identifier for that chat. It cannot see or change any account. Please do not share payment messages or personal details in that chat.

10. When we share information

KapuLetu does not sell personal data as a product.

• With authorized customer administrators and workspace users, according to their permissions and the customer's configuration.
• With service providers supporting hosting, databases, authentication, messaging, monitoring, analytics, customer support, payments and other operations.
• Where disclosure is required by law, a court, a regulator or a lawful government request.
• Where reasonably necessary to protect rights, property, safety or security, or to investigate suspected fraud, abuse or security incidents.
• In connection with a merger, acquisition, financing, restructuring or asset sale, subject to applicable law and appropriate safeguards.

11. Third-party services and messaging

We may use third-party providers for infrastructure, authentication, email or SMS, WhatsApp and other messaging, analytics, payments and support. Those providers may process information under their own terms and privacy practices and, where applicable, on our behalf under contractual controls.

Messages sent through WhatsApp or another messaging provider may also be processed by that provider. We may use message metadata and delivery information to operate, secure and troubleshoot integrations. Avoid sending information that is not necessary for the requested service.

The final list of providers is maintained through internal vendor and data-processing records and may change as the service evolves.

12. International transfers

Some providers or infrastructure may process or store information outside Kenya. Where personal data is transferred outside Kenya, the transfer is subject to safeguards and legal requirements that apply, which may include an adequacy assessment, contractual safeguards or consent. The locations depend on the providers used.

13. How long we keep information

We retain personal data for as long as reasonably necessary to provide the service, meet contractual requirements, resolve disputes, maintain security, comply with legal obligations and enforce agreements. Retention periods vary by category and purpose.

When information is no longer required, it may be securely deleted, anonymized or otherwise handled in accordance with applicable law and documented retention procedures. Some information may need to be retained after account closure for legal, dispute-resolution, security, fraud-prevention or audit purposes.

14. Your data protection rights

Subject to applicable law and lawful limitations, you may have the right to be informed about processing, access your personal data, request correction or deletion, object to or restrict processing, request portability, and withdraw consent where consent is the relevant legal basis.

We may ask for reasonable information to verify your identity. If an organization is the controller of information in its workspace, you may need to direct your request to that organization; we will provide assistance where required by law or contract. We will respond within applicable legal time limits and explain any lawful reason for limiting or refusing a request.

15. Accuracy and customer responsibilities

Users and customer organizations are responsible for keeping submitted information accurate and up to date. The platform may provide ways to review and correct transaction or profile information; where we identify inaccurate data, we may correct, restrict or delete it as appropriate.

Customers should use the platform lawfully, ensure they have authority to submit information, protect credentials, configure workspace permissions appropriately, remove users who no longer need access and provide required notices to contributors and other people. Do not upload unnecessary sensitive data or information you are not authorized to process.

16. Security and personal data incidents

KapuLetu maintains technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, loss or destruction. Depending on the service and controls in place, measures may include access controls, authentication, role-based permissions, encryption in transit and at rest where supported, secure secrets management, logging, monitoring, backups, environment separation, vulnerability management and controlled administrative access.

No internet-based system can guarantee absolute security. Users should protect their credentials and promptly report suspected compromise. We maintain procedures to identify, contain, investigate and respond to personal data incidents. Where applicable law requires notification to a regulator or affected individuals, notifications will be made as required by law.

17. Cookies and similar technologies

The website or application may use cookies, local storage, pixels, analytics and similar technologies to maintain sessions, improve security, remember preferences, measure usage and improve the service. Where required, non-essential technologies will be used only with appropriate notice and consent mechanisms.

18. Children's information

The KapuLetu Treasury Platform is intended for adults and authorized organizations and is not intended for independent account creation by children. Customers must not submit children's personal data unless they have a lawful basis and have met applicable requirements. If we become aware that children's data was collected unlawfully, we may take steps to delete or restrict it.

19. Service and marketing communications

We may send service and transactional communications needed to operate accounts, security, billing and requested features. Marketing communications will be handled in accordance with applicable law and your preferences. You may opt out where an opt-out mechanism is provided; essential service communications may still be sent.

20. Privacy by design and impact assessments

KapuLetu seeks to consider privacy and security in product architecture, workflows and development, and to limit access according to role and business need. New features involving substantial personal-data processing may be reviewed for privacy and security before release.

Where processing is likely to create a high risk to individuals, we will assess whether a Data Protection Impact Assessment or other formal assessment is required and, where required, document the risks and mitigation measures.

21. Complaints and contact

For questions, requests or complaints about personal-data processing, contact us at support@kapuletu.co.ke or +254703900449. Please include enough information to identify your account or request, but do not send unnecessary sensitive information.

Where an issue cannot be resolved internally, you may have the right to complain to the Office of the Data Protection Commissioner or another competent authority, subject to applicable law. You may contact us at support@kapuletu.co.ke or +254703900449, or use our Contact Support page.

• Office of the Data Protection Commissioner

22. Changes to this policy and governing law

We may update this Policy to reflect changes in law, technology, services or business practices. Material changes will be communicated through an appropriate channel where required.

This Policy is governed by the laws of Kenya, subject to any mandatory legal requirements applicable to a particular individual or processing activity.

• Kenya Data Protection Act, 2019
• Data Protection (General) Regulations, 2021