Privacy Policy

We collect the following categories of information:

• Account Information: Business name, email, phone, BRN, KRA PIN, and uploaded KYB documents during registration.
• Lookup Query Data: The identifier values (ID numbers, BRNs, PINs) you submit for verification, along with timestamps and results stored in your lookup log.
• Usage & Technical Data: IP addresses, API key identifiers, request timestamps, HTTP status codes, and response times for security auditing and rate limiting.

We use the information we collect to:

• Verify your business identity through our KYB process
• Provide and operate the verification service
• Maintain lookup logs for your audit and compliance needs
• Detect and prevent fraud or abuse of the platform
• Communicate important updates about the service
• Calculate and deduct token usage from your balance

Under Kenya's Data Protection Act 2019, we process your data on the following legal bases: contractual necessity (to deliver the service), legitimate interests (security and fraud prevention), and legal obligation (compliance with applicable law).

We do not sell your data. We may share data only in the following limited circumstances:

• Service providers: Hosting, infrastructure and payment processors who are contractually bound to handle data securely.
• Legal requirements: When required by Kenyan law or a valid court order.
• Government data sources: Verification queries are transmitted to official government APIs to obtain results. No additional data beyond the lookup identifier is sent.

Account data is retained for the life of your account plus 12 months after closure. Lookup logs are retained for 24 months to support your compliance needs. KYB documents are retained for 5 years to comply with anti-money laundering obligations.

Under the Data Protection Act 2019, you have the right to access your personal data, correct inaccurate data, request erasure (where applicable), object to processing, data portability, and lodge a complaint with the Data Commissioner.

To exercise these rights, contact us via the Contact page.

We implement industry-standard security measures including TLS encryption in transit, encrypted storage for sensitive documents, API key hashing, and access logging. However, no system is completely secure and we cannot guarantee absolute security.

We use session cookies necessary for authentication and CSRF protection. We do not use third-party tracking or advertising cookies.

The Service is intended for registered businesses only and is not directed at individuals under 18. We do not knowingly collect data from minors.

We may update this Privacy Policy periodically. We will notify registered users of material changes by email at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.

For privacy-related questions or to exercise your rights, please contact us through the Contact page. We aim to respond within 5 business days.