Privacy Policy

Last updated: 6 July 2026

Introduction

This Privacy Policy explains how CloudPay ("we", "us") collects, uses, shares, and protects information when you use the CloudPay website, platform, API, and related services (the "Services"). By using the Services you agree to the practices described here and in our Terms & Conditions.

Information We Collect

Account data: name, business name, email, phone number, business type, and password (stored only as a secure hash).
Verification (KYC) documents: identity and business documents you upload for card verification. These are stored privately and are never exposed at a public URL.
Payment configuration: paybill/till/bank details, account numbers, API credentials, wallet account numbers, and callback (webhook) URLs you configure.
Transaction data: references, amounts, fees, phone numbers, M-Pesa receipt numbers, statuses, and provider result codes.
Technical data: IP address, timestamps, and audit/security logs.

Money & Payment Data

To move money we process payment details you supply and exchange the necessary transaction information with mobile money operators (such as Safaricom M-Pesa and Airtel Money), card networks, and banking partners. We record wallet balances, settlement and withdrawal requests, fees, and M-Pesa receipt numbers for reconciliation, fraud prevention, and legal compliance.

We do not store full card numbers or CVV — cards are tokenized, and we keep only a token, the card brand, and the last four digits.
Each M-Pesa receipt is recorded once to prevent duplicate crediting.
We are not a bank and hold only operational balances necessary to provide the Services; final settlement depends on the underlying provider.

How We Use Information

To provide, operate, and secure the Services and process transactions;
To verify your identity and business (KYC) and prevent fraud, abuse, and money laundering;
To send transactional messages — one-time login codes (OTP), receipts, and account and support notifications;
To deliver signed webhook callbacks to systems you configure;
To comply with legal, regulatory, and payment-partner obligations.

We share information only as needed to provide the Services: with mobile money operators, card networks, and banks to process payments; with service providers who host or support our infrastructure; and with regulators or law enforcement where required by law or to investigate fraud. We do not sell your personal information.

Data Retention & Security

We retain transaction, audit, and KYC records for as long as necessary to provide the Services and to meet legal and regulatory requirements. We apply technical and organisational safeguards including encrypted transport (HTTPS), hashed passwords, tokenized cards, private document storage, signed webhooks, and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your Choices & Rights

You may access and update your account details in your dashboard, request correction or deletion of certain data subject to our legal retention obligations, and control the callback URLs and integrations linked to your account. Contact us to exercise these rights.

Changes to This Policy

We may update this Policy from time to time and will post the revised version here with an updated date. Continued use of the Services after changes constitutes acceptance of the updated Policy.

Contact

For privacy questions or requests, contact support@pay.cloud.or.ke.