How we collect, use, and protect your personal and financial data.
Endelea Finance Limited ("Endelea", "we", "us", "our") is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, share, and safeguard information about you when you use our mobile application, web platform, and related services (collectively, the "Services").
This policy is written in compliance with the Kenya Data Protection Act 2019 (DPA) and the Kenya Data Protection (General) Regulations 2021. By using our Services, you consent to the collection and use of your information as described in this policy.
The data controller for your personal data is:
When you register, we collect your full name, email address, phone number (in E.164 format, e.g. +254…), and a securely hashed password.
With your explicit permission, we read transaction messages from trusted senders on your Android device: financial senders on a list we manage and confirm (currently M-Pesa, Airtel Money, KCB, Equity Bank and Co-operative Bank, with other banks, SACCOs and lenders added as each is confirmed), and senders you add yourself under Settings → Trusted senders: a bank, SACCO or other financial institution, or a named business or person merchant. A sender is always a name, never a phone number. If you choose "Import past messages", we read the transaction messages from these senders that arrived in the last 30 days (up to 300 messages) and add the transactions we can read. You can start this once for each account on each phone. The message text is not uploaded. We collect the transaction details they contain. This includes: transaction amounts (stored as integer cents in KES), merchant or payee names, transaction types (send, receive, buy goods, pay bill, withdraw), and transaction timestamps. We do not have access to your M-Pesa PIN or Safaricom account credentials.
Data you manually enter including budget categories, goal targets, contribution amounts, and notes attached to transactions.
We collect device type and operating system version, and app version — for the purpose of improving the platform and debugging issues. Product analytics run only if you agree in Settings → Privacy. We also use a push-notification token and an analytics identifier to send notifications and understand usage. When the app hits an error, it sends us an error report (the error message, technical trace and your device platform) so we can fix it. We also record the IP address you sign up from, to prevent abuse of referral rewards.
When you create an account on the web, we record how you found us: the campaign tags in the link you followed (such as utm_source or utm_campaign, and ad click identifiers), the first page you landed on, and the name of the website that referred you — no IP address or browser details. We use this only to measure which of our marketing reaches people, keep it while your account exists, and delete it with your account.
If you connect with a financial advisor through the platform, the advisor's name, credentials, and your consent to share your data with them are recorded and stored.
When you scan a receipt, you choose the photo from your gallery or take it with your camera. In the Android app, the receipt is read on your phone to fill in the merchant, amount and date; the photo never leaves your device. On our website, the photo is sent to our servers and read by an AI model (through OpenRouter) to fill in the merchant, amount, date and items. We keep the photo with the transaction so you can view it, until you delete the receipt or your account. Either way, nothing is read without you choosing a photo. Receipt scanning does not need access to your photo library beyond the photo you pick.
You can add a photo for yourself or for a person you track (for example, someone you split bills with). You choose the photo from your gallery and crop it. The photo is stored on our servers and shown in the app. Stored photos are reachable by their web address, which is generated at random and not published, but anyone with that address can open the photo. Please only add photos of people who have agreed to it. When you replace a photo, the old one is deleted. When you delete a person, their photo is deleted with them. When you delete your account, every photo you added is deleted.
We use your data for the following purposes, each grounded in a lawful basis under the DPA 2019:
Endelea uses transaction messages from the senders listed in section 3.2 only to extract transaction details. This permission is granted explicitly by you during setup. Messages from any other sender are ignored on your device and are never stored or sent. If you add a trusted sender, we store its name (and the label you give it) with your account so it applies on your other devices; you can remove it at any time. Transaction messages are read on your device, and only the extracted details (amount, date, counterparty, fee and transaction type) are sent to our servers; the message text stays on your phone. Messages from a past-messages import you start (section 3.2) are read on your device the same way. On our website, a message you paste is read on our servers to fill in the form and is not kept; only the details you save are stored.
One exception: if the on-device reader cannot understand a message you have chosen to import (by tapping or pasting it, or by choosing "Read with AI" for a message the app could not read on its own), that single message is sent to our servers to be read by an AI model. Nothing is sent without you selecting the message, and we never upload your inbox. The past-messages import that you start never sends a message for AI reading; a message from it reaches the AI reader only if you later choose "Read with AI" for it. These messages, with the reader's result, are kept for 90 days and then deleted (section 9). We use them to improve the reader and to protect it from misuse.
Endelea is not a payment service provider. We do not initiate, hold, or transfer funds on your behalf. M-Pesa integration is solely for subscription payment collection and transaction data capture.
Our AI features are powered by backend language models. This means:
With your explicit consent, you may store the phone number or email address of a person you split a bill with, so that their share can be shared with them and so that reminders can reach them. Consent is recorded with a timestamp when you save the contact. We use this contact information only for pairing splits and sending reminders you request — never for marketing. You can view and delete a stored contact at any time.
When you link a person by their phone number or email, we check whether it matches a verified Endelea account. Our response to you is always the same, whether or not a match exists — so the service never discloses whether a particular person is an Endelea user.
When someone accepts your link, they see only their own share of the split: the description, their amount, your name, and the date. They never see the other participants, other shares, the split total, or any notes.
When you remind someone about an unpaid share, we deliver it through the channel available: an in-app notification for linked users, otherwise an SMS or email to the contact you stored. The reminder is sent on your behalf and names you and the amount owed. Every SMS reminder carries an opt-out line ("Reply STOP to opt out."), and a person who opts out or asks you to stop will no longer receive reminders. Reminders are limited to one per unpaid share per 24 hours.
Reminders that leave the platform (SMS and email) are metered in prepaid reminder credits. Credits are bought as packs and are never part of any subscription plan. In-app reminders to linked users are free.
We do not sell your personal data. We may share data in the following limited circumstances:
We retain your data for as long as your account is active. If you delete your account, it is erased 30 days after your request; you can cancel the deletion within that time. Your transactions and other financial data are then permanently deleted. Receipt photos, advisor message attachments, data imports, data exports and your profile photo are erased at the same time. Invoices and payment records are kept as tax records, with your identity removed. SMS messages sent for AI reading (section 5), with the reader's result, are deleted 90 days after they are received, or when your account is erased, whichever comes first.
We protect your data using industry-standard security measures including:
Under the Kenya Data Protection Act 2019, you have the following rights:
To exercise any of these rights, submit a request through the app (Settings → Privacy → Data Requests) or email dpo@endeleafinance.com. We will respond within 30 days.
Our mobile app does not use cookies. Our marketing website uses essential cookies for session management, and optional analytics cookies (which you may decline). A full Cookie Policy is available separately.
Our Services are intended for users aged 18 and above. We do not knowingly collect personal data from anyone under 18. If you believe a minor has registered, please contact us immediately at dpo@endeleafinance.com and we will delete the account.
We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email and in-app notification at least 14 days before the changes take effect. Your continued use of the Services after the effective date constitutes acceptance of the updated policy.
For any privacy-related queries, data requests, or complaints:
If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya at www.odpc.go.ke.