scaiveThe short version
- Scaive never moves, holds or processes your money. You always pay inside M-Pesa.
- Scaive never asks for, sees or stores your M-Pesa PIN.
- Camera images are read on your phone and are never uploaded.
- Your payment history stays on your phone, encrypted.
- Our servers keep phone, till and paybill numbers only as scrambled codes (keyed hashes), not as readable numbers.
- We don't sell your data and we don't show adverts.
Who we are
Scaive is run by [YOUR COMPANY NAME] Ltd, a company registered in Kenya (“we”, “us”). We are the data controller for the information described here, and we are registered with the Office of the Data Protection Commissioner [ODPC REGISTRATION NUMBER].
Scaive is independent and is not affiliated with Safaricom.
What we collect
- Your phone number, to create your account and send sign-in codes. We store it as a keyed hash.
- A device identifier made by the app, and basic device checks, to stop abuse.
- Numbers you check. When you scan or type a number, the app sends it to us to look up scam reports. We turn it into a keyed hash in memory. We don't store or log the readable number.
- Scam reports you send: the hashed number, the category, and any details you choose to write.
- Shop claims, if you ask for a verified sticker: your till or paybill number, business name, the KSh 1 confirmation payment reference, and any documents you upload.
- Anonymous usage counts, such as how often a scan needed a digit check. You can turn these off in Settings.
What we never collect
- Your M-Pesa PIN, balance, statements or messages
- Camera images or photos
- Your payment history
- Your contacts or precise location
How we use it
We use this information to sign you in, show warnings about reported numbers, verify shops, prevent abuse of the reporting system, and keep the service working. Our legal bases are your consent, performing our agreement with you, and our legitimate interest in preventing fraud.
Who we share it with
We share only what each provider needs to do its job:
- An SMS provider, to deliver sign-in codes to your number
- Cloud hosting and error-monitoring providers, who process data for us
- Safaricom, only as part of receiving a shop's KSh 1 confirmation payment
- Authorities, when the law requires it
Other users never see who reported a number. A verified shop's business name and till or paybill number are public, because the shop prints them on its sticker.
Where it is stored
[DATA LOCATION: to be confirmed with our lawyer, including any transfer outside Kenya and the safeguards used]
How long we keep it
- Account details: until you delete your account
- Sign-in codes: 5 minutes
- Scam reports: they stop counting after 90 days, and are anonymised if you delete your account
- Shop documents: deleted 90 days after a decision
Your rights
Under the Data Protection Act, 2019 you can ask to see your data, correct it, delete it, or object to how we use it. You can delete your account in the app or on our account deletion page. You can also complain to the Office of the Data Protection Commissioner.
Children
Scaive is for adults who are able to hold an M-Pesa account. It is not aimed at children.
Changes to this policy
If we change this policy in a way that matters, we will tell you in the app before the change applies.
Contact
Privacy questions: support@scaive.co.ke
[YOUR COMPANY NAME] Ltd, [YOUR POSTAL ADDRESS], Nairobi, Kenya