Privacy policy

In short

Chama stores the records your group enters so your members can see them. We collect the minimum needed to run the service, we never sell personal data, and we never hold or move your money.

What we collect

• Your account: name, email address and, if you provide it, your mobile number.
• Group records: membership details, contributions, loans, repayments, expenses, meeting minutes and the M-Pesa or bank references your officials enter.
• Technical data: sign-in timestamps and security logs needed to keep accounts safe.

We do not ask for your M-Pesa PIN, bank passwords, national ID number or card details, and you should never enter them into Chama.

Who can see your group's data

Data is separated per chama. Only active members of your group can see its records, and what each member sees depends on their role and the visibility settings your chairperson chooses. Contact details are restricted to officials. Loan details default to officials only.

Chama support staff cannot read your group's financial records by default. When you ask for help and we need access, a named member of staff must open a time-limited support grant with a stated reason — your chairperson is notified and the grant is recorded in your audit log.

How long we keep it

Financial records are kept for as long as your group uses Chama, and for seven years afterwards so historic accounts remain available. Because a chama's accounts must stay intact, confirmed financial entries are never deleted — mistakes are corrected by a reversal that leaves both entries visible.

Your rights

Under the Data Protection Act, 2019 you may ask for a copy of your personal data, ask us to correct it, or ask us to delete your account. Deleting your account removes your personal profile and unlinks you from your groups; the group's financial history remains, as it belongs to the chama as a whole. Write to privacy@chamahq.co.ke.

Processors we use

We use Supabase for the database and authentication, and Vercel for hosting. Both act on our instructions only. If we add M-Pesa collection through Safaricom Daraja, the transaction references involved will be processed by Safaricom under their own terms.