Privacy Policy

Last updated: September 24, 2026

The short version: Your M-Pesa PDF is read entirely in your browser and is never uploaded. Your dashboard is built in your browser too. Only when you buy the Excel workbook, and only with your consent, are the transactions extracted from your statement uploaded — securely, to private encrypted storage on Amazon Web Services servers in the United States — so our server can format them. That upload is deleted as soon as your workbook is built, and the finished workbook is deleted automatically within two days. We do not keep, sell, or share your financial data.

1. Who we are

Cheche Technologies ("Cheche", "we", "us") is a service of CHECHE INNOVATIONS AFRICA, a business registered in Kenya (Business No. BN-EOSBRJZP), P.O. Box 13382-00100, Nairobi. We operate the M-Pesa Statement Converter at chechetech.co.ke and are responsible for the personal data described in this policy. For any privacy questions, contact us at privacy@chechetech.co.ke.

2. What data we process

When you use the converter, the following data may be processed:

M-Pesa statement contents — transaction dates, amounts, payee/payer names, receipt numbers, and statement password (if your PDF is locked).
Phone number — only if you choose a paid plan (Pay As You Go, Pro, or Business), to send an M-Pesa payment prompt (STK Push).
Usage data — an anonymous random identifier stored in your browser, the type of action taken (e.g. page visited, statement converted, workbook downloaded), device type (mobile/desktop), approximate file size, number of transactions and months in the statement, and how you arrived at the site. This tells us how the product is being used. It never includes the contents of your statement — no names, amounts, or balances.

3. How your data is processed

Step	Where it happens	What happens to your data
PDF unlocking & extraction	Your browser (client-side)	Never leaves your device
Workbook assembly	Your browser (client-side)	Never leaves your device
Dashboard in the converter	Your browser (client-side)	Never leaves your device
Excel workbook formatting (paid)	AWS server (Lambda) and private storage (Amazon S3), United States	The extracted transactions are uploaded over encrypted HTTPS to private, encrypted storage that is not publicly accessible. They are deleted as soon as your workbook has been built — normally within a minute. The finished workbook is delivered through a private download link that expires after 10 minutes, and is kept only so you can download it again if your first download fails; it is deleted automatically within two days. Statement contents are never written to our logs
Payment (STK Push)	AWS server (United States) + Safaricom Daraja API	Phone number and payment amount sent to initiate M-Pesa payment. Successful payments are retained for reconciliation and accounting; pending or failed attempts are deleted automatically after 30 days
Usage analytics	AWS server (United States)	Anonymous identifier and event metadata stored for up to 18 months, then deleted automatically. No statement contents

4. International data transfers

Our servers are provided by Amazon Web Services (AWS) and are located in the United States (us-east-1, Virginia). This means the following are processed outside Kenya:

The transactions extracted from your statement, when you buy the Excel workbook — deleted as soon as your workbook is built, with the finished workbook deleted within two days (see Section 3).
Your payment record — kept for reconciliation, accounting and tax.
Anonymous usage data — never includes statement contents.

We only send your transaction and payment data to these servers with your explicit consent, which we ask for separately on the payment screen, before any of it leaves your device. We protect it with encryption in transit and at rest, private storage that cannot be accessed publicly, short-lived download links, and access restricted to the minimum each component needs. If you do not consent, you can still use the free dashboard, which runs entirely in your browser and sends none of your statement data anywhere.

5. What we never do

We do not keep your M-Pesa statement, transaction history, or any extracted financial data beyond the short processing window described in Section 3 — your PDF is never uploaded, the data used to build your workbook is deleted as soon as it is built, and the finished workbook is deleted within two days.
We do not sell, rent, or share your data with advertisers or third parties.
We do not use your financial data to train any AI model.
We do not require an account, email, or personal details for the Free or Pay As You Go tiers.

6. Payment data

When you initiate a payment via M-Pesa STK Push, we record your phone number, payment amount, plan, payment status (pending, paid, or failed), and M-Pesa receipt number where applicable. This is standard transaction record-keeping, similar to any business that accepts M-Pesa payments. We retain records of successful payments to reconcile our records with Safaricom, resolve payment disputes, and meet our own accounting and tax obligations. Records of attempts that failed or were cancelled are deleted automatically after 30 days. When you pay, your payment record also includes the anonymous usage identifier described in Section 2, so that we can understand how paying customers use the product. We do not store your M-Pesa PIN at any point — this is entered directly on your phone via Safaricom's own secure prompt and never passes through our systems.

7. Your rights

Under Kenya's Data Protection Act, 2019, you have the right to:

Know what data we hold about you (in practice, this is minimal — see Section 5)
Request correction or deletion of any data we do hold
Object to processing of your data
Withdraw your consent at any time — this does not affect processing already carried out, or payment records we must keep by law
Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe your rights have been violated

To exercise any of these rights, email privacy@chechetech.co.ke.

8. Security

All data in transit is encrypted via HTTPS/TLS, and workbook data is also encrypted while it is briefly stored. The storage used for formatting is private — it cannot be browsed or accessed publicly — and each download link is unique to your workbook and expires after 10 minutes. Please do not share a download link while it is active. Our infrastructure runs on Amazon Web Services (AWS), with access restricted to the minimum each component needs. Because your financial data is deleted within the short windows described above, the risk of a data breach affecting it is minimised by design.

9. Children's privacy

Cheche is intended for use by adults managing their own or their business's financial records. We do not knowingly collect data from minors.

10. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top will reflect any changes. Continued use of the service after changes constitutes acceptance of the updated policy.

11. Contact us

Cheche Technologies (CHECHE INNOVATIONS AFRICA, BN-EOSBRJZP)
P.O. Box 13382-00100, Nairobi, Kenya
Email: privacy@chechetech.co.ke
Web: chechetech.co.ke