Privacy Policy

Last updated: June 17, 2026

The short version: Your M-Pesa PDF is read entirely in your browser and never uploaded anywhere. If you choose the Formatted Excel option, your transaction data is sent securely to our server for formatting only, and is discarded immediately afterward. We do not store, sell, or share your financial data with anyone.

1. Who we are

Cheche Technologies ("Cheche", "we", "us") operates the M-Pesa Statement Converter at chechetech.co.ke. We are based in Nairobi, Kenya. For any privacy questions, contact us at privacy@chechetech.co.ke.

2. What data we process

When you use the converter, the following data may be processed:

M-Pesa statement contents — transaction dates, amounts, payee/payer names, receipt numbers, and statement password (if your PDF is locked).
Phone number — only if you choose a paid plan (Pay As You Go, Pro, or Business), to send an M-Pesa payment prompt (STK Push).
Technical data — browser type, approximate file size, and timestamps, used only for diagnosing errors.

3. How your data is processed

Step	Where it happens	What happens to your data
PDF unlocking & extraction	Your browser (client-side)	Never leaves your device
Raw Excel generation	Your browser (client-side)	Never leaves your device
Formatted Excel (Dashboard)	AWS server (Lambda)	Sent over encrypted HTTPS, processed, returned, then immediately discarded — not stored or logged
Payment (STK Push)	AWS server + Safaricom Daraja API	Phone number and payment amount sent to initiate M-Pesa payment; all payment attempts (successful, pending, or failed) retained for reconciliation and accounting

4. What we never do

We do not store your M-Pesa statement, transaction history, or any extracted financial data on our servers.
We do not sell, rent, or share your data with advertisers or third parties.
We do not use your financial data to train any AI model.
We do not require an account, email, or personal details for the Free or Pay As You Go tiers.

5. Payment data

When you initiate a payment via M-Pesa STK Push, we record your phone number, payment amount, plan, payment status (pending, paid, or failed), and M-Pesa receipt number where applicable. This is standard transaction record-keeping, similar to any business that accepts M-Pesa payments. We retain records of all payment attempts — including ones that failed or were cancelled — to reconcile our records with Safaricom, resolve payment disputes, and meet our own accounting and tax obligations. We do not store your M-Pesa PIN at any point — this is entered directly on your phone via Safaricom's own secure prompt and never passes through our systems.

6. Your rights

Under Kenya's Data Protection Act, 2019, you have the right to:

Know what data we hold about you (in practice, this is minimal — see Section 4)
Request correction or deletion of any data we do hold
Object to processing of your data
Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe your rights have been violated

To exercise any of these rights, email privacy@chechetech.co.ke.

7. Security

All data in transit is encrypted via HTTPS/TLS. Our payment infrastructure runs on AWS with industry-standard access controls. Because we do not retain your financial data after processing, the risk of a data breach affecting your information is minimised by design.

8. Children's privacy

Cheche is intended for use by adults managing their own or their business's financial records. We do not knowingly collect data from minors.

9. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top will reflect any changes. Continued use of the service after changes constitutes acceptance of the updated policy.

10. Contact us

Cheche Technologies
Nairobi, Kenya
Email: privacy@chechetech.co.ke
Web: chechetech.co.ke