Legal

Version 2.1

Privacy Policy

Plain English: We don't sell your data. Your statements are processed and never stored raw. You own your financial data — we only keep what you choose to keep.

1. Introduction

Welcome to Jijenga. We respect your privacy and are committed to protecting your personal data in strict accordance with the Constitution of Kenya (2010) and the Data Protection Act, 2019. We believe that your financial data belongs to you, and our role is to help you understand it, not to exploit it.

2. Data Controller

For the purposes of the Data Protection Act, the Data Controller responsible for your personal data is:

3. Information We Collect

We adhere to the principle of data minimization. We only collect the information necessary to provide our Service to you.

3.1. Personal Information (Account Data)

When you create an account, we collect identifiers to establish your identity and secure your account. We do not collect your name at signup to protect privacy:

  • Email Address
  • Profile information (if signing up via Google/Social Login)

3.2. Financial Data (The Core Service)

To provide financial clarity and savings insights, we process:

  • Uploaded Documents: When you upload an M-Pesa or bank statement, our system extracts transaction details (dates, amounts, sender/recipient, codes)
  • Security Note: PDF passwords are decrypted in temporary memory only. They are never written to our database or permanent storage. Once the data is extracted, the password is immediately cleared.
  • Manual Entries: Data you manually input regarding income, expenses, budgets, and account balances

3.3. Device and Usage Data

We collect technical data to improve app stability and user experience:

  • Device model, operating system, and unique device identifiers
  • Usage logs (e.g., features used, session duration, crash reports)

3.4. Cookies and Similar Technologies

We use cookies and similar technologies to remember your preferences and analyze how our Service is used. You can control cookies through your device settings.

4. Lawful Basis for Processing

Under the Data Protection Act, we process your data based on the following legal grounds:

  • Performance of a Contract: To provide the Jijenga Service to you as agreed in our Terms of Service (e.g., parsing your data to show you a dashboard)
  • Consent: Where you have given clear permission (e.g., subscribing to newsletters). You may withdraw consent at any time
  • Legitimate Interests: To improve our security, prevent fraud, and enhance our algorithms for the benefit of our user base, provided these interests do not override your fundamental rights

5. How We Use Your Information

We use your data for specific, stated purposes:

  • Service Delivery: To parse, categorize, and visualize your financial data
  • Savings Insights: To generate personalized recommendations based on your spending patterns
  • Communication: To send administrative alerts, savings summaries, and updates
  • Improvement: To analyze anonymized and aggregated trends to fix bugs and improve our features

6. Data Storage & Security

We utilize enterprise-grade infrastructure that adheres to industry-leading security standards:

  • Security Standards: SOC2 Type II compliance standards
  • Encryption in Transit: TLS 1.3 protocol
  • Encryption at Rest: AES-256 encryption
  • Access Control: Strictly restricted to authorized personnel bound by confidentiality agreements
  • Data Minimization: We do not store M-Pesa PINs. PDF passwords are used only in the moment of processing and are never permanently stored

7. Data Sharing and Disclosure

We do not sell your personal data. We share data only in the following limited circumstances:

  • Service Providers: With trusted vendors who assist in operating the Service (e.g., cloud hosting providers, analytics services), subject to strict data processing agreements
  • Legal Compliance: If required by Kenyan law or in response to a valid court order
  • Business Transfers: In the event of a merger, acquisition, or sale of assets, data may be transferred, subject to notification

8. International Data Transfers

Some of our service providers utilize enterprise-grade cloud infrastructure (such as Amazon Web Services (AWS) or Google Cloud Platform) which may host data in secure jurisdictions outside Kenya.

  • We ensure that such transfers comply with the Data Protection Act, 2019
  • Appropriate safeguards (such as standard contractual clauses) are in place to protect your data
  • Your data benefits from the highest security standards regardless of physical location

9. Data Retention

We retain your personal data only for as long as your account is active or as needed to provide you with the Service.

  • If you delete your account, we will delete or anonymize your identifiable personal data within 30 days
  • We may retain specific records if legally required (e.g., for tax or audit purposes)
  • Note on Anonymized Data: Aggregated and anonymized data that cannot be traced back to you — used to generate general insights or improve our algorithms — remains the property of Jijenga Technologies Limited and is not erased upon account deletion

10. Your Rights

You have the following rights regarding your personal data under the Kenya Data Protection Act:

  • Right to be Informed: To know what data we collect and how we use it
  • Right of Access: To request a copy of the personal data we hold about you
  • Right to Rectification: To correct inaccurate or incomplete data
  • Right to Erasure: To request deletion of your data ("Right to be Forgotten"), subject to Section 9
  • Right to Object/Restrict: To object to or restrict processing in certain circumstances
  • Right to Data Portability: To receive your data in a structured, commonly used format
  • To exercise any of these rights, contact us at [email protected]

11. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from children.

12. Right to Lodge a Complaint

If you believe your data privacy rights have been violated, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via the App or Email. Continued use of the Service after changes implies acceptance.