Privacy policy

Jameiyah Limited, a company registered in Kenya, is the data controller for personal data processed through Jameiyah. Jameiyah is community software for savings circles, table banking and giving. It is not a bank.

Account details: your name, phone number, email address (if you sign in with email or Google), date of birth and profile photo.

Identity details: your national ID number and the documents you upload for verification. We check your ID number against the government IPRS register to confirm your identity.

Money records: the circles you belong to, your contributions, payouts, loans, repayments, wallet top-ups and withdrawals, donations, and your M-Pesa or bank details for payouts.

Circle records: next of kin, votes, meeting notes and messages you add inside a circle.

Technical data: device and browser type, IP address, and activity logs we keep for security and audit.

We use your data to:

• create your account and sign you in;
• verify your identity and prevent fraud;
• run your circles, keep their books and produce statements;
• process payments, payouts and donations;
• send reminders and notices by SMS, email, WhatsApp or push;
• handle support requests and disputes;
• meet our legal and regulatory obligations.

We rely on performing our agreement with you, your consent where we ask for it, our legitimate interest in keeping the service safe, and legal obligations.

Officers of a circle can see the records of members in that circle. Other members see their own records and circle-level totals. Other circles cannot see your circle.

We share data with service providers who help run Jameiyah, only as far as they need it: Safaricom (M-Pesa), IntaSend and Paystack (payments), our partner banks (payouts), Taifa Mobile (SMS), Resend (email), Supabase and Vercel (hosting and database), and the IPRS register (identity checks). We also share data where the law requires it.

We do not sell your personal data.

Our database is hosted in the European Union (Ireland). Where data leaves Kenya, we rely on providers that apply safeguards consistent with the Data Protection Act.

We keep your account data while your account is open. We keep money and circle records for as long as the law requires after an account closes, because circle books and payment records must stay complete for other members and for audit.

Under the Data Protection Act you can ask us to:

• tell you what data we hold about you and give you a copy;
• correct data that is wrong;
• delete data we no longer need, unless we must keep it by law;
• stop or limit certain uses of your data;
• withdraw consent you gave earlier.

You can also complain to the Office of the Data Protection Commissioner (ODPC).

Data is encrypted in transit. Access is limited by role, sensitive actions need dual approval, and we keep audit logs of changes to money records.

We will post changes to this policy on this page and tell you in the app when a change is significant. To use your rights or ask a question, contact us through the support page.