Last updated: October 2026
Our Commitment
PesaIQ is committed to protecting your personal and financial information in compliance with the Kenya Data Protection Act, 2019. Your financial data is sensitive, and we treat it with the highest level of care and security.
PesaIQ is a financial intelligence platform designed for M-Pesa users in Kenya. We are a data controller under the Kenya Data Protection Act, 2019. We are in the process of registering with the Office of the Data Protection Commissioner (ODPC).
We collect: (a) Account information — your name, email address, and phone number when you register. (b) Transaction data — M-Pesa transaction details extracted from SMS messages or PDF statements you provide. (c) Usage data — how you interact with our platform to improve our services. (d) Technical data — device information, IP address, and browser type for security purposes.
We process your data to: provide financial analytics and insights, power the AI Financial Advisor, generate spending reports and forecasts, improve our services, comply with legal obligations, and detect fraud or unauthorized access.
Your transaction data is used exclusively to provide you with financial insights within PesaIQ. We do not sell your personal or financial data to third parties. We do not share your data with advertisers. Your raw SMS content is stored only temporarily for parsing and is not retained beyond what is necessary.
Your data is stored on secure cloud infrastructure (Neon PostgreSQL) with encryption at rest and in transit. We implement role-based access controls, strong authentication, and regular security reviews. All API communications are encrypted via HTTPS/TLS.
We retain your transaction data for as long as your account is active. Raw SMS content used for parsing is deleted after processing. If you delete your account, all your personal data is permanently deleted within 30 days.
You have the right to: access your personal data (use the Export My Data feature in Settings), correct inaccurate data (update your profile in Settings), delete your data (use the Delete Account feature in Settings), withdraw consent for data processing at any time, lodge a complaint with the Office of the Data Protection Commissioner.
If you use SMS import on Android, PesaIQ asks for permission to read your phone's SMS inbox. Your phone is searched only to find messages from M-Pesa ("MPESA", "M-PESA") and Airtel Money ("AIRTEL"); all other messages are ignored on your phone and are never sent to us. The text of matching messages is sent over an encrypted connection (HTTPS/TLS) to our servers, where it is read to extract transaction details (amount, date, type, counterparty and receipt number). The original message text is not stored after parsing; only the extracted details are kept. SMS import only runs when you start it, and PesaIQ does not listen for new SMS messages in the background. You can turn SMS parsing off at any time in Settings > Privacy & Data or in your Android app permissions, and you can delete your account and all your data at any time from Settings. You can also import by pasting messages or uploading a PDF statement instead.
We use the following third-party services: Google OAuth (authentication), Render (backend hosting, US-based), Neon (database hosting, US-based), Sentry (error monitoring), Groq (AI insights processing), Resend (sending verification and password-reset emails), and Safaricom Daraja (M-Pesa subscription payments). All third-party providers are contractually bound to maintain appropriate data protection standards.
Our infrastructure is hosted in the United States. By using PesaIQ, you consent to your data being transferred to and processed in the United States. We ensure all service providers maintain security standards compliant with applicable data protection laws.
For privacy-related questions or to exercise your rights, contact us at: privacy@xanatechafrica.com. We will respond to all requests within 14 days.