Privacy Policy

This policy explains what personal data Leapa collects, why we collect it, who we share it with, and what you can ask us to do with it. Leapa is operated by SatoshiPay Ltd, a company incorporated in Kenya and trading as Leapa. For the purposes of the Data Protection Act, 2019, we are the data controller for the data described here.

We do not sell your personal data. We never have and we will not.

1. What we collect, and why

Our rule is to collect what we need to run the Service and to meet our legal obligations, and not more.

Identity

Your name, date of birth, phone number, email address, and the identity document and selfie you submit when we verify you. We collect this because the law requires us to know who our customers are before we handle their money, and because we need to be able to reach you.

Financial and transaction data

Your M-Pesa number and the M-Pesa references we receive from Safaricom, the deposit addresses we generate for you, the blockchain addresses you deposit from and withdraw to, transaction amounts, rates, timestamps, and status. We keep this to run your account, to show you your history, to resolve disputes, and to meet anti-money-laundering record-keeping rules.

Screening results

The outcome of sanctions and illicit-finance checks we run on you and on the blockchain addresses involved in your transactions. We are required to run these checks and to keep the results.

Device and usage data

Your IP address, device and app version, and logs of how you use the app. We use this to keep accounts secure, to detect fraud and automated abuse, and to find and fix faults.

What you send us

Messages you send to support, whether by email, in-app, or through our Telegram bot. We keep them so we have the history when you come back to us.

What we do not collect

We never ask for and never store your M-Pesa PIN. We do not store your wallet PIN in a readable form. Nobody at Leapa can read it, and we will never ask you for it.

2. Our legal basis for using it

Depending on the data, we rely on one of the following:

• Performing our contract with you — running your account and completing your transactions.
• Complying with a legal obligation — KYC, anti-money-laundering, sanctions screening, tax and record-keeping duties.
• Our legitimate interests — keeping the Service secure, preventing fraud, and improving how it works. We do not rely on this where your own rights outweigh it.
• Your consent — for anything optional, such as marketing messages. You can withdraw consent at any time.

3. When we share it, and with whom

We share personal data only where we need to, and only with these categories of recipient:

• Mobile money providers, to send and receive the M-Pesa leg of your transactions.
• Blockchain infrastructure providers, to read balances and broadcast transactions on the networks we support.
• Identity verification and screening providers, to confirm who you are and to check addresses against sanctions and illicit-finance data.
• Messaging providers, to deliver the SMS, email and chat notifications you receive from us.
• Cloud hosting and infrastructure providers, who store and process data on our instructions.
• Professional advisers — auditors, lawyers and accountants — where they need it to advise us.
• Regulators, courts and law enforcement, where the law requires us to disclose.

Everyone in these categories is bound to handle your data only on our instructions and to protect it. We do not give them permission to use it for their own purposes.

On lawful requests: we disclose customer data to a government or law enforcement body only where we are compelled by valid legal process, or in a genuine emergency involving risk to life. Where we are permitted to tell you that a request was made, we will.

If Leapa is ever acquired or merged, we will tell you before your data becomes subject to a different privacy policy.

4. Where your data is held

Some of our infrastructure and some of the providers described above are located outside Kenya, which means your personal data may be transferred and processed outside the country. Where that happens, we satisfy ourselves that the recipient is bound by appropriate contractual protections and applies security measures consistent with this policy and with Kenyan data protection law.

5. How long we keep it

We keep identity and transaction records for seven years after your account closes. That period is set by anti-money-laundering record-keeping requirements, not by us, and we cannot delete those records earlier even if you ask.

Data we are not required to retain — marketing preferences, optional profile details, support correspondence not tied to a transaction — we delete within a reasonable period of your account closing, or sooner if you ask.

6. How we protect it

Traffic between your device and our systems is encrypted in transit. Sensitive values, including your wallet PIN, are stored hashed or encrypted, not in readable form. Access to production systems is restricted to the staff who need it for support, compliance or engineering work, and that access is logged.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal data, we will notify you and the Office of the Data Protection Commissioner as the law requires.

7. Your rights

Under the Data Protection Act, 2019 you have the right to:

• be told what we hold about you and how we use it — that is what this policy is for;
• get a copy of your personal data;
• correct anything inaccurate or incomplete;
• ask us to delete your data, subject to the retention period in section 5;
• object to or restrict how we use it in certain circumstances;
• withdraw consent where our use rests on consent; and
• complain to the Office of the Data Protection Commissioner.

These rights have limits. We cannot delete records the law requires us to keep, and acting on a deletion request will usually mean closing your account, because we cannot run it without the underlying data.

To exercise any of these, email support@leapa.co.ke. We will respond within the period the law allows, and we may ask you to confirm your identity first.

8. Changes to this policy

We may update this policy. Where a change materially affects you, we will tell you through the app or by message before it takes effect. The date of the current version is shown at the top of this page.

9. Contact and complaints

Questions, requests or complaints about how we handle your data go to support@leapa.co.ke. If you are not satisfied with our response, you can complain to the Office of the Data Protection Commissioner of Kenya.

SatoshiPay Ltd, trading as Leapa.