Privacy Policy

Adplay Media Ltd · Last updated August 2026

Pesa AI is built and operated by Adplay Media Ltd ("we", "us"). This policy explains what personal data we collect when you use Pesa AI, why, and what rights you have over it — in plain language, as recommended by Kenya's Office of the Data Protection Commissioner (ODPC) for small businesses. It applies to business owners who sign up for Pesa AI, and to the end-customers those businesses chat with over WhatsApp.

What we collect

From business owners: business name, category, phone number, email address, a hashed password (we never store your actual password), and — only if you choose to connect them — your M-Pesa paybill and payment credentials (see "Payment data" below).
From your customers (on your behalf): phone number, name (if given), chat messages sent to your AI assistant, and order details (products, quantities, totals).

Why we collect it, and our legal basis

We process this data to provide the service you signed up for: running your AI sales assistant, taking orders, and billing your Pesa AI subscription. That's performance of our contract with you. Where a business uses Pesa AI to send marketing messages to past customers, that requires the customer's own express, opt-in consent — collected and managed by the business, not by us.

Payment data — we never hold your money

If you connect your own M-Pesa paybill (Settings tab), customer payments go directly to your own M-Pesa account. Pesa AI never collects, holds, or moves your sales revenue. Your Daraja API credentials (Consumer Secret, Passkey) are encrypted at rest and are never displayed again once saved, even to you — if you need to change them, you'll re-enter new ones.

How long we keep data

We keep your business and order data for as long as your account is active, plus a reasonable period afterward for legal and accounting purposes. You can request deletion of your business account and associated data at any time — see "Your rights" below.

Who else sees your data

Anthropic — processes chat messages to power the AI assistant (when running in live AI mode, not the demo/mock mode).
Render — our hosting provider, where the application and its data are stored.
Safaricom — only if you connect your own M-Pesa paybill, to process payment requests directly with your own account.

We do not sell personal data to anyone.

Data storage location

Pesa AI is currently hosted outside Kenya (on Render's infrastructure). We rely on contractual and technical safeguards (encryption in transit and at rest, purpose limitation) as the legal basis for this cross-border processing, consistent with Kenya's Data Protection Act.

Security

We use industry-standard practices including encrypted connections (HTTPS), hashed passwords, encrypted storage of payment credentials, and access controls that keep each business's data isolated from every other business on the platform.

Your rights

Under Kenya's Data Protection Act, you can request access to, correction of, or deletion of your personal data, and you can object to certain processing. To exercise any of these rights, or to ask a question about this policy, contact us at privacy@adplaymedia.co.ke.

Changes to this policy

We'll update this page if how we handle data changes, and update the "last updated" date above.