Privacy Policy

Last updated: 18 August 2026

At FishPesa, we respect your privacy and strictly comply with Google Play policies, the Kenya Data Protection Act, 2019, and all applicable laws and regulations. This Privacy Policy explains how we collect, use, store, share and protect your personal information when you use the FishPesa mobile application (com.fishpesa.credit.secure) or website at fishpesa.com.

1. Information We Collect

1.1 Information You Provide

Depending on the stage of your use of FishPesa, we may collect:

• Account registration — mobile phone number and SMS verification code
• Profile & KYC — first, middle and last name; gender; date of birth; email; national ID number; county and address; employment / work status; monthly income, payday and salary frequency; education level; marital status
• Emergency contacts — name, phone number and relationship (selected or entered by you; we do not read your phone contact list)
• Loan & repayment — loan application details, M-Pesa disbursement/repayment records and related transaction references
• Support — communications with our customer support team

Information you enter in profile or KYC forms is uploaded when you submit those forms.

1.2 Information Collected With Your Permission

After you accept our in-app permissions disclosure, we may request approximate (coarse) location to help verify your device environment and prevent fraud. Location is not used for continuous or background tracking.

When you explicitly authorise required permissions and tap “Apply” during a loan application, we may also collect additional data for eligibility assessment and fraud prevention:

• Device information — brand, model, OS version, Android ID, memory and storage, battery and charging status, screen size, language, time zone, network operator, emulator/root/proxy/VPN indicators and related technical signals
• Location — approximate latitude/longitude and city/province where available, for risk assessment
• Wi-Fi & network environment — Wi-Fi status, nearby Wi-Fi count, router BSSID, IP address and MAC address where available
• Advertising identifier (GAID) — collected when you apply for a loan, for fraud prevention and risk assessment in compliance with platform policies; not used for targeted advertising unless you separately opt in

1.2.1 SMS Data Usage Disclosure

To prevent fraud and assess credit eligibility, this app accesses SMS data only after the user explicitly grants SMS permission and actively taps the “Apply” button.

During the loan application process, SMS messages are temporarily filtered using financial-related keywords, and only the minimum financial information necessary is processed.

Non-financial messages are not collected, stored, or uploaded. SMS access is limited to the loan application flow and does not involve continuous or background monitoring.

SMS data is not shared with any third-party services and is used solely for anti-fraud and credit assessment purposes. All data transmissions are encrypted and handled in accordance with our privacy policy.

1.2.2 Installed App List Data Usage Disclosure

For anti-fraud and credit scoring purposes, this app accesses installed application information only when the user actively taps the “Apply” button during the loan application process.

The collected app list data is limited to essential fields only, including app name, app version, installation time, and app package ID.

This information is used solely for anti-fraud and credit assessment purposes and is not used for any other purposes. Installed app list data is not shared with any third-party services.

All data transmissions are encrypted and handled in accordance with our privacy policy.

We will always request your permission before accessing or uploading sensitive data. Your mobile number is collected when you register; profile and KYC information is uploaded when you submit those forms; approximate location may be collected after you accept our in-app disclosure and grant location permission. Device, SMS and installed-app data described above are collected and uploaded only when you tap “Apply” during a loan application and grant the required permissions.

The SMS and installed-app disclosures above state that such data is not shared with third-party services for their own purposes. Contracted service providers (such as cloud hosting or fraud-detection vendors) that process data strictly on our behalf and under confidentiality obligations are not considered independent third-party recipients of that data.

1.3 Credit Bureau Data

We may request data from external credit bureaus or financial institutions to enhance credit assessment accuracy. Before making any such request, we will inform you of the provider involved and obtain your separate authorisation. No external queries occur without your explicit consent.

2. How We Use Your Information

We use personal information for the following purposes:

• Identity verification and Know Your Customer (KYC) compliance
• Credit scoring, assessment and loan decisioning
• Loan disbursement and repayment processing via M-Pesa
• Repayment monitoring, collections and loan extension management
• Fraud detection, device authentication and risk management
• Customer support and dispute resolution
• Service improvement, statistical analysis and product development
• Compliance with legal, regulatory and accounting obligations in Kenya
• Marketing and promotional activities — only if you separately opt in; you may withdraw consent at any time by contacting us

3. Legal Basis for Processing

We process your data based on:

• Contract performance — to provide lending services you request
• Legitimate interests — fraud prevention, security and service improvement
• Legal obligation — compliance with Kenyan law and regulatory requirements
• Consent — for optional processing such as marketing, credit bureau inquiries and sensitive permissions

4. M-Pesa Payments

Loan disbursement and repayment are processed through Safaricom M-Pesa. We collect your M-Pesa mobile number, transaction amounts, reference numbers and payment status. We never collect, store or request your M-Pesa PIN. All M-Pesa transactions are confirmed on your Safaricom phone.

5. Data Sharing

We do not sell your personal data. We may share data only in these circumstances:

• With your explicit consent — for optional services or marketing you agree to
• Service providers — payment processors (M-Pesa/Safaricom), identity verification vendors, cloud hosting, analytics and fraud-detection partners, operating under strict confidentiality obligations
• Credit bureaus — only with your separate authorisation
• Legal requirements — court orders, law enforcement or regulatory requests, where we will notify you when legally permitted
• Security vendors — for fraud detection and incident response

6. Data Security & Storage

We implement appropriate technical and organisational measures to protect your data:

• In transit — industry-standard encryption (TLS/HTTPS)
• At rest — strong encryption algorithms on our servers
• Access control — only authorised personnel may access your data
• Data residency — data is transmitted to and stored on our secure servers. Specific retention periods are available upon request

7. Cookies and this Website

The FishPesa website at fishpesa.com is a static information site. We do not use advertising cookies or third-party tracking pixels on this website. Your browser may send standard technical data (such as IP address, browser type and pages visited) to our hosting provider (Cloudflare) as part of normal web delivery and security.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, including providing services, complying with legal obligations and resolving disputes. When data is no longer needed, we securely delete or anonymise it.

9. Your Rights

Under the Kenya Data Protection Act, 2019, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to legal and contractual obligations)
• Withdraw consent for optional processing (e.g. marketing)
• Object to certain processing activities
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC)

You may exercise these rights through in-app account features where available, via our account deletion page, or by contacting us as described in Contact Us below. Account deactivation is available after all outstanding loans have been fully repaid.

10. Account Deactivation

You may request account deletion in the FishPesa app (Profile → Deactivate) or on the web at https://fishpesa.com/delete-account.

When you request account closure:

1. All outstanding loans must be fully repaid
2. After confirmation, there is a 7-day grace period to cancel the closure by logging in again
3. If you do not log in within 7 days, the account is permanently closed

11. Children

FishPesa is not intended for persons under 18 years of age. We do not knowingly collect personal data from minors.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will reflect the latest version. Continued use of the app after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or need to raise a privacy-related concern, please email us at [email protected]. We will review your message and respond in accordance with applicable law.