Privacy Policy

This Privacy Policy ("Policy") applies to all users of the MyHUB mobile application ("App"), the MyHUB web dashboard, and any related services operated by the MyHUB team ("we", "us", "our"). It governs the collection, processing, storage, and disclosure of personal data in connection with those services.

This Policy is issued in compliance with the Kenya Data Protection Act, 2019 (No. 24 of 2019) and the Data Protection (General) Regulations, 2021 (Legal Notice No. 206). Where you access the service from outside Kenya, we continue to apply the same standards, and where applicable, we align with the requirements of the General Data Protection Regulation (EU) 2016/679 (GDPR).

By using the App or any related service, you confirm that you have read and understood this Policy and that you consent to the processing of your personal data as described here. If you do not agree, you should discontinue use of the service immediately.

2.1 Information You Provide Directly

When you register and use MyHUB, you provide us with:

2.2 Transaction Data

As you use the service, we process and store records of:

• USSD requests sent, including timestamps, execution results, and response codes
• M-Pesa transaction confirmations received by SMS, including amounts, reference codes, and counterparty numbers
• Pending, successful, and failed transaction histories
• Offer configurations you set within the application

Transaction data is necessary for the core function of the service. It cannot be disabled without rendering the service non-functional. Retention periods are described in Section 6.

2.3 Device and Technical Data

We automatically collect certain technical information to ensure the service operates correctly:

• Device identifiers: Android device ID, a hashed device public key for premium seat binding
• Operating system and app version: Used for compatibility checks and update notifications
• Connectivity state: Online/offline status for transaction queue management
• Crash and error logs: Stack traces, error codes (no personal content is included)
• IP address: Logged server-side for abuse prevention and rate limiting only; not stored long-term

We do not collect GPS location, microphone input, camera images, contacts, calendar data, or any information unrelated to the financial transaction management function of the App.

MyHUB requests the following Android permissions. Each permission is used only for the stated purpose and nothing beyond it.

We use the personal data we hold only for the following defined purposes:

• Service operation: Processing USSD transactions, matching SMS confirmations to pending requests, updating transaction status records, and delivering real-time notifications to connected interfaces.
• Account management: Creating and maintaining user accounts, authenticating sessions, enforcing single-device login, and managing subscription entitlements.
• Fraud detection and transaction integrity: Analysing patterns in transaction data to identify anomalous behaviour, prevent duplicate processing, and protect users against chargebacks and fraud.
• Service improvement: Reviewing aggregated, anonymised usage metrics to identify performance bottlenecks, prioritise feature development, and fix defects.
• Customer support: Responding to support requests, investigating reported issues, and providing guidance on service use.
• Legal and regulatory compliance: Meeting our obligations under the Kenya Data Protection Act, cooperating with lawful requests from competent authorities, and enforcing our Terms of Service.
• Security operations: Protecting our infrastructure against unauthorised access, denial-of-service attacks, and other threats through logging, rate limiting, and anomaly detection.

We do not use your data for advertising, profiling for marketing purposes, or any form of resale to third parties.

Under the Kenya Data Protection Act 2019 and the Data Protection (General) Regulations 2021, we are required to identify a lawful basis for each category of data processing. Our bases are as follows:

• Performance of a contract (Section 30(1)(b) DPA 2019): The majority of processing — running transactions, storing records, authenticating users — is necessary to deliver the service you contracted for when you registered an account.
• Legitimate interests (Section 30(1)(f) DPA 2019): Processing for fraud detection, security operations, aggregated performance analytics, and service improvement, where those interests are not overridden by your rights.
• Consent (Section 30(1)(a) DPA 2019): For optional communications such as service announcements or policy update notifications, we rely on the consent you give at the point of registration. You may withdraw consent at any time via the in-app settings.
• Legal obligation (Section 30(1)(c) DPA 2019): Where we are required to retain or disclose data under Kenyan law, including directives from the Central Bank of Kenya, the Communications Authority of Kenya, or a court of competent jurisdiction.

6.1 Where Data Is Stored

• Google Firebase (Cloud): User profiles, agent data, transaction history, and device status are stored in Firebase Firestore and the Firebase Realtime Database. Google's data centres used for this project are located in the Africa (Johannesburg) and Asia-Southeast (Singapore) regions. Google LLC is certified under ISO/IEC 27001:2022 and complies with the EU–US Data Privacy Framework.
• Device storage (SQLite): A local cache of recent transactions is maintained on your device for offline operation. This data is stored in the application's private storage directory, inaccessible to other apps.
• Device storage (SharedPreferences, encrypted): Session credentials and subscription entitlement data are stored in AES-256 encrypted SharedPreferences using the Android Keystore system.

6.2 Retention Periods

We apply the following retention schedule:

When you delete your account, we initiate a complete data purge across all Firebase collections associated with your UID. This process is completed within 30 days. Local device data is cleared immediately upon logout or uninstall.

We operate a multi-layered security programme aligned with ISO/IEC 27001:2022 and, where relevant to payment data flows, PCI DSS v4.0 principles. The controls we have deployed include:

• Transport encryption: All communication between the App, our servers, and Firebase uses TLS 1.2 or higher. Connections are validated against pinned certificates where technically feasible.
• Credential security: Passwords and session tokens are never stored in plain text. We use Firebase Authentication's industry-standard credential management, including secure token issuance and revocation.
• Data isolation: All database queries are scoped to the authenticated user's UID. A user can only read or write their own records. Server-side Firestore Security Rules enforce this at the database layer, independent of application logic.
• Encrypted local storage: Sensitive data held on the device — notably premium entitlement tokens and session identifiers — is encrypted using AES-256-GCM via the Android Keystore, bound to the device hardware where supported.
• Rate limiting and abuse prevention: API endpoints are rate-limited per device and per IP address. Repeated failed authentication attempts trigger automatic temporary blocks.
• Device attestation: The App uses a custom device attestation flow to verify application integrity before issuing session credentials, reducing the risk of credential theft by modified APK variants.
• Single-device session enforcement: Only one authenticated session per device type is permitted at a time. A new login from another device immediately invalidates the previous session and notifies the affected user.
• Background worker scheduling: All background operations are handled via Android WorkManager. The App does not use AlarmManager or persistent polling threads that could bypass system security controls.

We do not sell, rent, or trade your personal data to any third party. We share data only in the following defined circumstances:

• Service providers: Google LLC (Firebase platform hosting), Vercel Inc. (web infrastructure), and Safaricom PLC (M-Pesa payment network integration) receive data to the minimum extent necessary to deliver their respective services. All providers are contractually bound to process data only on our instructions and to maintain appropriate security standards.
• Legal requirements: We will disclose personal data where required to do so by a valid court order, warrant, or regulatory directive issued by a competent Kenyan authority, including the Office of the Data Protection Commissioner, the Central Bank of Kenya, or the Communications Authority of Kenya. Where legally permitted, we will notify you before complying.
• Protection of rights: We may disclose data to the extent necessary to prevent or investigate fraud, enforce our Terms of Service, or protect the safety of users or the public.
• Business transfers: If MyHUB is acquired by or merged with another entity, your data may be transferred to the successor entity, subject to the same protections described in this Policy. We will provide you with advance notice of any such transfer.

In all cases, we disclose only the minimum data required for the specific purpose and do not grant third parties the right to use your data for their own marketing or commercial purposes.

The Kenya Data Protection Act 2019 grants you the following rights in respect of your personal data. You may exercise any of these rights by contacting us using the details in Section 12.

• Right of access (Section 26 DPA): You may request a copy of the personal data we hold about you and information on how it is being processed. We will respond within 21 days as required by the DPA.
• Right to rectification (Section 26 DPA): If any data we hold about you is inaccurate or incomplete, you have the right to have it corrected. You can update most information directly through the App settings.
• Right to erasure (Section 26 DPA): You may request that we delete your personal data. Where we have no legal obligation to retain it and no overriding legitimate interest, we will comply within 30 days. Deletion of your account triggers an automatic full data purge.
• Right to restrict processing (Section 26 DPA): You may ask us to suspend the processing of your data in certain circumstances — for instance, while a dispute about accuracy is resolved.
• Right to data portability: You may request an export of the personal data you have provided to us in a structured, machine-readable format (JSON or CSV).
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• Right to object (Section 26 DPA): You may object to processing based on legitimate interests where your particular circumstances require it.
• Right to lodge a complaint: If you believe we have not handled your data lawfully, you have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya (www.odpc.go.ke).

MyHUB is a financial services tool intended strictly for use by adults. The App is designed for registered M-Pesa agents and business operators. You must be at least 18 years of age to create an account.

We do not knowingly collect personal data from persons under 18. If we discover that a user under the age of 18 has provided us with personal data, we will delete that data promptly and close the associated account. If you believe a minor has registered an account, please contact us immediately at [email protected].

We may update this Privacy Policy from time to time to reflect changes in the law, our services, or our data practices. When we do, we will update the "Last Updated" date at the top of this page.

For material changes — those that significantly affect your rights or the way we process your data — we will notify you through a prominent in-app notification and, where we hold your email address, by email, at least 14 days before the changes take effect. Your continued use of the service after the effective date of the updated Policy constitutes your acceptance of the changes.

We archive all previous versions of this Policy. If you would like a copy of a specific previous version, contact us using the details below.

If you have questions about this Policy, wish to exercise a data subject right, or want to report a concern about how your data is being handled, please reach us through any of the following channels:

If you are not satisfied with our response, you have the right to escalate your complaint to the Office of the Data Protection Commissioner of Kenya, established under Section 5 of the Kenya Data Protection Act 2019, at www.odpc.go.ke.