Privacy Policy

1. Information We Collect

When you register for ArchPay, we collect:

• Business information — your business name, email address, and phone number
• Transaction data — payment amounts, phone numbers, M-Pesa receipt numbers, and timestamps for transactions processed through our platform
• Technical data — API usage logs, webhook delivery attempts, and channel configurations

2. How We Use Your Information

• To process M-Pesa STK Push payments on your behalf
• To deliver transaction callbacks and webhook notifications to your endpoint
• To send account-related communications (welcome emails, transaction alerts)
• To enforce platform security and prevent fraud
• To provide customer support

3. Data Storage

Your data is stored in MongoDB Atlas (cloud database hosted in AWS). All data is encrypted at rest and in transit using TLS/SSL. We retain transaction records for a minimum of 7 years to comply with Kenyan financial regulations.

4. Sharing of Information

We do not sell your personal data. We share data only:

• With Safaricom M-Pesa to process payment requests
• With our cloud infrastructure providers (Heroku, MongoDB Atlas) under strict data processing agreements
• When required by Kenyan law or regulatory order

5. API Keys & Security

Your API keys grant access to your account. You are responsible for keeping them secure. We store only a hashed/masked version of your keys. If you believe your key has been compromised, regenerate it immediately from your dashboard settings.

6. Your Rights

• Access your data at any time via your dashboard
• Request deletion of your account and associated data by contacting us
• Export your transaction history in JSON format

7. Cookies

ArchPay does not use tracking cookies. We use browser localStorage only to persist your session token for convenience. No third-party analytics or advertising cookies are used.

8. Children's Privacy

ArchPay is a business payment platform intended for adults and registered businesses. We do not knowingly collect information from persons under 18.

9. Changes to This Policy

We may update this policy from time to time. We will notify registered users of material changes via email. Continued use of the platform after changes constitutes acceptance.