Privacy Policy

Airtime Duka ("we", "us", or "our") provides an online platform for buying Safaricom airtime for calls and SMS and for agents to earn commission by facilitating airtime purchases for others. This Privacy Policy explains what personal information we collect, why we collect it, and how it's handled when you use our website.

1. Information We Collect

We collect the following information depending on how you use the site:

• Contact details — your name, email address, and phone number, collected when you register an agent account.
• Transaction details — the recipient phone number, the M-Pesa number used to pay, the amount paid, and the M-Pesa transaction reference for each airtime purchase.
• Account activity — your commission balance, purchase history, and withdrawal requests, if you hold an agent account.
• Technical information — your IP address and basic browser information, used for security purposes such as identifying abusive or fraudulent activity.

We do not collect or store your M-Pesa PIN at any point. Payment authorization happens directly between you and Safaricom through the M-Pesa STK Push prompt on your phone — we never see or have access to your PIN.

2. How We Use Your Information

• To process airtime purchases and confirm payment via M-Pesa.
• To calculate and pay out commission owed to agents.
• To send order confirmations, withdrawal updates, and account-related notifications by email.
• To detect and prevent fraud, abuse, or unauthorized use of the platform — for example, identifying and blocking suspicious activity from a specific IP address.
• To respond to support requests.

3. Payment Processing

All M-Pesa payments are processed through Safaricom's Daraja API. When you make a payment, your phone number and payment details are shared with Safaricom solely to process that transaction. Safaricom's own privacy practices govern how they handle that data once it reaches their systems.

4. Sharing Your Information

We do not sell your personal information to third parties. We only share information where necessary to operate the service — principally with Safaricom, to process M-Pesa payments and complete airtime top-ups — or where required by law.

5. Data Security

Passwords are stored using industry-standard one-way hashing and are never stored or transmitted in plain text. We use rate limiting and IP-based blocking to guard against automated abuse of the payment system. While we take reasonable steps to protect your information, no online service can guarantee absolute security.

6. Data Retention

We retain transaction and account records for as long as your account remains active, and for a reasonable period afterward as needed for accounting, fraud prevention, and legal compliance purposes.

7. Your Rights

Under Kenya's Data Protection Act, 2019, you have the right to access the personal information we hold about you, request that inaccurate information be corrected, and request deletion of your data, subject to any legal or legitimate business reasons we may have to retain it (such as financial record-keeping requirements). To make a request, contact us using the details below.

8. Cookies

We use essential cookies to keep you logged in and to maintain your session while using the site. We do not use third-party advertising or tracking cookies.

9. Children's Privacy

This service is not directed at children, and we do not knowingly collect personal information from anyone under the age of 18.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date.

11. Contact Us

If you have questions about this Privacy Policy or how your information is handled, contact us at:

• Phone: 0725327911