Privacy Policy

1. Information Collection

Cyzora collects only data strictly required to process M-Pesa payments, prevent fraudulent activities, and maintain banking compliance under Central Bank of Kenya (CBK) financial regulations.

• Account credentials: name, verified corporate email, registered business registration number, and phone number.
• Transactional records: M-Pesa transaction receipts, timestamps, customer MSISDN phone identifiers, and ledger amounts.
• Technical access logs: client IP addresses, webhook response delivery codes, and TLS protocol fingerprints.

2. Processing & Transmission

All communications between your servers, Cyzora endpoints, and Safaricom Daraja v2 rails are encrypted via TLS 1.3. Webhooks are cryptographically signed using SHA256 HMAC tokens.

3. Retention & Tax Compliance

Under Kenya Revenue Authority (KRA) and CBK payment gateway statutory guidelines, transaction audit trails are preserved securely for a minimum of seven (7) years.

4. Contacting Data Protection

Inquiries regarding your stored ledger records or account deletion may be directed to privacy@cyzora.co.ke.