Privacy Policy

Last updated: October 9, 2026

This policy explains what personal data Kacha collects when you use our receipt-scanning and rewards service, how we use and share it, and the choices and rights you have. It applies to the Kacha mobile apps, the Kacha website, and related services (together, the “Service”).

1. Who we are

The Service is operated by the Kacha group of companies:

  • [Kacha Labs Limited], incorporated in Republic of Kenya (registered address: [Kenya registered address]). For users in Kenya, this is the data controller responsible for your personal data. It is registered with the Office of the Data Protection Commissioner (registration [ODPC registration number]).
  • [Kacha Labs Rwanda Ltd], incorporated in Republic of Rwanda (registered address: [Rwanda registered address]). For users in Rwanda, this is the data controller responsible for your personal data. It is registered with the National Cyber Security Authority (registration [NCSA registration number]).
  • [Kacha Labs, Inc.], incorporated in State of Maryland, United States (registered address: [US registered address]). This company owns the Service and operates the technical infrastructure on behalf of Kacha Labs Kenya and Kacha Labs Rwanda under intra-group data-processing agreements. For users outside Kenya and Rwanda, this is the data controller.

Wherever this policy says “Kacha”, “we” or “us”, it means the relevant company above. You can reach our privacy team at [email protected].

2. Information we collect

2.1 Information you give us

  • Account information: name, email address, and phone number, and the credentials you use to sign in.
  • Profile information: display name, profile picture, and any preferences or optional details (such as gender) you choose to add.
  • Receipts: the photos of receipts you upload and the information printed on them — merchant name, date, line items, quantities, prices, totals, taxes, and any QR code or invoice reference.
  • Rewards activity: your Kacha Points balance and the full history of how Points were earned, adjusted and redeemed, including airtime and other reward redemptions.
  • Referrals: the referral code you share or enter, and the link between a referrer and a referred user.
  • Support and feedback: the content of support tickets, bug reports, survey responses, and messages you send us.
  • Payment messages (Android, optional): if you turn this on, the content of M-Pesa payment notifications on your device (Kenya only), so matching transactions can be reconciled against your receipts. You see a specific explanation and grant this separately through Android’s own permission screen; we only ever read M-Pesa payment messages, never any other notification.
  • Contacts (optional): if you choose to buy airtime for someone else, the specific contact you pick, so we can fill in their phone number. We do not access your contacts for any other purpose.

2.2 Information we collect automatically

  • Usage data: screens viewed, features used, scans performed, session length, and similar activity within the Service.
  • Device data: device type and model, operating system and app version, and language.
  • Location: general location inferred from your IP address always; precise GPS location only if you grant it, used to show nearby prices and offers.
  • Diagnostic and log data: IP address, timestamps, crash reports, error traces, and performance metrics, used to keep the Service secure and working.
  • Cookies and similar technologies on our website — see section 7.

Our systems are configured to strip obvious personal identifiers out of diagnostic and analytics events before they are stored, so that operational data is kept as non-identifying as we reasonably can.

3. How we process your receipts

We use automated systems, and manual review where needed, to read each receipt, match items to known products and prices, award Points, and detect duplicates or alterations. We store both the original image and the extracted data.

If a receipt carries a fiscal QR code from a tax authority (for example KRA eTIMS in Kenya or an RRA EBM receipt in Rwanda), we may open the public verification page that code points to, to confirm the receipt is genuine. That page is already public; we don’t send the tax authority your account details or any other personal data. In some countries we also keep the QR code text and the public page it leads to, so we can improve how we read and check receipts there.

Guest use. You can try Kacha and scan a limited number of receipts before signing up, identified only by a server-issued guest ID and your device. A guest receipt runs through the same checks as any other; the Points it would earn are shown but not paid until you create an account and claim them. We keep unclaimed guest data rather than deleting it automatically, so you can still claim it later — email [email protected] with your guest ID to have it deleted sooner.

4. How we use your information and our legal bases

We use your information to:

  • provide the Service — create and secure your account, process your receipts, operate the Kacha Points programme, and deliver airtime and other reward redemptions (legal basis: performance of our contract with you);
  • run the referral programme and campaigns you take part in (legal basis: performance of our contract with you; your consent where a campaign asks for it);
  • keep the Service safe — authenticate sign-ins, prevent fraud and abuse of the rewards programme, and investigate suspected violations of our terms (legal basis: our legitimate interest in protecting the Service and other users; compliance with law);
  • understand and improve the Service through usage analytics and diagnostics (legal basis: our legitimate interest in improving the Service; your consent for non-essential website analytics);
  • communicate with you — service messages, responses to your requests, and, where you have not opted out, news about features and rewards (legal basis: performance of our contract; our legitimate interest in keeping you informed; your consent where required);
  • comply with legal obligations and enforce our agreements (legal basis: compliance with law; our legitimate interests).

We may produce aggregated or de-identified statistics — for example, total receipts scanned in a period, or which products sell well in which areas — that cannot reasonably be linked back to you, and use them for any purpose, including showing them to brands and manufacturers through Kacha for Manufacturers (legal basis: our legitimate interest in operating that service; this never discloses your identity or any single receipt of yours).

5. How we share your information

We do not sell your personal data. We share it only in these ways:

  • Within the Kacha group: between the companies named in section 1, to operate and support the Service.
  • Service providers: companies that process data on our behalf and on our instructions, to provide cloud hosting and storage, receipt data processing, product analytics, error monitoring, communications, and airtime redemption. They may only use the data to provide the service we have asked them for.
  • Legal and safety reasons: where we reasonably believe disclosure is required by law or legal process, or is necessary to protect the rights, property or safety of Kacha, our users, or the public — including to prevent fraud.
  • Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this policy continuing to apply to your data.
  • With your direction: when you ask us to share specific information, or take part in a feature that clearly involves sharing.
  • Aggregate insights for brands and manufacturers: de-identified, aggregated statistics built from receipts shoppers scanned — such as spend observed for a product or where it is purchased — shown to manufacturers through Kacha for Manufacturers. These never identify you or show your individual receipts.
  • Within your organisation: if you use Kacha through a business, accounting firm, store, or manufacturer account, see section 12 for how data is shared inside that organisation.

6. Where your data is stored

Kacha operates from Kenya and Rwanda. Our infrastructure and service providers are in the United States, so your data is stored and processed there. This transfer is necessary to provide the Service, covered by the intra-group data-processing agreements between the Kacha companies, and consented to at sign-up — the safeguards the Kenya Data Protection Act, 2019 and Rwanda’s Law No. 058/2021 on the protection of personal data and privacy permit. Where Rwandan law requires the National Cyber Security Authority’s authorisation for a transfer, Kacha Labs Rwanda obtains it. Your data is protected to this policy’s standard wherever it is processed.

7. Cookies and similar technologies

Our website uses cookies and similar technologies for sign-in, for remembering your choices, and — only with your consent — for analytics and diagnostics. You can accept or decline non-essential cookies when you first visit, and change your choice at any time from the “Cookie settings” link in the website footer. See our Cookie Policy for the full list.

8. How long we keep your data, and deletion

We keep your personal data for as long as your account is active, and for as long afterwards as we need it to meet a legal, accounting, or fraud-prevention requirement.

You can delete your account at any time from Account → Security → Close account in the app, or from the account deletion page on the website. When you do:

  • your personal data — profile, receipts and receipt images, Points and reward history, referral links, support messages, and related records — is deleted from our active systems immediately;
  • residual copies held in encrypted backups are overwritten on our normal backup cycle and are fully purged within 30 days;
  • we may retain a minimal record where the law requires it, or to resolve a dispute or enforce our agreements; anything kept for fraud prevention is reduced to the minimum needed and is not used for any other purpose.

For step-by-step instructions, see our account deletion help page.

9. Your rights

Under Kenya’s Data Protection Act, 2019, Rwanda’s Law No. 058/2021 (and comparable laws where they apply to you), you have the right to:

  • be informed of how your personal data is being used (this policy);
  • access the personal data we hold about you;
  • have inaccurate or incomplete data corrected;
  • have your data deleted, as described in section 8;
  • object to, or ask us to restrict, certain processing;
  • withdraw consent at any time, where we rely on consent;
  • receive a copy of certain data in a portable format;
  • lodge a complaint with the supervisory authority — in Kenya, the Office of the Data Protection Commissioner (odpc.go.ke); in Rwanda, the National Cyber Security Authority (ncsa.gov.rw) — or your local supervisory authority.

To exercise any of these rights, email [email protected]. We will respond within the time the law allows. Some data — such as your name and email — can also be viewed and updated directly in the app.

10. How we protect your data

We use industry-standard safeguards, including:

  • encryption of data in transit (HTTPS/TLS) and of stored files and backups;
  • access controls, authentication, and least-privilege permissions for our team;
  • row-level database security so accounts are isolated from one another;
  • logging, monitoring, and regular review of our security practices.

No system is perfectly secure, but we work to protect your data and will notify you and the relevant authority of a breach where the law requires it.

11. Children

Kacha is intended for adults. You must be at least 18 years old (or the age of majority in your country, if that is higher) to use the Service. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact [email protected] and we will delete it.

12. Using Kacha through a business, accounting firm, store or manufacturer

Kacha for Business, Kacha for Accountants, Kacha for Stores and Kacha for Manufacturers (together, the “Business Services”) are separately governed by the Business & Accounting-Firm Terms. This section explains how that changes the rest of this policy.

  • Who controls the data: the organisation (or, for an accounting firm, its client) controls what it puts into a Business Service and who on its team sees it. Kacha processes that data on the organisation’s instructions.
  • Receipts and filings stay confidential: an organisation’s own receipts, financial records and tax filings never feed the aggregate manufacturer insights in sections 4 and 5 — those come only from individual shoppers’ own receipts.
  • Retention can be longer: tax and accounting records are often legally required to be kept for a set number of years. Where that applies, we keep them that long even after the related account is deleted; section 8’s deletion commitments still apply to that person’s own personal data.
  • Tax IDs and business identifiers (for example a KRA PIN in Kenya or a TIN in Rwanda): collected to prepare tax filings and receipt checks, and protected to the same standard as any other data in this policy.

13. Changes to this policy

We may update this policy from time to time. If a change is significant, we will tell you through the app or by email before it takes effect. The “Effective” date at the top shows when the current version came into force. Continuing to use the Service after a change means you accept the updated policy.

14. Contact us

  • Privacy team: [email protected]
  • General support: [email protected]
  • Data controller (Kenya): [Kacha Labs Limited], [Kenya registered address]
  • Data controller (Rwanda): [Kacha Labs Rwanda Ltd], [Rwanda registered address]