Back to Legal

Privacy Policy

Last updated: August 2026

1. Data Controller

Finestbit Digital (trading as Merry-Go)
Email: dpo@merry-go.ac.ke

2. Data We Collect

  • Phone number
  • Display name
  • PIN (hashed, not stored in plain text)
  • Contribution records
  • M-Pesa transaction references
  • Device information
  • Crash and error logs

3. How We Use Data

  • Authenticate your identity
  • Track contributions
  • Send reminders
  • Process Pro subscriptions
  • Prevent fraud
  • Comply with legal obligations

4. Legal Bases

We process your data on the basis of:

  • Consent (given on signup)
  • Contract performance (to run the service)
  • Legitimate interest (security, fraud prevention)
  • Legal obligation (tax, KRA compliance)

5. Data Sharing

We share data only with:

  • Google Cloud Platform (Firebase) - storage and hosting
  • Safaricom (M-Pesa) - payment processing
  • WhatsApp (Meta) - reminder messages

We do NOT sell your data.

6. Data Retention

  • Account data: kept while your account is active
  • Transaction data: 7 years (tax compliance)
  • Error logs: 90 days

7. Security

  • AES-256 encryption at rest
  • TLS 1.3 in transit
  • PIN hashing (SHA-256)
  • OTP verification
  • Daily encrypted backups
  • Access controls

8. Your Rights

Under the Kenya Data Protection Act (2019) and the GDPR, you have the right to: access your data, correct it, request erasure, restrict processing, port it elsewhere, object to processing, and withdraw consent.

To exercise any right, email dpo@merry-go.ac.ke. We respond within 30 days.

9. Cross-Border Transfers

Some data may be transferred to South Africa and the United States (for cloud infrastructure). These transfers are protected by Standard Contractual Clauses.

10. Breach Notification

In the event of a data breach, affected users are notified within 72 hours. The Office of the Data Protection Commissioner (ODPC) is notified as required by law.

11. Children

Merry-Go is not intended for use by anyone under 18. We do not knowingly collect data from minors.

12. Changes

We may update this policy. The "Last updated" date at the top reflects the latest version.

13. Contact

Data Protection Officer
Email: dpo@merry-go.ac.ke
WhatsApp: +254 100 073610