Publisher and data protection roles
ChamaClub is published in Kenya by ChamaClub. For personal information used to operate accounts, provide the service, secure the app and answer support requests, ChamaClub acts as the data controller under the Kenya Data Protection Act, 2019.
Each chama decides why its membership applications, contribution records, loan records and governance records are created and how its officials use them. Depending on the activity, the chama may act as a data controller and ChamaClub may process those records for the chama as a data processor. Chama officials remain responsible for using member information lawfully and only for chama work.
Information we handle
- Account and profile information. Firebase Authentication identifies your account. Your profile may include your name, phone number and account identifier.
- Group membership and activity. We store the chamas you create, join or ask to join, member roles, meetings, RSVPs, votes and other group activity.
- Financial records. The app records contributions, M-Pesa references and parsed confirmation details, loans, repayments, investments, penalties, balances and related approvals. ChamaClub records activity but does not move money through M-Pesa.
- Join application details. A public chama application can include your workplace, residence, planned contribution, national ID number, reason for joining and an uploaded ID photo. ID photos are kept in protected Firebase Storage and are available only to you and members authorized to review the application.
- Support information. We receive the information you include when you contact us for help, exercise a data right or make an account deletion request.
- Technical information. Firebase may process device, network, authentication and error information needed to deliver and protect its services.
Purposes and lawful bases
Our lawful bases depend on the record and purpose:
- Contract. We process account, profile and service activity needed to provide ChamaClub at your request.
- Legitimate interests. We protect accounts, prevent misuse, maintain accurate audit records, diagnose errors and answer support requests. We consider the effect on members before relying on this basis.
- Consent. Optional Android SMS access and optional device features are used only after you choose to enable them. You can deny or withdraw permission in device settings.
- Legal obligation. We may retain or disclose information where Kenyan law requires it.
- Chama instructions. Where ChamaClub is a data processor, we process group records on the chama's documented use of the service, subject to law and this policy.
Optional SMS access on Android
You may allow ChamaClub to read SMS messages on Android so it can find your own M-Pesa confirmation and prefill the payment confirmation form. The app uses confirmation details such as the M-Pesa reference, amount and date to match a contribution or repayment.
On a device with SMS permission, ChamaClub can also ingest messages it recognizes as incoming M-Pesa confirmations. The app parses the sender name, phone number, amount, reference and payment date. For each chama where the device owner has an authorized Treasurer or Chairperson role, ChamaClub may place those parsed details in that chama's deposit inbox in Firestore to match a pending contribution. This is role-scoped processing within those chamas, not public sharing.
SMS access is optional. If you deny permission, you can paste the M-Pesa confirmation into the app instead. The contribution flow remains available without SMS permission.
App lock and device security
You can turn on a biometric or device-credential app lock that uses the fingerprint, PIN, pattern or password already configured on your device. ChamaClub does not receive your fingerprint or device credential. The app lock setting is stored locally in secure device storage and is used to protect the app when it opens.
How we use and share information
We use information to provide sign-in, maintain your profile, manage group membership, show group records, match payment confirmations, support governance decisions, secure the app and answer support requests.
Group records are shared with chama members or authorized leaders according to their role and the action involved. Join application details are limited to the applicant and the people authorized by that chama's approval policy. We do not sell personal information or use it for third-party advertising.
Firebase providers and cross-border processing
ChamaClub uses Google Firebase services, including Firebase Authentication for account identity, Cloud Firestore for hosted app records and Firebase Storage for uploaded files such as an ID photo. Google acts as a service provider and data processor for these hosted services.
Google may process or store information outside Kenya. This cross-border processing is subject to Google's contractual and technical safeguards and to the transfer requirements of Kenyan data protection law. You can review Google's privacy and Firebase data processing terms on Google's websites.
Retention and account deletion
We keep information while your account is active and for as long as needed to operate the service. You can make an account deletion request by following the steps on our Delete account page.
After a verified request, we delete or detach personal account data that is no longer needed. Transaction and audit records may be retained where required for legal obligations, fraud prevention, dispute resolution or financial accountability. Access to retained records is limited to the purpose for which they are kept.
Your rights
Subject to the Data Protection Act, you may ask to be informed about use of your information, access it, correct inaccurate information, object to or restrict certain processing, request deletion of information that no longer has a lawful reason to be kept, and ask for portable information where the right applies. You may also withdraw consent without affecting earlier lawful processing.
Email support@chamaclub.com. We may verify your identity and ask which chama or record is involved. A request cannot require us to alter an accurate shared transaction or governance record, but we will assess whether identifying details can be corrected, limited or detached.
ODPC complaints
If you believe a privacy concern has not been resolved, you may complain to Kenya's Office of the Data Protection Commissioner (ODPC). Current complaint channels and contact details are available at odpc.go.ke.
Children
ChamaClub is intended for adults who can participate in a chama and accept these terms. We do not knowingly offer accounts to children under 18. Contact us if you believe a child has provided personal information without lawful authority.
Security and data breach response
We use access rules, account authentication, role checks and protected storage to reduce unauthorized access. No online service can promise absolute security. If a data breach affects personal information, we will investigate, limit the exposure and notify affected people and the ODPC where Kenyan law requires notice.
Changes to this policy
We may update this policy when the service, providers or law changes. The effective date above will change, and we will give a suitable notice in the app or on this site when a change materially affects how personal information is used.
Contact
Questions, requests and complaints about this policy can be sent to support@chamaclub.com.