Privacy Policy

The types of personal information we obtain depend on how you interact with Chulri. "Personal Information" refers to any data that identifies, relates to, or can be associated with you.

• Information Collected Directly from You: Includes contact details (full legal name, primary phone number, email address), custom @username handles, account security credentials (4-digit Account Lock PIN), and KYC compliance uploads (National ID / Passport numbers, KRA PIN, ID photos, and verification selfies).
• Financial & Vault Information: Records of locked liquidity amounts, drip payout frequencies, target maturity dates, M-PESA receipt numbers, and external recipient phone numbers provided for beneficiary transfers.
• Usage & Device Data: Automatically collected usage metrics, including IP addresses, browser types, device identifiers, and session cookies used to prevent unauthorized access.

We process your data strictly to fulfill our financial and behavioral service commitments:

• Providing Core Services: Executing automated STK Push deposits, calculating lock schedules, and dispatching M-PESA B2C payouts directly to designated lines.
• Security & Fraud Prevention: Detecting malicious activity, validating 4-digit PIN authorizations, preventing duplicate identity registrations, and maintaining audit trails.
• Regulatory Compliance: Fulfilling Anti-Money Laundering (AML) and Know Your Customer (KYC) mandates required under Kenyan law.

Chulri does not sell, rent, or trade your personal information or transaction history to third-party advertisers. We disclose data only in the following limited circumstances:

• Payment Infrastructure Partners: With Safaricom PLC (M-PESA APIs) to process STK pushes and disburse automated payouts.
• Service Vendors: Cloud storage providers, database infrastructure, and SMS gateway vendors who operate under strict non-disclosure agreements.
• Legal Obligations: When compelled by law enforcement, court order, or regulatory authorities pursuant to applicable Kenyan statutes.

Depending on applicable regulations, you reserve the right to exercise the following data subject rights:

• Right to Access / Know: Request a copy of all personal records and transaction ledgers stored under your account.
• Right to Correct: Update inaccurate identity details, such as KRA PINs or username handles.
• Right to Erasure (Delete): Request deletion of your personal data, subject to legal record retention requirements for active financial vaults.
• Right to Restrict Processing: Request restrictions on how your data is processed in specific dispute scenarios.

We implement industry-standard TLS 1.3 encryption for data in transit and AES-256 encryption for sensitive media stored at rest.

How long we retain your personal data depends on statutory requirements (e.g., preserving transaction audit logs for financial reporting compliance). Upon account closure and vault settlement, unneeded KYC media is safely purged according to our retention schedules.