Privacy Policy
Nichomez Enterprise ("Nichomez", "we", "us") provides multi-tenant financial management software for help groups, GROUP/SACCOs, and cooperatives. This Privacy Policy explains how we collect, use, store, and share information when you use our marketing website, web application, APIs, and mobile app. It is written to align with Google Play User Data / Data Safety requirements and applicable Kenyan data-protection expectations.
1. Who this policy covers
- Visitors to nichomez.com (product information and live aggregate statistics).
- Members and officials who sign in at api.nichomez.com or through the Nichomez Android app.
- GROUP/SACCO administrators who configure tenant settings, reports, communications, and payment integrations.
Each GROUP/SACCO is a separate tenant. Your organization’s officials control most day-to-day data about members. Nichomez operates the platform infrastructure, security, and shared payment rails on their behalf.
2. Information we collect
Depending on how you use Nichomez, we may process:
- Account and identity data: name, phone number, email address, national ID or registration number where collected by your GROUP/SACCO, login credentials, role (member, official, collector), and session tokens.
- Financial and membership data: contributions, share capital, loan applications and balances, repayments, fines, dividends, withdrawals, guarantor details, statements, and ledger postings maintained for your organization.
- Payment and wallet data: M-Pesa references, STK push receipts, paybill details, KCB e-wallet transaction references, and reconciliation metadata required to post deposits and disbursements.
- Communications: SMS and email content sent through the platform, reminder preferences, delivery logs, and Android push notification tokens (FCM).
- Device and technical data: IP address, browser or app version, device type, operating system, crash diagnostics (including Sentry where enabled), and API request logs used for security and reliability.
- Microphone (optional): if you use the in-app assistant with speech dictation, audio is processed on-device or via the OS speech service to text for your session. We do not sell voice data or use it for advertising.
- Contacts (optional, officials only): when registering a member, you may grant contacts access so you can pick a phone number/name. We receive only the fields you confirm in the registration form — not your full address book for advertising or resale.
- Biometrics (optional, on-device): fingerprint/face unlock uses your device biometric APIs. Biometric templates stay on the device; Nichomez receives only success/failure of unlock, not biometric images.
3. How we use information
- Authenticate users and enforce role-based access within each tenant.
- Operate ledgers, loans, contributions, reports, and official workflows requested by your GROUP/SACCO.
- Send transactional SMS, email, and in-app / push notices (e.g. payment reminders, loan installments).
- Integrate with payment providers (including KCB and M-Pesa) to initiate and reconcile payments you authorize.
- Run optional programs your officials enable, such as debt collection hubs and member referral rewards.
- Monitor platform health, prevent fraud, and improve reliability and security.
- Display aggregate, non-personal statistics on nichomez.com (e.g. total registered members across tenants).
We do not sell personal data, and we do not use app data for third-party advertising or cross-app tracking.
4. Google Play Data Safety summary
The following maps to disclosures you should see (and that we maintain) in Google Play Console → App content → Data safety
for package com.nichomez.app:
- Collected: personal info (name, email, phone), financial info (payments, loans, contributions), app activity / diagnostics, device or other IDs (push tokens, session identifiers).
- Optional / permission-gated: microphone (voice assistant), contacts (official member registration picker), notifications.
- Shared: with payment processors (KCB / M-Pesa), SMS/email providers, hosting and crash analytics vendors — only as needed to run the Service.
- Security practices: data encrypted in transit (HTTPS/TLS); account authentication required; Android app backup of auth tokens disabled at application level.
- Deletion: users can request account deletion via the in-app Delete account link and at nichomez.com/account-deletion/ (see section 9).
5. Legal bases and your organization’s role
Nichomez processes data to perform our contract with your GROUP/SACCO and its members, to comply with applicable law, and — where appropriate — with consent (for example, optional microphone/contacts permissions or optional programs your officials enable). Your GROUP/SACCO remains responsible for informing members about how their data is used within that organization and for collecting any consents required under Kenyan law.
6. Sharing and disclosure
We do not sell personal data. We may share information with:
- Your GROUP/SACCO officials and other authorized users within the same tenant.
- Service providers that host infrastructure, deliver SMS/email/push, provide crash analytics, or process payments — under contractual confidentiality and security obligations.
- Regulators or courts when required by law, or to protect rights, safety, and platform integrity.
- Other members only where your GROUP/SACCO’s policies and product features make information visible (e.g. guarantor lists, referral attribution).
7. Data retention and security
We retain data for as long as your GROUP/SACCO uses the platform and as needed for accounting, audit, dispute resolution, and legal obligations (financial ledgers are commonly retained for 7+ years under Kenyan cooperative / accounting practice). We apply access controls, encryption in transit (HTTPS/TLS), tenant isolation, and operational monitoring. The Android app stores session tokens locally with backup disabled at the application level.
8. International processing
Infrastructure providers may process data outside Kenya. Where this occurs, we require appropriate safeguards consistent with applicable data-protection requirements.
9. Account and data deletion
Google Play requires a clear way to request deletion of an app account and associated user data. Nichomez provides:
- Web: https://nichomez.com/account-deletion/
- In-app: Privacy / Terms / Delete account links on Welcome and Login screens.
Demo or unpaid trial logins may use self-service deletion. Eligible accounts are deleted or anonymised promptly after a successful request (typically within a few minutes of confirmation; residual backups may take up to 30 days to expire).
Live production GROUP/SACCO memberships cannot be fully erased via self-service because financial and membership records must be retained for accounting, audit, fraud prevention, and regulatory compliance. Members should contact their GROUP/SACCO officials to deactivate membership. Officials may request platform support at info@nichomez.com. Where law requires retention, we keep only what is necessary and disclose that practice here and on the account deletion page.
10. Your rights and choices
Subject to law and your GROUP/SACCO’s policies, you may request to:
- Access or correct personal data we hold about you.
- Withdraw consent for optional processing (e.g. microphone, contacts, optional programs) where consent is the legal basis.
- Object to or restrict certain processing, or request deletion where no longer required and not subject to legal retention.
Contact your GROUP/SACCO officials first for member-record changes. For platform-level privacy requests, email info@nichomez.com.
11. Children
Nichomez is intended for adults who are registered members and officials of financial groups. We do not knowingly collect data from children under 18 without appropriate authorization from a guardian and the GROUP/SACCO. The app is not directed at children.
12. Changes to this policy
We may update this policy from time to time. Material changes will be reflected on this page with a revised "Last updated" date. Continued use of Nichomez after changes constitutes acceptance of the updated policy.
13. Contact
Nichomez Enterprise (Google Play publisher / organizational developer)
Nairobi, Kenya
Privacy & support: info@nichomez.com
Platform: api.nichomez.com
Account deletion: nichomez.com/account-deletion/
Related document: Terms of Service