Privacy Policy

1. Scope of This Policy

This Privacy Policy applies to personal data collected through or in connection with the Services provided by Kolacash Limited. It applies to information collected from users, customers, and visitors who access or use our Services.

2. Information We Collect

Depending on how you use our Services, we may collect the following categories of information:

• Account Information, including your phone number, email address, WhatsApp number, username, and other information you provide when registering or managing your account.
• Verification Information, including one-time passwords (OTP), verification status, and related records used to confirm that an account belongs to its rightful owner.
• Transaction Information, including payment-related details, order details, transaction identifiers, timestamps, and records necessary to process transactions, refunds, disputes, and compliance checks.
• Device and Technical Information, including device model, operating system, app version, IP address, language settings, browser type, crash reports, log data, and other diagnostic information.
• Usage Information, including interactions with our Services, features used, pages viewed, session activity, access times, and analytics information.
• Support and Communication Information, including information you provide when you contact us for customer support, submit inquiries, or communicate with us regarding your account or transactions.
• Wallet and Payout Information, including your in-app wallet balance and history, withdrawal requests, and the payout accounts you add (such as bank or mobile-money account name, number, provider, market and currency), used to credit completed trades and send withdrawals to you.
• Support Chat Information, including messages and photos you send to our support team through the in-app chat, and our replies. Chat content is stored on KolaCash-controlled servers and is accessible only to authorised KolaCash staff for the purpose of helping you.
• Card Submission Information, including gift card photos, receipts, card codes and related details you submit for a trade. These are visible only to authorised staff who review your trade.
• Push Notification Tokens, if you allow notifications, so that we can tell you when our team replies or your trade status changes. Notifications do not include message content, amounts or card details.

3. How We Use Information

We may use your personal data for the following purposes:

• To create, maintain, and secure your account.
• To verify your identity and confirm that an account belongs to its rightful owner.
• To provide account registration, login, authentication, and recovery functions.
• To send OTP codes, verification messages, security alerts, and service-related communications through channels such as email, SMS, or WhatsApp where applicable.
• To process transactions, payments, refunds, and related operational activities.
• To improve, monitor, and analyze the performance, usability, and reliability of our Services.
• To detect, investigate, prevent, and respond to fraud, abuse, security incidents, unauthorized access, and other harmful or illegal activity.
• To comply with applicable laws, regulations, lawful requests, and internal risk-control or compliance obligations.
• To provide customer support and respond to user inquiries or requests.
• To operate your in-app wallet, credit completed trades, and process withdrawals to the payout accounts you choose.
• To answer your support chat messages and keep a record of the conversation so any team member can continue helping you.

4. Legal Basis for Processing

Where required by applicable law, we process personal data on one or more of the following legal bases:

• Performance of a contract, including providing the Services you request, account access, and transaction processing.
• Compliance with legal obligations, including recordkeeping, anti-fraud, regulatory, tax, accounting, or law-enforcement requirements.
• Legitimate interests, such as protecting the security of our Services, improving product performance, preventing misuse, and operating our business responsibly.
• Consent, where consent is required under applicable law for specific processing activities.

5. How We Share Information

We do not sell your personal data. We may disclose personal data only as reasonably necessary in the following circumstances:

• To service providers and vendors who perform services on our behalf and under appropriate contractual or operational safeguards.
• To payment processors, payment gateways, banking partners, and fraud-prevention providers in connection with payments and transaction handling.
• To messaging, authentication, and communication providers for delivery of OTP, verification, or service-related notifications.
• To comply with applicable law, regulation, judicial process, governmental request, or lawful authority.
• To protect our rights, property, safety, users, business operations, or the integrity of the Services.
• In connection with a merger, acquisition, financing, reorganization, sale of assets, or similar corporate transaction, subject to applicable legal requirements.

6. Payment and Messaging Providers

Some parts of the Services rely on third-party providers to support payment processing, transaction settlement, messaging delivery, identity confirmation, analytics, hosting, and infrastructure operations.

Examples may include:

• Banks and mobile-money partners that deliver withdrawals to your chosen payout account.
• Messaging and verification providers such as WhatsApp, Infobip, SMS and email delivery services used to send one-time passwords and service messages.
• Cloud hosting, database and file-storage providers that store your account data, chat messages and uploaded photos on our behalf.
• Push-notification services (Apple Push Notification service and Google Firebase Cloud Messaging) that deliver notifications to your device.
• Analytics, monitoring, and security providers that help us operate and improve the Services.

These third parties may process personal data in accordance with their own privacy terms and only to the extent needed to provide the relevant services to us.

7. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Services, maintain business and transaction records, comply with legal obligations, resolve disputes, enforce agreements, and support fraud prevention and security functions.

Retention periods may vary depending on the type of information, the nature of the Services used, applicable legal requirements, and legitimate business needs. When personal data is no longer required, we will delete it, de-identify it, or securely anonymize it where reasonably practicable.

Support chat messages and photos are kept while your account is active so that we can resolve follow-up questions about your trades. They are deleted together with your other personal data when your account is deleted, except where we must keep transaction records as described below.

8. Data Security

We implement reasonable administrative, technical, and organizational safeguards designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. These measures may include access controls, encryption where appropriate, system monitoring, logging, authentication controls, and internal security procedures.

However, no method of transmission over the internet or method of electronic storage is completely secure. Accordingly, while we strive to use appropriate safeguards, we cannot guarantee absolute security.

9. International and Cross-Border Transfers

Because our service providers, technical infrastructure, support operations, or business partners may be located in different countries or regions, your personal data may be transferred to, stored in, or processed outside your country or region of residence.

Where such transfers occur, we take reasonable steps to ensure that appropriate safeguards are in place and that your personal data receives a level of protection consistent with applicable law.

10. Your Rights and Choices

Subject to applicable law, you may have the right to:

• Request access to personal data we hold about you.
• Request correction of inaccurate or incomplete personal data.
• Request deletion of your personal data or closure of your account.
• Object to or request restriction of certain processing activities.
• Withdraw consent where processing is based on consent, without affecting prior lawful processing.
• Request information about how your personal data is used or shared.

We may need to verify your identity before fulfilling certain requests, and we may retain certain information where required by law or for legitimate business or security reasons.

11. Account Deletion

You can delete your account at any time in the App under Account → Delete account. After you confirm, your account is closed immediately and you can no longer sign in. We keep your data for a 30-day grace period in case the request was made by mistake — contact support within that period to cancel it. After 30 days, your personal data, including your profile, contact details, payout accounts, support chat messages and device tokens, is permanently deleted.

We may retain limited transaction records (such as trade references, amounts and dates) after deletion where required to comply with legal, accounting or anti-fraud obligations, resolve disputes, or enforce our agreements. These records are no longer linked to your contact details.

Before requesting deletion, please withdraw any remaining wallet balance.

12. Cookies and Similar Technologies

Our website or online services may use cookies, local storage, pixels, SDKs, log files, and similar technologies to support core functionality, remember preferences, understand usage patterns, improve performance, and protect the security of the Services.

You may be able to control certain cookies or similar technologies through your browser or device settings. Please note that disabling some technologies may affect the functionality or availability of certain features.

13. Children’s Privacy

Our Services are not directed to children under the age required by applicable law to consent to data processing in their jurisdiction. We do not knowingly collect personal data from children without appropriate authorization where required.

If you believe that a child has provided personal data to us inappropriately, please contact us and we will take reasonable steps to investigate and, where appropriate, delete such information.

14. Third-Party Links and Services

The Services may contain links to third-party websites, applications, or services that are not operated by us. We are not responsible for the privacy practices, content, or security of such third parties. We encourage you to review their privacy policies before providing personal data to them.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our business practices, technologies, legal requirements, or Services. Any updates will be posted on this page with a revised effective date. Your continued use of the Services after such updates become effective may constitute acceptance of the revised Privacy Policy, to the extent permitted by applicable law.

16. Contact Us

If you have questions, requests, or concerns regarding this Privacy Policy or our privacy practices, please contact us: