Plain language summary: We collect the minimum data needed to run an invoicing service — your business details, invoices, and payment info. We share your invoice data with KRA because that's the whole point of eTIMS. We store data on Convex servers in the United States. We will never sell your data to anyone. You can export or request deletion of your data at any time (within the limits of what the law requires us to keep).
PesaStack Limited ("PesaStack," "we," "us") is the data controller for personal data processed through Risiti. We are a private limited company registered in the Republic of Kenya.
This Privacy Policy applies to all personal data we collect when you use Risiti on the web (getrisiti.com) or via mobile apps.
Note: Invoice data is transmitted to KRA's eTIMS system as a core function of the Service. This is not optional — it is the reason Risiti exists.
We do not store your M-Pesa PIN, M-Pesa account balance, or any payment card details.
We do not read, store, or process the content of any SMS messages you receive. SMS is outbound only.
| Purpose | Legal Basis |
|---|---|
| To provide the invoicing service and transmit invoices to KRA via eTIMS | Contract performance + Legal obligation (Tax Procedures Act, 2015) |
| To process M-Pesa subscription payments | Contract performance |
| To send transactional SMS (invoice confirmations, payment receipts, KRA status) | Contract performance + Legitimate interest |
| To verify your identity via OTP at login | Contract performance + Security (legitimate interest) |
| To comply with Kenyan tax, financial, and data protection laws | Legal obligation |
| To improve the Service using aggregated, anonymized analytics | Legitimate interest |
| To send renewal reminders and service announcements | Legitimate interest (you can opt out) |
| To send marketing communications about new features or offers | Consent (you can withdraw at any time) |
PesaStack does not sell your data. Ever. We share data only with the parties listed below, and only to the extent necessary to provide the Service.
Your invoice data is transmitted to KRA's eTIMS system via the OSCU API. This is the primary and mandatory function of Risiti. Sharing invoice data with KRA is required by Kenyan tax law. You cannot opt out of this and continue using the Service — it is the entire purpose of eTIMS invoicing.
When you make a subscription payment, your M-Pesa phone number and payment amount are shared with Safaricom's Daraja API to process the STK Push transaction. Safaricom's own privacy policy governs their handling of this data.
Your phone number (and the phone numbers of invoice recipients, where provided) are shared with Africa's Talking solely for the purpose of delivering SMS notifications. Africa's Talking processes this data as a data processor on our behalf.
All Risiti data — including your business profile, invoices, and payment records — is stored on Convex cloud infrastructure. Convex operates servers in the United States. See Section 5 on international data transfers.
We may disclose data to Kenyan law enforcement agencies, courts, the ODPC, or other regulatory bodies when required to do so by law, court order, or to protect the rights, property, or safety of PesaStack, our users, or the public.
Risiti stores all data on Convex cloud servers located in the United States. The United States does not have an adequacy determination from Kenya's ODPC under Section 48 of the Kenya Data Protection Act, 2019.
PesaStack relies on appropriate contractual safeguards with Convex (data processing agreements) to ensure your data receives an adequate level of protection when transferred outside Kenya. By using Risiti, you consent to this transfer.
If you have concerns about international data transfers, contact us at hello@getrisiti.com.
As a data subject under the Kenya DPA 2019, you have the following rights:
To exercise any of these rights, email hello@getrisiti.com with the subject line "Data Rights Request." We will verify your identity before processing the request.
PesaStack implements the following security measures to protect your data:
No security system is 100% impenetrable. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ODPC as required by the Kenya Data Protection Act, 2019.
Risiti is a business tool intended for adults operating registered businesses in Kenya. We do not knowingly collect personal data from anyone under 18 years of age. If you believe a minor has created an account, contact us at hello@getrisiti.com and we will delete the account.
For details on how Risiti uses cookies and tracking technologies on the web app, see our Cookie Policy.
In summary: we use session cookies for authentication, and anonymized analytics to understand how people use the app. We do not use third-party advertising trackers.
We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or SMS at least 30 days before the changes take effect. The updated policy will always be available at getrisiti.com/privacy.
Your continued use of Risiti after the effective date of changes constitutes acceptance of the updated policy.
For any privacy-related questions, requests, or complaints:
If you are not satisfied with our response, you have the right to contact the Office of the Data Protection Commissioner (ODPC):
Website: odpc.go.ke · Email: info@odpc.go.ke