Privacy Policy

1. Introduction

InvestFlow ("Company", "we", "us", or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your data when you use our platform, website, mobile applications, and related services (collectively, the "Platform").

By accessing or using the Platform, you agree to the terms of this Privacy Policy. If you do not agree, please discontinue use of the Platform.

2. Information We Collect

2.1 Personal Information

We may collect the following personal information:

• Full name, date of birth, and nationality
• Email address, phone number, and mailing address
• Government-issued identification documents (for KYC/AML compliance)
• Financial information, including bank account details and transaction history
• Employment and income information
• Investment preferences and risk tolerance

2.2 Automatically Collected Information

• Device information (type, operating system, browser)
• IP address and approximate location
• Usage data (pages visited, features used, timestamps)
• Cookies and similar tracking technologies

3. How We Use Your Information

We use collected information to:

• Create and manage your account
• Process investments, payments, and withdrawals
• Conduct KYC/AML verification and fraud prevention
• Send transactional notifications and platform updates
• Personalise your experience and recommend investment opportunities
• Analyse platform usage to improve our services
• Comply with legal and regulatory obligations
• Respond to support inquiries and resolve disputes

4. Data Sharing & Disclosure

We do not sell your personal data. We may share information with:

• Service Providers: Payment processors (M-Pesa/Safaricom, Stripe), identity verification partners, cloud hosting providers, and email/SMS delivery services.
• Regulatory Bodies: Government agencies, financial regulators, or law enforcement as required by applicable law.
• Professional Advisors: Auditors, legal counsel, and compliance consultants under strict confidentiality obligations.
• Business Transfers: In connection with a merger, acquisition, or asset sale, subject to privacy safeguards.

5. Data Retention

We retain personal data for as long as your account is active or as needed to provide services. After account closure, we retain data for up to 7 years to comply with financial regulations, legal obligations, and dispute resolution needs.

6. Data Security

We implement industry-standard security measures, including AES-256 encryption at rest, TLS 1.3 for data in transit, role-based access control, regular penetration testing, and 24/7 monitoring. Despite these measures, no electronic transmission or storage method is 100% secure.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access and receive a copy of your personal data
• Rectify inaccurate or incomplete information
• Request deletion of your data (subject to legal retention requirements)
• Restrict or object to certain processing activities
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, contact us at privacy@investflow.co.ke.

8. Cookies

We use essential cookies for authentication and session management, and optional analytics cookies to improve our platform. You can manage cookie preferences through your browser settings. Disabling essential cookies may affect platform functionality.

9. International Transfers

Your data may be processed in countries outside Kenya. When we transfer data internationally, we ensure appropriate safeguards are in place, including standard contractual clauses and adequacy decisions.

10. Children's Privacy

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors. If we learn that we have collected data from a minor, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or a prominent notice on the Platform. Continued use after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact: