Legal

Privacy Policy

Updated 19 September 2026

Overview

UtiBills Ltd ("UtiBills", "we", "us") operates a property and utility bill payment platform for Kenya. This policy explains what personal data we collect, why we collect it, and what rights you have under the Kenya Data Protection Act 2019.

What we collect

We collect the following categories of personal data:

  • Identity — name, national ID number (where required for payment compliance)
  • Contact — phone number (WhatsApp), email address
  • Tenancy — lease terms, unit address, landlord–tenant relationship
  • Utility accounts — meter numbers, account references, provider names
  • Payment — M-Pesa transaction IDs, amounts, timestamps, receipts. We never store your M-Pesa PIN.
  • Usage — messages sent to our WhatsApp bot, timestamps, intent logs used to operate the service

How we collect it

We collect data you give us directly through the WhatsApp bot, through the landlord dashboard, and through M-Pesa payment callbacks from Safaricom. We do not buy, rent, or scrape personal data from third parties.

Why we use it

We process personal data on the following legal bases under the Kenya Data Protection Act 2019:

  • Performance of a contract — to record leases, process payments, and send receipts
  • Legitimate interests — to send payment reminders, detect fraud, and improve the service
  • Legal obligation — to comply with CBK, KRA, and other regulatory requirements
  • Consent — to send optional marketing messages on WhatsApp (you can withdraw at any time by replying STOP)

Who we share it with

We share personal data only where necessary:

  • Safaricom — to initiate and confirm M-Pesa STK Push and B2B payments
  • Utility providers — account references passed to paybill numbers to complete payments
  • Meta (WhatsApp) — messages transit Meta infrastructure under their terms
  • OpenAI — message text is sent to GPT-4o-mini for intent recognition; we do not enable training on your data
  • Vercel / cloud infrastructure — the platform runs on Vercel; data is stored in our PostgreSQL database
  • Legal authorities — when required by law, court order, or to prevent serious harm

How long we keep it

We keep payment records for seven years to meet tax and regulatory obligations. Lease and tenancy records are kept for five years after the lease ends. WhatsApp conversation logs are kept for twelve months. You can request earlier deletion — see Your Rights below.

Your rights

Under the Kenya Data Protection Act 2019 you have the right to:

  • Access — request a copy of the personal data we hold about you
  • Rectification — correct inaccurate or incomplete data
  • Erasure — ask us to delete your data where there is no legal basis to keep it
  • Restriction — ask us to limit how we use your data while a dispute is resolved
  • Portability — receive your data in a structured, machine-readable format
  • Object — object to processing based on legitimate interests
  • Withdraw consent — reply STOP on WhatsApp, or email us, to withdraw marketing consent at any time

Data security

We encrypt data in transit (TLS 1.2+) and at rest. Access to production data is restricted to authorised personnel. We conduct periodic security reviews. If we suffer a breach that is likely to harm you, we will notify you and the Office of the Data Protection Commissioner within 72 hours of becoming aware.

Cross-border transfers

Our servers are hosted in the EU (Vercel infrastructure). We transfer data outside Kenya only where appropriate safeguards are in place — standard contractual clauses or equivalent protections recognised under the Kenya Data Protection Act 2019.

Children

UtiBills is not intended for anyone under 18. We do not knowingly collect data from minors. If you believe a minor has provided us data, contact us and we will delete it promptly.

Changes

We may update this policy. Material changes will be posted here and, where we can reach you, sent via WhatsApp or email. Continued use of the service after changes are posted means you accept the updated policy.

Contact & complaints

For data requests or privacy concerns: legal@utibills.com. We aim to respond within 14 days. If you are unhappy with our response, you may lodge a complaint with the Office of the Data Protection Commissioner of Kenya (ODPC): odpc.go.ke.