Contents
1. Introduction
AlkaPay ("we", "us", or "our") provides an M-Pesa payment gateway plugin for WooCommerce and operates the website at alkapay.co.ke. This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using our website or services, you agree to the practices described here.
AlkaPay is software, not a payment processor. We do not touch, hold, or move your money, and we do not receive or store your customers' M-Pesa payment data. Funds flow directly between your customer, Safaricom M-Pesa, and your own business account. AlkaPay charges no transaction fees.
2. Who We Are
AlkaPay is operated by Alkagist Technologies, a business registered in Kenya ("the data controller" for the information described in this policy). For any privacy question, or to exercise your rights, contact us at support@alkapay.co.ke.
3. Information We Collect
We collect information in a few ways:
- Information you provide: your name, email address, and billing details when you purchase a license, contact support, or sign up for updates.
- License & account data: processed through our licensing provider (Freemius) when you activate or manage a Pro license.
- Plugin diagnostic data (only if you opt in): when you activate the plugin you are asked whether to share basic diagnostics. If you agree, the plugin (via Freemius) may send your site URL, WordPress and PHP versions, your active theme and plugin list, and your administrator email for license correspondence. If you decline, none of this is sent. We never collect your customers' data, orders, or M-Pesa transactions this way.
- Website usage data: basic analytics such as pages visited, browser type, and approximate location, collected to improve our website.
4. How We Use Information
We use the information we collect to:
- Deliver, activate, and support your AlkaPay license;
- Process payments and send transactional emails (receipts, license keys, renewals);
- Respond to your support requests and questions;
- Improve our website, plugin, and documentation;
- Send product updates where you have opted in, and comply with our legal obligations.
5. Data and the AlkaPay Plugin
The AlkaPay plugin runs on your own WordPress server. When your customers pay via M-Pesa, transaction details (such as the M-Pesa receipt code, amount, and phone number) are processed and stored on your website's database as part of order handling — not on AlkaPay's servers.
As the store owner, you are the data controller for your customers' information and are responsible for your own privacy policy and for complying with data-protection law that applies to you (including Kenya's Data Protection Act 2019). In relation to that customer data, AlkaPay acts only as the software you have chosen to install — we do not receive it. The plugin stores your API credentials encrypted at rest and masks sensitive values (such as phone numbers) in its logs, which are kept on your server.
AlkaPay communicates directly with Safaricom's Daraja API from your server to process STK Push and confirmation callbacks. We do not receive or retain your customers' M-Pesa transaction data.
6. Sharing & Third Parties
We do not sell your personal information. We share data only with trusted service providers that help us operate, including:
- Freemius, Inc. — our licensing, checkout, and subscription provider, which processes your purchase, license, and (with your consent) diagnostic data;
- Payment processors used by Freemius to complete your purchase;
- Safaricom PLC — only when your own server calls the Daraja API to process payments; this happens on your infrastructure, not ours.
Each of these providers operates under its own terms and privacy policy. We may also disclose information if required by law, regulation, or valid legal process, or to protect our rights, users, or the public.
7. International Data Transfers
Some of our service providers (such as Freemius and its payment processors) are located outside Kenya, so operating your account and processing your purchase may involve transferring your personal information to other countries. Where we do so, we take reasonable steps to ensure your information is treated consistently with this policy and with applicable law, including the cross-border transfer requirements of Kenya's Data Protection Act 2019.
8. Cookies & Analytics
Our website may use cookies and similar technologies for essential functionality and to understand how visitors use the site. You can control cookies through your browser settings. Disabling some cookies may affect site functionality.
9. Data Retention
We keep your personal information for as long as needed to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. License and billing records may be retained for accounting and tax purposes.
10. Your Rights
Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to withdraw a consent you previously gave (such as the plugin's diagnostics opt-in). To exercise any of these rights, contact us using the details below and we will respond as required by law.
If you are in Kenya, these rights are provided under the Data Protection Act 2019. If you believe we have not handled your data lawfully, you also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.
11. Children's Privacy
AlkaPay is a business product intended for merchants and is not directed at children. We do not knowingly collect personal information from anyone under the age of 18. If you believe a child has provided us information, contact us and we will delete it.
12. Security
We use reasonable technical and organizational measures to protect your information. The AlkaPay plugin follows WordPress security best practices, including prepared database statements, input sanitization, output escaping, AES-256 encryption of API credentials at rest, a secret per-site callback URL, and masking of phone numbers in logs. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above, and where appropriate we will provide additional notice. Your continued use of our website or services after changes take effect constitutes acceptance of the updated policy.
14. Contact Us
If you have questions about this Privacy Policy or how we handle your data, please contact us at support@alkapay.co.ke.