Privacy Policy

Individuals who create a Kairo wallet to send money, receive money, pay bills, or make purchases through WhatsApp, voice, or chat-based interfaces.

Business owners (sole proprietors, registered companies, and informal businesses) who use Kairo to collect payments, manage a storefront, send invoices, run promotions, or access AI-powered customer support via social media, with optional web dashboard access.

Financial institutions (banks, fintechs, payment processors, and switches) that license Kairo's enterprise software products (Reconcile, Fraud, Support, Flow, Relay, Insight, and Risk). Where Kairo processes data on behalf of an Enterprise client about that client's own customers, Kairo acts as a data processor (or “processor” under NDPA/GDPR terminology) on the institution's instructions, and the institution remains the data controller for its end customers' information. Separate data processing agreements govern this relationship in addition to this Policy.

• Identity information: full name, date of birth, phone number, and (where applicable) email address
• Account credentials and authentication data.
• Communications you send to Kairo, including WhatsApp messages, voice messages, and chat transcripts.
• Device and technical information: IP address, device identifiers, operating system, app version, and general location data (derived from phone number or IP, not precise GPS unless separately authorized).
• Transaction data: amounts, timestamps, counterparties, payment references, and transaction status.

• Bank Verification Number (BVN) and the identity data returned by BVN verification (full name, date of birth, gender, phone number, and BVN-linked photograph, where provided by the verification provider)
• Wallet balance and full transaction history (sends, receives, bill payments, purchases)
• Recipients and contacts you transact with or save within Kairo
• Voice recordings, when you use voice-based commands (processed to extract transaction intent; see Section 4 for retention and processing detail)
• Images submitted for “snap to pay” functionality (e.g. photographs of account slips or invoices)
• Language preference and the language(s) you communicate in
• Bill payment details (service providers, account numbers for utilities/subscriptions you've linked)

• Business name, business category, and (where provided) business registration details
• Storefront content: product listings, prices, images, and descriptions you upload
• Customer lists and contact details you upload or that are generated through transactions (your customers' phone numbers, names, and order history with your business)
• Invoice and payment collection data
• Content of customer service conversations handled by Kairo's AI auto-responder on your behalf
• Business owner's BVN and identity verification data (same as Section 3.2), required to activate a business wallet

• Institutional account and integration credentials (API keys, system identifiers).
• Transaction, reconciliation, settlement, and exception data submitted by the institution for processing by Kairo's software.
• Aggregated and pseudonymized behavioral data used to power fraud detection, routing optimization, and risk models, as governed by the applicable data processing agreement.
• Usage and performance data related to the institution's use of Kairo's enterprise products (queries run, API calls, system logs).

Kairo uses machine learning models to power conversational understanding, fraud detection, and risk intelligence. Where transaction and behavioral data is used to train or improve these models, we use aggregated and/or pseudonymized data wherever feasible. Voice recordings and message content used to improve language understanding are processed primarily through automated systems; access by human reviewers, where it occurs for quality assurance or model improvement purposes, is limited, logged, and subject to confidentiality obligations. You may object to your data being used for model improvement purposes by contacting us as described in Section 15, though this may limit certain personalization features.

When you send or receive money, certain information (such as your name and the transaction amount) is necessarily visible to the person or business on the other end of the transaction.

Where required to provide wallet services under Nigerian financial regulations, we may share your identity verification data (including BVN-derived information) with licensed banks or financial institutions as necessary to open and maintain your wallet.

We share your BVN with NIBSS (Nigeria Inter-Bank Settlement System) or other licensed BVN verification providers solely to confirm your identity. We do not receive your bank account balance, transaction history with other banks, or account details as part of this process.

We engage third-party vendors to support our operations, including cloud hosting providers, SMS/WhatsApp Business API providers (including Meta, as the operator of WhatsApp), customer support tooling, and analytics providers. These providers are contractually bound to protect your information and use it only for the purposes we specify.

Information about transactions, products, and customer interactions is shared between you (the business owner) and your customers as a necessary function of the Service. If you use the AI auto-responder, customer messages and Kairo's responses are processed and may be reviewed in aggregate for quality and service improvement.

Data submitted by Enterprise clients is shared only as necessary to deliver the contracted services (e.g., sharing fraud signals across the institution's own systems) and as set out in the applicable Master Services Agreement and Data Processing Agreement.

We may disclose information where required by law, regulation, court order, or to cooperate with law enforcement, regulators (including the Central Bank of Nigeria and the Nigeria Data Protection Commission), or in connection with the investigation of fraud or other illegal activity.

If Kairo is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or use of your personal information.

• Encryption of sensitive data (including BVN and identity data) both at rest and in transit.
• Role-based access controls limiting employee access to personal data on a need-to-know basis.
• Regular security testing, monitoring, and audit logging of access to sensitive systems.
• Multi-factor authentication for internal systems handling financial and identity data.
• Fraud monitoring systems (Kairo Fraud) that operate across all three products to detect anomalous activity in real time.

We retain personal information for as long as necessary to provide the Services, comply with legal obligations (including financial recordkeeping and AML requirements), resolve disputes, and enforce our agreements. Specific retention periods:

Identity verification data (BVN-derived):

Duration of account + 5 years after account closure.

Transaction records

Minimum 5 years from transaction date, per standard financial recordkeeping requirements.

WhatsApp/chat conversation logs:

Duration of account + 5 years for support and dispute resolution.

Voice recordings:

5 years from the date of recording.

Marketing consent and preferences:

Until you withdraw consent or close your account

Where you close your Kairo account, we will delete or anonymize your personal information within a reasonable period, except where retention is required by law (such as financial transaction records) or necessary for the resolution of disputes or legal claims.