Legal
Privacy Policy for Ikon Pay
1. Who we are
Ikon Pay is a payment and invoicing platform operated by Ikon Kode Limited, a limited liability company incorporated in Kenya, company registration number PVT-GYUP7Q7.
We use Ikon Pay to issue invoices to our own customers and to collect payments owed to us. We are not a payment service provider to third parties and we do not process payments on behalf of other businesses.
For the purposes of the Data Protection Act, 2019, Ikon Kode Limited is the data controller for the personal data described in this policy.
Contact for all privacy matters: contact@ikon.ke
This policy explains what personal data we collect through Ikon Pay, why we collect it, who we share it with, how long we keep it, and what rights you have under Kenyan law.
2. Who this policy applies to
Customers paying an invoice. You receive an invoice from us, look it up on our site, confirm your email address, and pay. You do not need an account.
Customers paying through checkout. You are directed to a hosted Ikon Pay checkout page to pay for a product or subscription.
Account holders. You have a registered account. Accounts are not open to the general public; they are created for our staff and for customers we onboard directly.
Where a section applies only to one group, we say so.
3. What personal data we collect
3.1 If you pay an invoice or use checkout
| Data | Why we collect it |
|---|---|
| Your name | To identify you as the payer and issue a valid invoice and receipt |
| Your email address | To confirm your identity before showing you an invoice, and to send receipts and payment confirmations |
| Your phone number | Required to send an M-Pesa payment request to your handset |
| The amount, date and reference of your payment | To record the transaction and reconcile it against your invoice |
| Transaction references and receipt numbers from M-Pesa, Pesapal or Paystack | To match your payment to the correct invoice and resolve disputes |
| Any further details shown on the invoice | To describe what you are being billed for |
Before we display an invoice, we ask you to confirm the email address it was issued to. This stops someone who guesses an invoice number from seeing your billing details.
We never see or store your card number, CVV, expiry date or M-Pesa PIN. Card details are entered directly on payment pages operated by Paystack or Pesapal. M-Pesa PINs are entered only on your own handset, on the Safaricom prompt. No member of our staff will ever ask you for your PIN.
3.2 If you have an account
In addition to the above: your username, first and last name, email address, and password, which is stored only as a cryptographic hash that we cannot read. Optionally your phone number and country. We also record when your account was created, when you last signed in, and whether your phone number has been verified.
If you sign in with Google, we receive your Google profile information and email address from Google. We never receive your Google password.
3.3 Information collected automatically
When you use Ikon Pay we collect technical information about your visit:
- Your IP address, which we send to a geolocation service to derive the country you are visiting from. We store the resulting country code against your browsing session.
- Your browser type and version, and the page that referred you to us.
- Your device type, screen size, operating system, device model, language and timezone.
- A randomly generated visitor identifier stored in your browser, which lets us recognise a returning browser across visits.
- A record of the pages you view and the actions you take, including clicks, form interactions, and payment steps.
We use this to understand how people move through our checkout, to find and fix points where payments fail or people get stuck, and to detect abuse. We rely on our legitimate interest in operating a secure and functional payment system as the lawful basis for this processing.
We do not use this data for advertising, we do not sell it, and we do not share it with advertising networks.
3.4 Information collected to prevent abuse
If an attempted account registration is blocked by our anti-automation checks, we record the originating IP address and the details submitted so we can identify repeat attempts.
4. Our lawful basis for processing
Under section 30 of the Data Protection Act, 2019, we process your personal data on these bases:
| Processing | Lawful basis |
|---|---|
| Issuing invoices, taking payments, sending receipts | Necessary to perform a contract with you, or to take steps at your request before entering one |
| Keeping accounting and tax records | Compliance with a legal obligation under the Companies Act 2015 and the Tax Procedures Act 2015 |
| Confirming your email before displaying an invoice | Our legitimate interest in protecting your billing information from unauthorised access |
| Analytics, session tracking and device information | Our legitimate interest in operating, securing and improving the service |
| Preventing fraudulent and automated account creation | Our legitimate interest in protecting the integrity of the service |
| Service emails about your invoice or subscription | Necessary to perform a contract |
You may object to any processing carried out on the basis of legitimate interest. See section 9.
5. Who we share your data with
We do not sell your personal data. We share it only with the providers we need to operate Ikon Pay.
| Provider | What they receive | Purpose |
|---|---|---|
| Safaricom PLC (M-Pesa) | Your phone number, the amount, and a payment reference | To send the payment request to your handset and confirm payment |
| Pesapal | Your name, email, phone number, amount and merchant reference | To process card and recurring card payments |
| Paystack | Your email, the amount, currency and payment reference | To process card and bank payments |
| Mailjet | Your email address and the content of the message | To deliver invoices, receipts, sign-in codes and service notifications |
| Google LLC | An authentication request | Only if you choose to sign in with Google |
| ipapi.co | Your IP address | To determine the country a visit originates from |
| DigitalOcean LLC | All data stored by the service | Hosting of our servers and database |
We may also disclose personal data where required by law, by a court order, or by a regulator, or where necessary to establish, exercise or defend a legal claim.
6. Transfers outside Kenya
Our servers are located in London, United Kingdom, operated by DigitalOcean LLC. Several of the providers above also process data outside Kenya:
- DigitalOcean: United Kingdom
- Paystack: Nigeria, and other jurisdictions used by its processing partners depending on the payment method
- Mailjet: European Union
- Google: United States and other jurisdictions
- ipapi.co: United States
- Safaricom and Pesapal: Kenya
Your personal data is therefore transferred outside Kenya. Under section 48 of the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021, we make these transfers on the basis that they are necessary to perform our contract with you, since we cannot host the service, accept card payments, or send you a receipt without them, and on the basis of the data protection commitments each provider gives us contractually.
For details of the safeguards applying to a specific transfer, write to contact@ikon.ke.
7. How long we keep your data
| Data | Retention |
|---|---|
| Invoices, payment records, receipts and transaction references | Seven years from the end of the financial year in which the transaction occurred, to meet our obligations under the Companies Act 2015 and the Tax Procedures Act 2015 |
| Account details | For as long as your account remains open, then anonymised after the deletion process in section 8 |
| Analytics sessions and interaction events | For as long as necessary for the purposes described in section 3.3, reviewed periodically and deleted when no longer needed |
| System and email delivery logs | For as long as necessary for security, troubleshooting and record-keeping |
| Records of blocked registration attempts | For as long as necessary to identify repeat attempts |
Financial records cannot be deleted on request. Where you ask us to delete your data, we will remove or anonymise your account and contact details, but we must keep the underlying invoice and payment records for the statutory period above. After that period they are deleted.
8. Deleting your account
If you have an account, you can request deletion from your profile. When you do:
- Your account is deactivated immediately and you can no longer sign in.
- A grace period of 30 days begins, during which you may contact us to reverse the request.
- At the end of the 30 days, your name, email address and phone number are permanently overwritten, your password is disabled, any linked Google account is removed, and your access tokens and API keys are revoked.
Invoices and payment records associated with you are retained as described in section 7, but are no longer linked to a live account.
9. Your rights
Under Part V of the Data Protection Act, 2019 you have the right to:
- Be informed of how we use your personal data, which is the purpose of this policy.
- Access a copy of the personal data we hold about you.
- Correct data that is inaccurate, out of date, incomplete or misleading.
- Object to processing carried out on the basis of our legitimate interests, including our analytics.
- Request deletion of data we no longer have a lawful reason to keep.
- Receive your data in a structured, commonly used format.
- Not be subject to a decision based solely on automated processing that significantly affects you.
How to exercise these rights. Email contact@ikon.ke from the address associated with your invoice or account. We may ask you to confirm your identity before acting, so that we do not disclose your data to someone else. We will respond within 30 days. There is no charge unless a request is manifestly unfounded or excessive.
This applies whether or not you hold an account. If you paid an invoice as a one-off customer, write to us and we will handle your request manually.
10. Automated decisions
Some decisions on Ikon Pay are made automatically:
- Subscriptions. If payment is not received by the renewal date, a subscription is marked past due. If it remains unpaid when the grace period ends, it is cancelled. If an initial payment is not completed within ten minutes of starting, the subscription is cancelled. We notify you by email before these steps where possible.
- Invoices. An invoice with an outstanding balance is automatically marked overdue after its due date.
- Registration. Automated checks may block an attempted registration showing signs of being automated.
- Rate limiting. Repeated requests from the same address in a short period may be temporarily refused.
If an automated decision affects you and you believe it is wrong, write to contact@ikon.ke. A person will review it and you can put your side of the case.
11. Security
We protect your data with encrypted connections (HTTPS) for all traffic, passwords stored as salted cryptographic hashes, API keys stored only as hashes, cryptographic signature verification on payment callbacks, rate limiting on authentication, restricted administrative access, and sign-in codes that expire after five minutes.
No system is completely secure. If a breach occurs that presents a real risk of harm to you, we will notify the Office of the Data Protection Commissioner within 72 hours and notify you as required under section 43 of the Data Protection Act, 2019.
12. Cookies and local storage
We use the following, all set by us. We do not use third-party advertising or analytics cookies.
| Name | Purpose | Duration |
|---|---|---|
| sessionid | Keeps you signed in and remembers that you have confirmed your email for an invoice | Session |
| csrftoken | Protects forms against cross-site request forgery | Session |
| tracker_visitor_id | Recognises a returning browser for analytics | Persistent |
| tracker_session_id | Groups activity within a single visit | Until the tab closes |
| tracker_user_id | Links analytics to your account when you are signed in | Persistent |
| theme-preference | Remembers light or dark mode | Persistent |
| Checkout state keys | Tracks a payment in progress so we can show you its status | Until the tab closes |
The session and CSRF entries are strictly necessary, and the service will not work without them. You can clear the others through your browser settings at any time, though doing so may reset your preferences.
13. Children
Ikon Pay is not intended for children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, write to contact@ikon.ke and we will delete it.
14. Complaints
If you are unhappy with how we have handled your personal data, please contact us first at contact@ikon.ke so that we can try to resolve it.
15. Changes to this policy
We may update this policy at any time. The date at the top shows when it was last changed, and the version published on our site is the one in force. Where a change materially affects your rights, we will notify you by email or through a notice on the service.