Privacy Policy

At Chulri, security is not an afterthought—it is the foundational bedrock of our engineering. Inspired by international ISO/IEC 27001 security principles and Kenyan regulatory benchmarks, our automated liquidity platform is built to deliver complete confidentiality, ledger accuracy, and operational defense:

• Cryptographic Data Protection: Every byte of data exchanged between your handset and Chulri is shielded with end-to-end modern TLS encryption. At rest, data is compartmentalized with enterprise-grade encryption standards.
• Zero-Knowledge PIN Vaulting: Your 4-digit Account Security PIN is processed through irreversible one-way cryptographic hashing before it ever touches database storage. No human employee, support agent, or third party can ever view or retrieve your PIN.
• Strict Ledger Integrity: Every balance update is backed by dual-channel verification and immutable audit logs, guaranteeing that your funds are tracked with banking-grade precision.

We operate on a principle of data minimization: we only request the specific information necessary to service your vaults, deliver your payouts, and prevent unauthorized account access.

• Primary Account Identity: Your legal name, verified Safaricom mobile number, primary email address, and optional @username handle.
• Authentication Credentials: Cryptographically hashed PIN tokens, one-time verification codes, and active session tokens.
• Vault & Schedule Particulars: Target payout amounts, selected drip intervals, unlock dates, designated beneficiary numbers, and official M-PESA clearing confirmations.
• Chama Group Data: Group memberships, rotation turn allocations, and collective contribution history within private groups you join.
• Diagnostic & Protection Telemetry: IP addresses, device types, and secure browser sessions monitored to instantly detect and block suspicious or unauthorized sign-ins.

We are committed to clear, honest communication regarding account verification requirements:

• Simpler, Modern Authentication: Account access and authorization are securely confirmed through your verified Safaricom phone number, email-delivered security tokens, and your private security PIN.
• Document Uploads Currently Inactive: Mandatory uploads of national identity cards, passport pages, and live verification selfies are currently disabled across the platform. You do not need to submit document scans or facial photos to use Chulri.
• Advance Notice for Policy Changes: If evolving national financial regulations or high-value account limits require document verification in the future, we will provide clear advance notice inside your dashboard before requesting any physical documents.

Your information is processed strictly to automate your savings, fulfill your payout schedules, and safeguard your money:

• Automated Disbursements: Directing scheduled drip transfers and maturity sums straight to your phone through Safaricom M-PESA on your chosen schedule.
• Real-Time Audit Receipts: Generating instantaneous receipts and balance updates via email and SMS whenever deposits or disbursements settle.
• Anti-Fraud Monitoring: Detecting unauthorized access attempts, validating security PIN entries, and maintaining reliable ledger tracking.
• Chama Rotation Automation: Displaying cycle status and turn schedules strictly to verified members of your personal group.

Chulri enforces an uncompromising standard: we never sell, lease, monetize, or trade your personal identity or financial records to data brokers, marketing firms, or third-party advertisers. Data is shared exclusively with essential infrastructure partners:

• Safaricom PLC (M-PESA): Telecommunication rails required to process payment prompts and disburse funds to your handset.
• Encrypted Dispatch Partners: High-reliability message carriers (such as Resend, Brevo, and Africa's Talking) bound by strict data security agreements to deliver receipts and security codes.
• Hardened Cloud Infrastructure: Enterprise-grade database servers protected by intrusion detection, network firewalls, and restricted-access protocols.
• Legal Directives: Only when strictly compelled by valid, enforceable court orders or formal statutory mandates under Kenyan law.

Chulri clearly separates your social group activities from your private personal finances:

• Private Group Transparency: Within a Chama, your fellow members can view your name, assigned payout turn, and contribution status for active cycles.
• Zero Inter-Group Visibility: Chama ledgers are isolated; members of other Chamas cannot view your group or its savings.
• Personal Vault Secrecy: Your personal savings vaults (e.g., Daily Survival, Rent & Bills, Goal Savings) remain completely confidential. No Chama member, colleague, or external user can ever see your personal balances or payout schedules.

We retain financial transaction records only as long as required to fulfill your vault schedules and comply with Kenyan accounting and statutory record-keeping laws.

Once your active vaults complete their payouts and you choose to close your account, non-essential personal identifiers and session records are systematically expunged in accordance with our data hygiene protocols.

We fully uphold your rights under the Kenya Data Protection Act (DPA 2019):

• Right of Access: View and export your complete transaction history and account details at any time from your dashboard.
• Right to Rectification: Update or correct your legal name, username handle, or registered email through your profile settings or customer support.
• Right to Erasure: Request account closure and data erasure once all active financial vaults have safely completed their payouts.
• Right to Restrict or Object: Opt out of promotional announcements at any time while continuing to receive essential security alerts and transaction confirmations.

As our platform capabilities expand and Kenyan data protection frameworks evolve, we may update this policy to reflect higher standards of protection.

Any material updates will be clearly reflected by the version date at the top of this page, accompanied by notifications sent to your registered email address.