We never receive your statement.

Pesa Recap, at pesarecap.zuriscore.com, is run by ZuriScore Limited (“ZuriScore”, “we”). For any question about this notice or your data, email hello@zuriscore.com.

This notice covers Pesa Recap only. ZuriScore's other services, including the paid M-PESA report at zuriscore.com, are covered by ZuriScore's privacy policy. That report is a separate service, and there your statement is uploaded.

None of the following ever leaves your phone or computer:

• the statement PDF and its password;
• your name and email address as they appear on the statement, and its phone number unless you choose to pay with it;
• your transactions: receipt numbers, amounts, balances, dates and times;
• the people you send money to or receive it from, including Pochi la Biashara, by name or number.

Your browser reads them to make your recap. They are not sent to us, to any analytics or error-reporting service, or to anyone else, and are never put in a web address. They are held in the page's memory only, never written to your device's storage, and are gone when you close the tab.

If you choose Keep a copy, your cards are saved on your device as a PDF or as images. They are made right there, from what the cards show, and we never receive them. Amounts and sensitive cards are left out unless you switch them on.

Exactly the following, each sent as a single request with no cookies, no referrer and nothing in the web address:

• The kinds of transactions on your statement. Each kind once, such as “airtime purchase” or a transfer to someone, as its wording with the person's name taken out, their phone number cut to its first few digits (the network), and any account number or reference code removed; and for a till or paybill, its number, the name M-PESA printed for it, and whether money went to it or came from it. Never an amount, a date, a time, a balance, a count, a receipt number, or any person you sent money to. Our server says what each one is, so your phone can work out your recap; the lists it uses to do that stay on our server. A small puzzle your phone solves is sent with it, so the service can't easily be used in bulk. We keep a till or paybill we didn't know yet, with a suggested category, so the next person's recap recognises it, and our team may review it for ZuriScore's business directory. What we keep is not linked to you, to your statement or to any other request. Nothing else in the request is kept.
• Rounded facts for your captions. For each card you can share: amounts at two significant figures (like “KES 12,000”), whole percentages, counts, a multiple (like “2.3x”), a month or weekday, a day of the month on its own, an hour, a spending category, a way of travelling (like “SGR”) and your money personality. Never an exact amount, a date, a name or a place, and never a private card: a card that names a town gets the town filled in on your phone. We use them to write the captions on your cards, and keep nothing.
• Anonymous counts. That one of our pages was opened (which one: home, how it works, this notice or the recap, never its web address), that a file was picked, that a statement couldn't be read and why, that cards were shown, that you reached the end of your recap, that a card, a comparison, your cards or a PDF copy was shared or saved, that a payment was started, went through or didn't and why, or that the report button was tapped, with banded numbers such as how many cards you got. No identifier, session or time is sent with a count. We add each one to an hourly total, such as “recaps made between 2pm and 3pm”, to see how Pesa Recap is used and where it fails, and keep nothing else: nothing in those totals links to you, to your statement or to another count.
• If there's a charge, your payment. When we charge for a recap, the price is shown after your statement is read and before your cards, and you're never asked to pay for a statement that can't be read. To pay, you confirm an M-PESA number: the one on your statement is filled in on your phone, and you can change it. Only when you tap Pay do we receive it, and we send it to Safaricom to put the payment prompt on that phone, and ask Safaricom how it went. We keep a record of the payment: the number, the amount, the M-PESA receipt and the time. A paid recap then sends a pass, a code that stands for that payment, with the kinds of transactions and the rounded facts above, so our server can check the recap was paid for. The pass says nothing about your statement, and nothing sent with it is kept with your payment.

OpenAI. When it's switched on, an AI model from OpenAI suggests categories for the businesses we don't recognise and writes captions from the rounded facts. We send these through OpenAI's API with storage turned off, but OpenAI may keep API requests for up to 30 days to monitor for abuse. Nothing sent to OpenAI includes your statement, your details or the people you sent money to.

Safaricom. If you pay for a recap, Safaricom receives the number you pay with and the amount, to send the M-PESA prompt and take the payment, under its own M-PESA terms.

Our hosting. Pesa Recap runs on servers ZuriScore operates. We don't sell or share what we receive with anyone else.

Pesa Recap's server doesn't log what it's sent, your IP address or your browser, sets no cookies, and has no way to link one request to another, except that a paid recap's requests carry the same pass.

Like any website, the servers that deliver Pesa Recap see your IP address and browser details when you load it, and the secure-connection (TLS) proxy in front of them may record these in its standard logs. Those logs never contain your statement, because your statement is never sent.

Pesa Recap sets no cookies and runs no analytics, advertising, error-reporting or tracking scripts. A service worker keeps a copy of the app's own code, the statement reader and the PDF reader, on your device so a second recap loads faster. It never stores your statement or anything made from it.

If you pay, the page keeps a code for your payment in this tab's session storage, so reloading the page doesn't mean paying again. It says nothing about your statement, lasts at most an hour after you pay, and is gone when you close the tab.

• Turn on Global Privacy Control or Do Not Track in your browser, and no counts are sent at all, not even that you opened a page. Your recap works the same.
• Every amount on a card starts hidden, sensitive cards (betting, health, giving) start private, and no card names a person or business. You choose what to reveal and what to share.
• A card you share goes wherever you send it. A friend-compare code carries your money personality and rounded habits, such as roughly what share of your spending went on groceries, fuel or eating out, never an amount, a name or anything sensitive like betting or health, and a compare link keeps the code after the “#” in the address, a part browsers never send to a server.

Kenya's Data Protection Act, 2019 gives you rights over your personal data, including to be informed about its use, to access it, to have it corrected or deleted, and to object to its processing. Because Pesa Recap never receives your statement, we usually hold no personal data about you from it. If you paid for a recap, we hold the record of that payment, including the number you paid with.

For any request or question, email hello@zuriscore.com. You can also complain to the Office of the Data Protection Commissioner.

If what Pesa Recap sends, or what we keep, ever changes, we'll update this notice and the date at the top. How it works explains the technical side in plain words.