Privacy Policy

Last updated 12 October 2026

Lever is based in Nairobi, Kenya, and makes the Pesa Prompt app. This policy explains what information we collect, why, and what we do with it. It applies to the Lever website and the Pesa Prompt app.

What Lever does

Lever lets a business send an M-PESA payment request to a customer. The customer approves it on their own phone with their own M-PESA PIN, and the money moves from their M-PESA account directly to the business’s till.

Lever never holds, receives or has access to your money. We cannot withdraw funds from any till. We can only ask a customer to pay, which they are free to decline.

Information we collect

From businesses who sign up:

• First and last name
• Business name
• M-PESA till number
• Phone number
• A 4-digit passcode, which we store only as a cryptographic hash and never in readable form

From payment requests:

• The customer’s phone number, entered by the business
• The amount requested
• The outcome, including the M-PESA receipt number, result code and time

We do not collect your M-PESA PIN. It is never entered into Lever and never passes through our systems — it is entered only into Safaricom’s own prompt on the customer’s handset.

Who we share it with

Safaricom, to send payment requests and receive their results through the M-PESA Daraja API. Safaricom’s own terms and privacy practices govern what they do with that information.

Our infrastructure providers, who store and run the service on our behalf: Supabase for the database and Vercel for hosting.

We do not sell personal information, and we do not share it for advertising.

How long we keep it

Account details are kept while the account is open. Payment records are kept for seven years, which is the period Kenyan tax and accounting rules expect business transaction records to be retained.

Security

Passcodes are hashed and salted. All traffic uses HTTPS. Access to the production database is restricted to authorised personnel.

Your rights

Under Kenya’s Data Protection Act, 2019, you have the right to access the personal data we hold about you, to have inaccurate data corrected, to ask for your data to be deleted, and to object to how it is processed. To exercise any of these, contact us at the address below.

You also have the right to complain to the Office of the Data Protection Commissioner.

Deleting your account

You can ask us to delete your account at any time. See how to delete your account for the steps and what is kept.

Children

Lever is a tool for businesses and is not directed at anyone under 18.

Changes

If we change this policy we will update the date at the top of this page.

Contact

pivotlever@gmail.com
Lever, Nairobi, Kenya