Privacy Policy

Last updated: September 27, 2026

Version: 1.1

Preamble

At Kodo, protecting your personal data is a fundamental priority. Kodo Financial Technology Inc. ("Kodo", "we", "our", or "the Company") is committed to processing your personal data with the utmost transparency, integrity, and security.

This Privacy Policy ("the Policy") explains in detail how we collect, use, store, protect, and share your personal information when you use the Kodo platform, whether through our mobile app, our website, or any other Kodo service.

We encourage you to read this document carefully. If you have any questions, feel free to contact us using the details provided at the end of this document.

By using the Kodo platform, you acknowledge that you have read this Policy and consent to the processing of your personal data under the terms described below.

1. Who we are

1.1 Data controller

The controller responsible for processing your personal data is:

Kodo Financial Technology Inc. 254 Chapman Rd, Ste 208 #28536 Newark, Delaware 19702 United States of America

Operating subsidiary: Kodo Financial Technology SAS Senegal

For any question regarding the processing of your personal data, you can contact us via the Kodo app or by post at the address above.

1.2 Data Protection Officer (DPO)

Can be reached at: hello@kodo.sn.

1.3 Scope of application

This Policy applies to all personal data collected by Kodo in connection with:

• Use of the Kodo mobile app
• Access to the Kodo website
• Any transaction or interaction with our services
• Any communication with our customer support

2. What data do we collect?

This Policy covers two distinct contexts: the data collected today on the kodo.sn website (even before the app is available for download), and the data we will collect via the Kodo app once it has launched. Section 2.1 below describes the former; sections 2.2 through 2.10 describe the latter.

2.1 Data collected on the kodo.sn website

Contact and application forms. The kodo.sn site offers several forms (user waitlist, Ambassador application, Partner application, Investor inquiry). Depending on the form submitted, we collect: your name, phone number and/or email address, country, and, where applicable, your company or fund name, your role, and any free-text message you choose to send us. This information is used solely to respond to your request and, if you consent at the time of submission, to follow up with you regarding the relevant program.

Attribution data. When you submit one of these forms, we also record the page you navigated from, the page that referred you to the site (if any), and the campaign parameters present in the URL (utm_source, utm_medium, utm_campaign). This data helps us understand which channels bring visitors to the site; it is not cross-referenced with your identity beyond the form you submitted.

Redirection to WhatsApp. Some buttons on the site open a WhatsApp conversation with the Kodo team. When you click one of these buttons, we record the event (originating page, timestamp) before WhatsApp opens, but we do not have access to the content of your WhatsApp exchanges. WhatsApp is a service operated by Meta; its use is governed by WhatsApp's own privacy policy, independent of this Policy.

Cookies and analytics. We use Mixpanel, hosted in the European Union, to measure site traffic (pages viewed, sections seen, buttons clicked, simulator use, forms submitted), and Sentry, hosted in Germany, to detect technical errors. Nothing you type in a form is sent to these services. See Section 11 for details on the cookies used and how to disable them.

2.2 Identification and contact data

When you create your account and use our services, we collect:

• Phone number: the primary means of identification, used to create your account and verify it through a WhatsApp message you send from that number. This number is your primary identifier on Kodo; it must be from the country where you live.
• Email address (optional): if you choose to provide it, used for important communications and account recovery.
• First and last name: requested when you create your account, to identify you to your loved ones and on your receipts.
• Date of birth: requested when you create your account, to check the minimum age of 14.
• Gender: requested when you create your account, for statistics and personalization.
• Address and city: derived from your location if you allow it, editable in the app.
• Profile picture (optional): if you choose to add one.

2.3 Verification and authentication data

To secure your account, we collect:

• WhatsApp verification: a one-time code you send to Kodo from your WhatsApp, to verify your number when you create your account, at each new login, to create a new secret code or to change your number.
• Secret code: stored only as an encrypted hash, never in plain text.
• Face ID or fingerprint (if you enable it): verification happens only on your phone; Kodo neither receives nor stores any biometric data, only the confirmation that verification succeeded.
• Login timestamps: the dates, times, and frequency of your logins to the platform.
• Device information: a unique device identifier, operating system, and app version, used to secure your account and detect unauthorized access attempts.

2.4 Transaction data

For each transaction made on Kodo, we record:

• Type of service: mobile top-up, water bill payment, electricity bill payment, Woyofal top-up
• Transaction amount: in CFA francs (FCFA)
• Target number or identifier: phone number, meter number, or customer account identifier (provided by you)
• Payment method used: Orange Money, Wave, bank card
• Transaction status: success, failure, refund
• Date and time of the transaction: precise timestamp
• Transaction reference: unique identifier assigned by Kodo

2.5 Loyalty program data

As part of the Kodo Points program, we retain:

• Kodo Points balance: total number of points accumulated
• Points history: transactions that generated points, date awarded, amount concerned
• Points usage: rewards obtained or discounts applied

2.6 Technical data collected automatically

While you use the platform, we automatically collect:

• IP address: your device's Internet Protocol address, used for security purposes and approximate geolocation
• Device type: make, model, and operating system (iOS/Android)
• App version: the version of the Kodo app in use
• Network data: connection type (WiFi, 4G, 3G)
• Browsing data: pages and features viewed, session duration, actions taken, errors encountered
• Advertising identifiers (with your consent): IDFA (iOS) or GAID (Android) identifiers, for improving the user experience

2.7 Location data

• Approximate location: determined from your IP address, used to detect unusual logins and improve security.
• Precise GPS location (only with your permission): requested when you create your account to prefill your city and address and to secure your payments (detection of unusual activity). Your consent is recorded with its date.

You can disable location access in your device settings. This will not affect Kodo's core functionality.

2.7 bis Address book (only with your permission)

If you allow access to your address book, Kodo checks which of your contacts already have an account, so you can offer them a service or ask them to pay a bill. Numbers never leave your phone in plain text: only an encrypted hash of each number is compared with those of Kodo members. Kodo does not keep your address book. In return, you only see the first name and last-name initial of matching members. Your consent is recorded with its date, and you can withdraw it in your phone settings.

2.8 Data received from third parties

We may receive limited information from our partners:

• Payment confirmation: success or failure status of the transaction, from our payment partners (Orange Money, Wave, banking networks)
• Delivery confirmation: success or failure status of service delivery, from our partner aggregators

This data is limited to what is strictly necessary to confirm or refute the execution of your transactions.

2.9 Communication and support data

If you contact us via our customer support, we retain:

• The content of your messages and requests
• The responses provided by our team
• Any documents exchanged (screenshots, proof of payment, etc.)
• The history of interactions with our support team

2.10 What we do not collect

Kodo does not collect:

• Full bank card numbers (processed directly by the payment gateway)
• Identity documents (national ID, passport), unless additional verification proves necessary
• Medical information, or any biometric data (Face ID and fingerprints stay on your phone)
• Financial data (income, bank statements) beyond transactions made on Kodo
• The content of your address book

3. Why do we collect this data?

3.1 Providing services (legal basis: performance of a contract)

We use your data to:

• Create and manage your Kodo account
• Process your top-up and bill payment requests
• Verify your identity when creating your account and logging in
• Confirm transactions and send you receipts
• Manage the Kodo Points loyalty program
• Resolve technical issues or disputes related to your transactions

3.2 Security and fraud prevention (legal basis: legitimate interest)

We use your data to:

• Detect, prevent, and address fraudulent, abusive, or suspicious activity
• Verify the legitimacy of transactions
• Protect the integrity of the platform and payment systems
• Identify and block unauthorized access attempts
• Analyze suspicious usage patterns (multiple accounts, unusual transactions, etc.)
• Suspend or deactivate accounts in the event of confirmed or suspected fraudulent use

3.3 Improving and personalizing services (legal basis: legitimate interest)

We use your data to:

• Analyze platform usage to identify areas for improvement
• Personalize your experience (transaction history, service suggestions)
• Test and develop new features
• Optimize the platform's technical performance
• Carry out aggregated statistical analyses of service usage
• Improve our service offering and loyalty program

3.4 Communications (legal basis: contract or consent, as applicable)

We use your data to:

• Send you transaction confirmations and receipts (SMS, push notifications, or email if provided)
• Alert you of unusual activity on your account
• Inform you of important platform updates
• Notify you of changes to the Terms of Use or this Privacy Policy
• Contact you regarding your support requests

With your prior consent:

• Inform you of special offers, promotions, and new services

3.5 Legal compliance (legal basis: legal obligation)

We use your data to:

• Comply with our legal and regulatory obligations in the jurisdictions where we operate
• Respond to legitimate requests from competent public authorities
• Establish, exercise, or defend our legal rights in the event of a dispute
• Comply with applicable accounting and tax obligations

3.6 Analysis and research (legal basis: legitimate interest)

We may use aggregated and anonymized data to:

• Understand usage trends for our services
• Improve our business strategy
• Prepare internal reports

These analyses do not allow individual users to be identified.

4. Legal basis for processing

5. Who do we share your data with?

5.1 Payment partners

To process your payments, we share strictly necessary information with:

• Orange Money (Orange Sénégal): for processing payments via Orange Money
• Wave: for processing payments via Wave
• Bank payment service providers: for processing card payments

These partners receive only the information essential to securely process your payment (amount, transaction reference). They do not receive your entire Kodo profile.

5.2 Service aggregators

To deliver the services you have ordered (mobile credit, bill payments, etc.), we share the information necessary for delivery with our partner aggregators:

• Target phone number or meter number
• Type of service ordered
• Transaction amount
• Order reference

These partners are contractually required to process this information exclusively for the purpose of delivering the ordered service.

5.3 Technical service providers

We use third-party providers to help us operate the platform technically:

• Cloud hosting providers: for data storage and backup
• Data analytics providers: for anonymized analysis of platform usage
• Notification providers: for sending push notifications and WhatsApp OTP messages
• Customer support providers: for managing user support requests
• IT security providers: for monitoring and protecting the platform

These providers act as Kodo's data processors and are subject to strict contractual data protection obligations. They only have access to the data necessary to carry out their specific task.

5.4 Legal obligations

Kodo may be required to disclose your personal data to public authorities or third parties in the following cases:

• A legal or regulatory obligation (court order, administrative injunction)
• Cooperation with competent authorities as part of official investigations
• Protection of the rights, property, or safety of Kodo, its users, or third parties
• Prevention or detection of offenses

In these cases, Kodo discloses only the information strictly required and informs the user where possible, unless prohibited by law.

5.5 Business transfer or restructuring

In the event of a merger, acquisition, asset sale, or restructuring involving Kodo, your personal data may be transferred to the acquiring entity. We will inform you in advance where possible.

5.6 What we do not do with your data

• We never sell your personal data to third parties for commercial or advertising purposes.
• We do not share your data for third-party ad targeting purposes.
• We do not disclose your data to credit bureaus or financial institutions for creditworthiness assessment purposes.

6. International data transfers

6.1 Transfers to the United States

Kodo Financial Technology Inc. is based in the United States (Delaware). Your data may be transferred to, stored, and processed in the United States. By using Kodo, you consent to this international data transfer.

6.2 Applicable safeguards

Kodo ensures that any transfer of data to third countries takes place under appropriate security conditions, notably through:

• The use of standard contractual clauses
• Verification that destination countries have an adequate level of data protection
• Appropriate technical and organizational measures

6.3 Data of Senegalese users

For users based in Senegal, certain operational data may be processed by the Senegalese subsidiary, Kodo Financial Technology SAS, in accordance with applicable Senegalese law, in particular the law on the protection of personal data.

7. Data retention periods

7.1 Data collected via the website (forms)

Information submitted via a form on the site (waitlist, Ambassador application, Partner application, Investor inquiry) is retained for 24 months from your last interaction with us, unless you request its deletion before this period or your application results in the creation of a Kodo account, in which case the rules in section 7.2 apply from that point.

7.2 Active data

As long as your Kodo account is active, your personal data is retained to enable the provision of services and management of your account.

7.3 Data after account closure

After your Kodo account is closed, we retain:

7.4 Anonymized data

Beyond the retention periods above, your data may be anonymized (so that it is no longer possible to identify you) and retained for statistical purposes and to improve our services, with no time limit.

7.5 Kodo Points data

Kodo Points and their associated history are deleted when the account is closed. They cannot be recovered after closure.

8. Security of your data

8.1 Technical security measures

Kodo implements appropriate technical security measures to protect your personal data against unauthorized access, alteration, disclosure, loss, or destruction:

• Encryption in transit: all communications between your device and our servers are encrypted using secure protocols (HTTPS/TLS)
• Encryption at rest: sensitive data stored in our databases is encrypted
• Strong authentication: access to internal systems is protected by multi-factor authentication mechanisms
• Access control: data access is limited to team members who need it to carry out their duties
• Continuous monitoring: 24/7 monitoring of our infrastructure to detect any anomaly or intrusion attempt
• Logging: access to sensitive data is logged for audit and accountability purposes

8.2 Organizational measures

• Training: regular awareness training for our team on data protection
• Security policy: a strict internal IT security policy
• Incident management: defined and tested security incident response procedures
• Partner selection: vetting of our processors' security practices

8.3 Notification in the event of a data breach

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, Kodo commits to informing you as soon as possible, in accordance with applicable legal obligations.

8.4 Limits of security

While we take all reasonable precautions, no security system is infallible. We cannot guarantee absolute security of your data. In the event of a data breach, we will immediately take the necessary steps to limit the damage and inform you.

8.5 Your role in security

You help keep your data secure by:

• Never sharing your OTP code with anyone
• Immediately reporting any suspicious activity on your account
• Using a secure device and network to access Kodo
• Keeping the Kodo app up to date

9. Your rights over your data

In accordance with applicable regulations, you have the following rights regarding your personal data:

9.1 Right to information

You have the right to be informed of how your data is collected and used. This Privacy Policy fulfills that purpose.

9.2 Right of access

You can request a copy of all the personal data we hold about you, as well as information about its processing (purposes, retention period, recipients, etc.).

9.3 Right to rectification

If your personal data is inaccurate, incomplete, or outdated, you can request that it be corrected or updated at any time.

9.4 Right to erasure ("right to be forgotten")

You can request the deletion of your personal data in cases provided for by law:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw your consent and there is no other legal basis
• You object to the processing and there is no overriding legitimate ground

This right does not apply where retention is necessary to comply with a legal obligation or to defend legal rights.

9.5 Right to restriction of processing

In certain cases (contesting the accuracy of the data, unlawful processing, data needed for a dispute), you can request that the processing of your data be restricted.

9.6 Right to data portability

You can request to receive your data in a structured, commonly used, machine-readable format, so you can transmit it to another provider.

9.7 Right to object

You can object to the processing of your data for direct marketing purposes (including any related profiling). You can also object to processing based on legitimate interest for reasons relating to your particular situation.

9.8 Right to withdraw consent

Where processing of your data is based on your consent, you can withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

9.9 Exercising your rights

To exercise any of these rights, please contact us via:

• The Kodo app: Account > Delete my account, for erasure; Account > Contact support, for any other request
• The kodo.sn/suppression-compte page, which explains deletion without the app
• Post: at the address listed in Section 1.1

We will respond to your request within a maximum of 30 days. This period may be extended by an additional two months for complex or multiple requests; you will be informed of any such extension.

We may ask you to verify your identity before responding to your request, in order to protect your data from unauthorized access.

10. Minors

10.1 Minimum age

Kodo is accessible to individuals aged 14 and over, which is checked when the account is created. We do not knowingly collect personal data from anyone under 14.

10.2 Users aged 14 to 17

For users aged 14 to 17, we recommend that Kodo be used with the agreement of a parent or legal guardian. Parents or guardians can contact us to exercise rights related to the personal data of minors under their responsibility.

10.3 Detected minor accounts

If we discover that a user is under 14, we will immediately suspend their account and delete their personal data.

11. Cookies and tracking technologies

11.1 What is a cookie?

A cookie is a small text file placed on your device when you access the Kodo platform. It allows the platform to recognize your device on future visits and improve your experience.

11.2 Cookies used on kodo.sn

• Audience measurement (Mixpanel, hosted in the European Union): a random identifier, stored in your browser's local storage, helps us understand how you use the site (pages visited, sections seen, buttons clicked, simulator, forms submitted) and, if you install the app from the site, link that installation to your visit. Set as soon as you arrive on the site.
• Error tracking (Sentry, hosted in Germany): if a technical error occurs, information about the error and your browser is sent to us so we can fix it, with no personal data.

Once available, the Kodo app may use cookies or equivalent technologies strictly necessary for authenticating and securing your session; this Policy will be updated accordingly if and when that happens.

11.3 Managing cookies

You can disable analytics cookies at any time via your browser settings (blocking third-party cookies, tracker-blocking extensions). Refusing analytics cookies does not affect your ability to browse the site or submit a form.

12. Changes to the Privacy Policy

12.1 Right to modify

Kodo reserves the right to modify this Privacy Policy at any time, in particular to reflect legal, regulatory, or technical developments.

12.2 Notification of changes

In the event of a substantial change to this Policy, we will inform you:

• Via a notification in the Kodo app
• By email if you have provided us with your email address
• By displaying a visible banner on the platform

12.3 Effective date

Changes take effect on the date indicated in the updated Policy. Your continued use of Kodo after that date constitutes your acceptance of the changes.

13. Contact and complaints

13.1 Contact regarding your personal data

For any question, request, or complaint relating to the processing of your personal data:

Via the Kodo app: Account > Delete my account, or Account > Contact support

By email: hello@kodo.sn

By post: Kodo Financial Technology Inc., Data Protection, 254 Chapman Rd, Ste 208 #28536, Newark, Delaware 19702, United States of America

Response time: 30 business days maximum

13.2 Complaints to competent authorities

If you believe that the processing of your personal data does not comply with applicable regulations, you have the right to lodge a complaint with the competent data protection authority in your country of residence or in the country where the alleged violation occurred. In Senegal, this is the Personal Data Protection Commission (CDP), under Law No. 2008-12 of January 25, 2008.

Kodo Financial Technology Inc. © 2026 All rights reserved.