Privacy Policy.

Privacy Policy

Last updated: August 2026

Version: 1.1

Preamble

At Kodo, protecting your personal data is a fundamental priority. Kodo Financial Technology Inc. ("Kodo", "we", "our", or "the Company") is committed to processing your personal data with the utmost transparency, integrity, and security.

This Privacy Policy ("the Policy") explains in detail how we collect, use, store, protect, and share your personal information when you use the Kodo platform, whether through our mobile app, our website, or any other Kodo service.

We encourage you to read this document carefully. If you have any questions, feel free to contact us using the details provided at the end of this document.

By using the Kodo platform, you acknowledge that you have read this Policy and consent to the processing of your personal data under the terms described below.

1. Who we are

1.1 Data controller

The controller responsible for processing your personal data is:

Kodo Financial Technology Inc. 254 Chapman Rd, Ste 208 #28536 Newark, Delaware 19702 United States of America

Operating subsidiary: Kodo Financial Technology SAS Senegal

For any question regarding the processing of your personal data, you can contact us via the Kodo app or by post at the address above.

1.2 Data Protection Officer (DPO)

Can be reached at: hello@kodo.sn.

1.3 Scope of application

This Policy applies to all personal data collected by Kodo in connection with:

• Use of the Kodo mobile app
• Access to the Kodo website
• Any transaction or interaction with our services
• Any communication with our customer support

2. What data do we collect?

This Policy covers two distinct contexts: the data collected today on the kodo.sn website (even before the app is available for download), and the data we will collect via the Kodo app once it has launched. Section 2.1 below describes the former; sections 2.2 through 2.10 describe the latter.

2.1 Data collected on the kodo.sn website

Contact and application forms. The kodo.sn site offers several forms (user waitlist, Ambassador application, Partner application, Investor inquiry). Depending on the form submitted, we collect: your name, phone number and/or email address, country, and, where applicable, your company or fund name, your role, and any free-text message you choose to send us. This information is used solely to respond to your request and, if you consent at the time of submission, to follow up with you regarding the relevant program.

Attribution data. When you submit one of these forms, we also record the page you navigated from, the page that referred you to the site (if any), and the campaign parameters present in the URL (utm_source, utm_medium, utm_campaign). This data helps us understand which channels bring visitors to the site; it is not cross-referenced with your identity beyond the form you submitted.

Redirection to WhatsApp. Some buttons on the site open a WhatsApp conversation with the Kodo team. When you click one of these buttons, we record the event (originating page, timestamp) before WhatsApp opens, but we do not have access to the content of your WhatsApp exchanges. WhatsApp is a service operated by Meta; its use is governed by WhatsApp's own privacy policy, independent of this Policy.

Cookies and analytics. We use PostHog to measure site traffic (pages viewed, buttons clicked, forms submitted). See Section 11 for details on the cookies used and how to disable them.

2.2 Identification and contact data

When you create your account and use our services, we collect:

• Phone number: the primary means of identification, used to create your account and verify it via WhatsApp OTP. This number is your primary identifier on Kodo.
• Email address (optional): if you choose to provide it, used for important communications and account recovery.
• First and last name (optional): if you choose to provide them to personalize your experience.
• Profile picture (optional): if you choose to add one.

2.3 Verification and authentication data

To secure your account, we collect:

• WhatsApp OTP data: a one-time code sent via WhatsApp to verify your phone number when you create your account and, if needed, on subsequent logins.
• Login timestamps: the dates, times, and frequency of your logins to the platform.
• Device information: a unique device identifier, operating system, and app version, used to secure your account and detect unauthorized access attempts.

2.4 Transaction data

For each transaction made on Kodo, we record:

• Type of service: mobile top-up, water bill payment, electricity bill payment, Woyofal top-up
• Transaction amount: in CFA francs (FCFA)
• Target number or identifier: phone number, meter number, or customer account identifier (provided by you)
• Payment method used: Orange Money, Wave, bank card
• Transaction status: success, failure, refund
• Date and time of the transaction: precise timestamp
• Transaction reference: unique identifier assigned by Kodo

2.5 Loyalty program data

As part of the Kodo Points program, we retain:

• Kodo Points balance: total number of points accumulated
• Points history: transactions that generated points, date awarded, amount concerned
• Points usage: rewards obtained or discounts applied

2.6 Technical data collected automatically

While you use the platform, we automatically collect:

• IP address: your device's Internet Protocol address, used for security purposes and approximate geolocation
• Device type: make, model, and operating system (iOS/Android)
• App version: the version of the Kodo app in use
• Network data: connection type (WiFi, 4G, 3G)
• Browsing data: pages and features viewed, session duration, actions taken, errors encountered
• Advertising identifiers (with your consent): IDFA (iOS) or GAID (Android) identifiers, for improving the user experience

2.7 Location data

• Approximate location: determined from your IP address, used to detect unusual logins and improve security.
• Precise GPS location (only with your explicit consent and if enabled): used for specific features if available.

You can disable location access in your device settings. This will not affect Kodo's core functionality.

2.8 Data received from third parties

We may receive limited information from our partners:

• Payment confirmation: success or failure status of the transaction, from our payment partners (Orange Money, Wave, banking networks)
• Delivery confirmation: success or failure status of service delivery, from our partner aggregators

This data is limited to what is strictly necessary to confirm or refute the execution of your transactions.

2.9 Communication and support data

If you contact us via our customer support, we retain:

• The content of your messages and requests
• The responses provided by our team
• Any documents exchanged (screenshots, proof of payment, etc.)
• The history of interactions with our support team

2.10 What we do not collect

Kodo does not collect:

• Full bank card numbers (processed directly by the payment gateway)
• Identity documents (national ID, passport), unless additional verification proves necessary
• Medical or biometric information
• Financial data (income, bank statements) beyond transactions made on Kodo

3. Why do we collect this data?

3.1 Providing services (legal basis: performance of a contract)

We use your data to:

• Create and manage your Kodo account
• Process your top-up and bill payment requests
• Verify your identity when creating your account and logging in
• Confirm transactions and send you receipts
• Manage the Kodo Points loyalty program
• Resolve technical issues or disputes related to your transactions

3.2 Security and fraud prevention (legal basis: legitimate interest)

We use your data to:

• Detect, prevent, and address fraudulent, abusive, or suspicious activity
• Verify the legitimacy of transactions
• Protect the integrity of the platform and payment systems
• Identify and block unauthorized access attempts
• Analyze suspicious usage patterns (multiple accounts, unusual transactions, etc.)
• Suspend or deactivate accounts in the event of confirmed or suspected fraudulent use

3.3 Improving and personalizing services (legal basis: legitimate interest)

We use your data to:

• Analyze platform usage to identify areas for improvement
• Personalize your experience (transaction history, service suggestions)
• Test and develop new features
• Optimize the platform's technical performance
• Carry out aggregated statistical analyses of service usage
• Improve our service offering and loyalty program

3.4 Communications (legal basis: contract or consent, as applicable)

We use your data to:

• Send you transaction confirmations and receipts (SMS, push notifications, or email if provided)
• Alert you of unusual activity on your account
• Inform you of important platform updates
• Notify you of changes to the Terms of Use or this Privacy Policy
• Contact you regarding your support requests

With your prior consent:

• Inform you of special offers, promotions, and new services

3.5 Legal compliance (legal basis: legal obligation)

We use your data to:

• Comply with our legal and regulatory obligations in the jurisdictions where we operate
• Respond to legitimate requests from competent public authorities
• Establish, exercise, or defend our legal rights in the event of a dispute
• Comply with applicable accounting and tax obligations

3.6 Analysis and research (legal basis: legitimate interest)

We may use aggregated and anonymized data to:

• Understand usage trends for our services
• Improve our business strategy
• Prepare internal reports

These analyses do not allow individual users to be identified.

4. Legal basis for processing

5. Who do we share your data with?

5.1 Payment partners

To process your payments, we share strictly necessary information with:

• Orange Money (Orange Sénégal): for processing payments via Orange Money
• Wave: for processing payments via Wave
• Bank payment service providers: for processing card payments

These partners receive only the information essential to securely process your payment (amount, transaction reference). They do not receive your entire Kodo profile.

5.2 Service aggregators

To deliver the services you have ordered (mobile credit, bill payments, etc.), we share the information necessary for delivery with our partner aggregators:

• Target phone number or meter number
• Type of service ordered
• Transaction amount
• Order reference

These partners are contractually required to process this information exclusively for the purpose of delivering the ordered service.

5.3 Technical service providers

We use third-party providers to help us operate the platform technically:

• Cloud hosting providers: for data storage and backup
• Data analytics providers: for anonymized analysis of platform usage
• Notification providers: for sending push notifications and WhatsApp OTP messages
• Customer support providers: for managing user support requests
• IT security providers: for monitoring and protecting the platform

These providers act as Kodo's data processors and are subject to strict contractual data protection obligations. They only have access to the data necessary to carry out their specific task.

5.4 Legal obligations

Kodo may be required to disclose your personal data to public authorities or third parties in the following cases:

• A legal or regulatory obligation (court order, administrative injunction)
• Cooperation with competent authorities as part of official investigations
• Protection of the rights, property, or safety of Kodo, its users, or third parties
• Prevention or detection of offenses

In these cases, Kodo discloses only the information strictly required and informs the user where possible, unless prohibited by law.

5.5 Business transfer or restructuring

In the event of a merger, acquisition, asset sale, or restructuring involving Kodo, your personal data may be transferred to the acquiring entity. We will inform you in advance where possible.

5.6 What we do not do with your data

• We never sell your personal data to third parties for commercial or advertising purposes.
• We do not share your data for third-party ad targeting purposes.
• We do not disclose your data to credit bureaus or financial institutions for creditworthiness assessment purposes.

6. International data transfers

6.1 Transfers to the United States

Kodo Financial Technology Inc. is based in the United States (Delaware). Your data may be transferred to, stored, and processed in the United States. By using Kodo, you consent to this international data transfer.

6.2 Applicable safeguards

Kodo ensures that any transfer of data to third countries takes place under appropriate security conditions, notably through:

• The use of standard contractual clauses
• Verification that destination countries have an adequate level of data protection
• Appropriate technical and organizational measures

6.3 Data of Senegalese users

For users based in Senegal, certain operational data may be processed by the Senegalese subsidiary, Kodo Financial Technology SAS, in accordance with applicable Senegalese law, in particular the law on the protection of personal data.

7. Data retention periods

7.1 Data collected via the website (forms)

Information submitted via a form on the site (waitlist, Ambassador application, Partner application, Investor inquiry) is retained for 24 months from your last interaction with us, unless you request its deletion before this period or your application results in the creation of a Kodo account, in which case the rules in section 7.2 apply from that point.

7.2 Active data

As long as your Kodo account is active, your personal data is retained to enable the provision of services and management of your account.

7.3 Data after account closure

After your Kodo account is closed, we retain:

7.4 Anonymized data

Beyond the retention periods above, your data may be anonymized (so that it is no longer possible to identify you) and retained for statistical purposes and to improve our services, with no time limit.

7.5 Kodo Points data

Kodo Points and their associated history are deleted when the account is closed. They cannot be recovered after closure.

8. Security of your data

8.1 Technical security measures

Kodo implements appropriate technical security measures to protect your personal data against unauthorized access, alteration, disclosure, loss, or destruction:

• Encryption in transit: all communications between your device and our servers are encrypted using secure protocols (HTTPS/TLS)
• Encryption at rest: sensitive data stored in our databases is encrypted
• Strong authentication: access to internal systems is protected by multi-factor authentication mechanisms
• Access control: data access is limited to team members who need it to carry out their duties
• Continuous monitoring: 24/7 monitoring of our infrastructure to detect any anomaly or intrusion attempt
• Logging: access to sensitive data is logged for audit and accountability purposes

8.2 Organizational measures

• Training: regular awareness training for our team on data protection
• Security policy: a strict internal IT security policy
• Incident management: defined and tested security incident response procedures
• Partner selection: vetting of our processors' security practices

8.3 Notification in the event of a data breach

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, Kodo commits to informing you as soon as possible, in accordance with applicable legal obligations.

8.4 Limits of security

While we take all reasonable precautions, no security system is infallible. We cannot guarantee absolute security of your data. In the event of a data breach, we will immediately take the necessary steps to limit the damage and inform you.

8.5 Your role in security

You help keep your data secure by:

• Never sharing your OTP code with anyone
• Immediately reporting any suspicious activity on your account
• Using a secure device and network to access Kodo
• Keeping the Kodo app up to date

9. Your rights over your data

In accordance with applicable regulations, you have the following rights regarding your personal data:

9.1 Right to information

You have the right to be informed of how your data is collected and used. This Privacy Policy fulfills that purpose.

9.2 Right of access

You can request a copy of all the personal data we hold about you, as well as information about its processing (purposes, retention period, recipients, etc.).

9.3 Right to rectification

If your personal data is inaccurate, incomplete, or outdated, you can request that it be corrected or updated at any time.

9.4 Right to erasure ("right to be forgotten")

You can request the deletion of your personal data in cases provided for by law:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw your consent and there is no other legal basis
• You object to the processing and there is no overriding legitimate ground

This right does not apply where retention is necessary to comply with a legal obligation or to defend legal rights.

9.5 Right to restriction of processing

In certain cases (contesting the accuracy of the data, unlawful processing, data needed for a dispute), you can request that the processing of your data be restricted.

9.6 Right to data portability

You can request to receive your data in a structured, commonly used, machine-readable format, so you can transmit it to another provider.

9.7 Right to object

You can object to the processing of your data for direct marketing purposes (including any related profiling). You can also object to processing based on legitimate interest for reasons relating to your particular situation.

9.8 Right to withdraw consent

Where processing of your data is based on your consent, you can withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

9.9 Exercising your rights

To exercise any of these rights, please contact us via:

• The Kodo app: Settings > Help & Support > Personal Data
• Post: at the address listed in Section 1.1

We will respond to your request within a maximum of 30 days. This period may be extended by an additional two months for complex or multiple requests; you will be informed of any such extension.

We may ask you to verify your identity before responding to your request, in order to protect your data from unauthorized access.

10. Minors

10.1 Minimum age

Kodo is accessible to individuals aged 12 and over. We do not knowingly collect personal data from anyone under 12.

10.2 Users aged 12 to 17

For users aged 12 to 17, we recommend that Kodo be used with the agreement of a parent or legal guardian. Parents or guardians can contact us to exercise rights related to the personal data of minors under their responsibility.

10.3 Detected minor accounts

If we discover that a user is under 12, we will immediately suspend their account and delete their personal data.

11. Cookies and tracking technologies

11.1 What is a cookie?

A cookie is a small text file placed on your device when you access the Kodo platform. It allows the platform to recognize your device on future visits and improve your experience.

11.2 Cookies used on kodo.sn

• Analytics cookies (PostHog): allow us to understand how you use the site (pages visited, buttons clicked, forms submitted) so we can improve it. Placed as soon as you arrive on the site.

Once available, the Kodo app may use cookies or equivalent technologies strictly necessary for authenticating and securing your session; this Policy will be updated accordingly if and when that happens.

11.3 Managing cookies

You can disable analytics cookies at any time via your browser settings (blocking third-party cookies, tracker-blocking extensions). Refusing analytics cookies does not affect your ability to browse the site or submit a form.

12. Changes to the Privacy Policy

12.1 Right to modify

Kodo reserves the right to modify this Privacy Policy at any time, in particular to reflect legal, regulatory, or technical developments.

12.2 Notification of changes

In the event of a substantial change to this Policy, we will inform you:

• Via a notification in the Kodo app
• By email if you have provided us with your email address
• By displaying a visible banner on the platform

12.3 Effective date

Changes take effect on the date indicated in the updated Policy. Your continued use of Kodo after that date constitutes your acceptance of the changes.

13. Contact and complaints

13.1 Contact regarding your personal data

For any question, request, or complaint relating to the processing of your personal data:

Via the Kodo app: Settings > Help & Support > Personal Data

By email: hello@kodo.sn

By post: Kodo Financial Technology Inc., Data Protection, 254 Chapman Rd, Ste 208 #28536, Newark, Delaware 19702, United States of America

Response time: 30 business days maximum

13.2 Complaints to competent authorities

If you believe that the processing of your personal data does not comply with applicable regulations, you have the right to lodge a complaint with the competent data protection authority in your country of residence or in the country where the alleged violation occurred.

Kodo Financial Technology Inc. © 2026 All rights reserved.