HashBack Solutions operates a technology platform for Kenyan businesses, made up of the products described below. One account gives access to all of them and they share a single balance; you pay only for what you use.
HashBack is not a bank, does not hold customer deposits, and is not a party to transactions between you and your customers. Money moves over Safaricom M-Pesa and our banking partners; we provide the software that initiates, records and reconciles it.
4.1 — HashPay (payment collection)
Collection of customer payments over M-Pesa: STK Push prompts, C2B Till and Paybill confirmations, payment links, hosted checkout, QR payments, webhooks and automated reconciliation. Payment channels are provisioned, reviewed and activated by HashBack, and may be operated on a subscription or, after a first completed subscription month, on Pay-As-You-Go. A sandbox mode is available for testing before go-live, restricted to numbers you have nominated and verified.
4.2 — Wallet as a Service (payouts and payroll)
Merchant wallets, B2C disbursements, bulk payment and payroll runs, withdrawals to M-Pesa or bank, float management, transaction ledgers and receipts. Payout fees are charged per payout on a published scale that varies with the amount. Funds held in a wallet are held for settlement purposes only and are not a deposit, do not earn interest, and confer no banking relationship.
4.3 — HashPay SMS (bulk messaging)
Bulk and transactional SMS delivered through our licensed messaging partner, with contact groups, templates, scheduling, per-recipient delivery reports and a REST API. Messages may be sent under a shared sender ID or, once approved and mapped to your account, your own registered sender ID; registration of a sender ID attracts a separate fee. SMS is billed per 168-character unit at a single flat rate regardless of which sender ID is used. Promotional traffic carries an opt-out line as required by Kenyan regulation, and the characters it adds are billed.
4.4 — WhatsApp messaging
One-time passwords, transaction alerts, receipts and customer notifications delivered over the WhatsApp Business platform. Use is additionally subject to WhatsApp's and Meta's own policies on what may be sent, to whom, and when; we cannot override those rules on your behalf.
4.5 — HashBack (MSISDN hash decoding)
Decoding of the hashed mobile numbers that appear in Safaricom M-Pesa C2B callbacks, so a payment can be matched to a payer. Sold as pay-as-you-go credits at a per-request rate set by your plan, with a minimum top-up per plan. Credits do not expire and no credit is charged for a failed decode. Decoding is available for Kenyan mobile numbers only, and may only be used against callbacks for payments genuinely made to you.
4.6 — Supporting tools
- —Short links for receipts and payment pages.
- —Service tokens which pay for notifications and certain per-request features; each notification sent on your behalf consumes a token.
- —Developer tooling — API documentation, sandbox, and C2B/B2C callback simulators.
- —A stablecoin wallet, where enabled on your account, subject to the separate risks and charges disclosed in the wallet itself.
4.7 — Custom systems
We also build bespoke systems — retail and point-of-sale, transport and fleet, property and rentals, ERP, web and mobile applications — on separately agreed terms. Nothing on our website constitutes a quotation, a delivery date or a commitment to build.
4.8 — Abuse controls applied to payer numbers
Repeatedly prompting a mobile number that does not complete the payment is abusive to that subscriber and puts our access to Safaricom's platform at risk. HashBack therefore operates automated controls on the numbers your channels prompt:
- Repeated cancellations. A mobile number that repeatedly cancels payment prompts from the same account — more than five cancellations within an hour, or more than three across a day — is placed on a temporary watchlist for that account. Prompts the customer simply ignores or leaves to time out count the same way.
- While watchlisted, further prompts from that account to that number are silently not delivered. Your request is accepted and answered normally, but no prompt is sent. This is deliberate: an alert would simply tell an abusive sender how to work around the control.
- The same applies to numbers that repeatedly come back as unreachable or non-existent.
- Watchlisting is temporary and lifts automatically. Thresholds and durations are set by us, are not published, and may change at any time without notice.
- Separately, an account whose confirmed-success rate falls below the required floor across its recent prompts may be moved to Pay-As-You-Go, restricted, or suspended.
You remain charged for prompts that are genuinely delivered, whatever the customer does next. Prompts suppressed by these controls are not delivered and are not charged.
4.9 — Removal of accounts, channels and linked records
To keep the platform and our partner integrations clean, HashBack may deactivate, purge or permanently delete accounts, payment channels and linked records — including any data held in them — in the following cases:
- Dormant accounts or channels with no genuine activity over an extended period.
- Channels pending renewal or left expired after a subscription has lapsed.
- Channels registered but never activated, and registrations abandoned before completion.
- Accounts involved in fraud, attempted fraud, impersonation or money laundering, or used to collect payments under false pretences.
- Accounts showing other suspicious activity, including prompt spamming, testing of stolen card or M-Pesa credentials, evasion of a suspension, or abuse of another person's identity or shortcode.
Purging is permanent and data removed in this way cannot be recovered. Export anything you need to keep before an account or channel lapses. Where fraud or a legal obligation is involved, we may instead retain records for as long as the law requires, and we may report the matter to Safaricom, our banking partners, or the authorities.
Settled funds belonging to you that are held at the time of closure remain payable to you, subject to our verification, any applicable investigation, and any deduction we are lawfully entitled to make.
