Terms & Conditions

• —"HashBack" refers to Hashback Solutions and its platform.
• —"User" / "You" means any individual or entity using the Services.
• —"Services" include STK Push, B2C, APIs, dashboards, and integrations.
• —"Third-Party Providers" include mobile network operators, banks, and payment processors.

You must:

• Be at least 18 years old
• Have the legal capacity to enter into a binding contract
• If acting on behalf of a business, have authority to bind that entity

You agree to:

• Provide accurate and complete information
• Maintain confidentiality of your credentials
• Be fully responsible for all activity under your account

HashBack Solutions operates a technology platform for Kenyan businesses, made up of the products described below. One account gives access to all of them and they share a single balance; you pay only for what you use.

4.1 — HashPay (payment collection)

Collection of customer payments over M-Pesa: STK Push prompts, C2B Till and Paybill confirmations, payment links, hosted checkout, QR payments, webhooks and automated reconciliation. Payment channels are provisioned, reviewed and activated by HashBack, and may be operated on a subscription or, after a first completed subscription month, on Pay-As-You-Go. A sandbox mode is available for testing before go-live, restricted to numbers you have nominated and verified.

4.2 — Wallet as a Service (payouts and payroll)

Merchant wallets, B2C disbursements, bulk payment and payroll runs, withdrawals to M-Pesa or bank, float management, transaction ledgers and receipts. Payout fees are charged per payout on a published scale that varies with the amount. Funds held in a wallet are held for settlement purposes only and are not a deposit, do not earn interest, and confer no banking relationship.

4.3 — HashPay SMS (bulk messaging)

Bulk and transactional SMS delivered through our licensed messaging partner, with contact groups, templates, scheduling, per-recipient delivery reports and a REST API. Messages may be sent under a shared sender ID or, once approved and mapped to your account, your own registered sender ID; registration of a sender ID attracts a separate fee. SMS is billed per 168-character unit at a single flat rate regardless of which sender ID is used. Promotional traffic carries an opt-out line as required by Kenyan regulation, and the characters it adds are billed.

4.4 — WhatsApp messaging

One-time passwords, transaction alerts, receipts and customer notifications delivered over the WhatsApp Business platform. Use is additionally subject to WhatsApp's and Meta's own policies on what may be sent, to whom, and when; we cannot override those rules on your behalf.

4.5 — HashBack (MSISDN hash decoding)

Decoding of the hashed mobile numbers (MSISDNs) that appear in Safaricom M-Pesa C2B callbacks, so that a payment can be matched to the payer who made it. Sold as pay-as-you-go credits at a per-request rate set by your plan, with a minimum top-up per plan. Credits do not expire and no credit is charged for a failed decode. Decoding is available for Kenyan mobile numbers only.

Permitted purpose — exhaustive. The decoding API may be triggered exclusively for the real-time reconciliation, tracking, receipting or invoice matching of a genuine payment that was initiated through, or made to, your own channel within your own platform, and only against a callback payload that Safaricom delivered to that channel. Each decode request is a representation by you that these conditions are met. Any other use is a material breach of these Terms.

Prohibited use. You shall not, and shall not permit any person to:

• Harvest, scrape, mine or enumerate mobile numbers of Kenyan mobile subscribers, whether in bulk, by iteration, by speculative submission of hashes, or by any automated means.
• Profile, segment, enrich, trace or identify any subscriber, or build, augment, test or validate any contact list, customer database, directory, marketing list or identity dataset.
• Decode a hash that did not reach you in a callback for a payment genuinely made to your own channel, including hashes obtained from a third party, from another account, from a simulator, or by any means other than your own live Safaricom callback.
• Resell, sublicense, share, publish or otherwise disclose decoding access, decoded numbers, or the output of the API to any third party, except to the data subject or as required by law.
• Retain a decoded number for longer than is necessary for the permitted purpose and for any statutory record-keeping obligation that applies to you, or use it for marketing or any secondary purpose without a separate lawful basis.

Every request is logged with the requesting account, channel, timestamp, source address and outcome. You authorise HashBack to inspect those logs, to apply rate, volume and pattern controls, and to require you to evidence the underlying payment for any request. Where we reasonably believe the decoder has been used outside the permitted purpose we may suspend decoding immediately and without notice, cancel unused credits without refund, terminate the account under Section 18, and report the matter to Safaricom PLC, the Communications Authority of Kenya and the Office of the Data Protection Commissioner. Use of the decoder is additionally subject to your warranties as Data Controller in Section 14, which require auditable consent from each data subject to the decoding of their mobile number.

4.6 — Supporting tools

• —Short links for receipts and payment pages.
• —Service tokens which pay for notifications and certain per-request features; each notification sent on your behalf consumes a token.
• —Developer tooling — API documentation, sandbox, and C2B/B2C callback simulators.

4.7 — Custom systems

We also build bespoke systems — retail and point-of-sale, transport and fleet, property and rentals, ERP, web and mobile applications — on separately agreed terms. Nothing on our website constitutes a quotation, a delivery date or a commitment to build.

4.8 — Abuse controls applied to payer numbers

Repeatedly prompting a mobile number that does not complete the payment is abusive to that subscriber and puts our access to Safaricom's platform at risk. HashBack therefore operates automated controls on the numbers your channels prompt:

• Repeated cancellations. A mobile number that repeatedly cancels payment prompts from the same account — more than five cancellations within an hour, or more than three across a day — is placed on a temporary watchlist for that account. Prompts the customer simply ignores or leaves to time out count the same way.
• While watchlisted, further prompts from that account to that number are silently not delivered. Your request is accepted and answered normally, but no prompt is sent. This is deliberate: an alert would simply tell an abusive sender how to work around the control.
• The same applies to numbers that repeatedly come back as unreachable or non-existent.
• Watchlisting is temporary and lifts automatically. Thresholds and durations are set by us, are not published, and may change at any time without notice.
• Separately, an account whose confirmed-success rate falls below the required floor across its recent prompts may be moved to Pay-As-You-Go, restricted, or suspended.

4.9 — Removal of accounts, channels and linked records

To keep the platform and our partner integrations clean, HashBack may deactivate, purge or permanently delete accounts, payment channels and linked records — including any data held in them — in the following cases:

• Dormant accounts or channels with no genuine activity over an extended period.
• Channels pending renewal or left expired after a subscription has lapsed.
• Channels registered but never activated, and registrations abandoned before completion.
• Accounts involved in fraud, attempted fraud, impersonation or money laundering, or used to collect payments under false pretences.
• Accounts showing other suspicious activity, including prompt spamming, testing of stolen card or M-Pesa credentials, evasion of a suspension, or abuse of another person's identity or shortcode.

Settled funds belonging to you that are held at the time of closure remain payable to you, subject to our verification, any applicable investigation, and any deduction we are lawfully entitled to make.

You agree to:

• Provide all required KYC documentation
• Comply with all applicable anti-money laundering (AML) and counter-terrorism financing (CTF) laws
• Cooperate with verification requests

HashBack reserves the right to:

• Monitor transactions
• Report suspicious activity to authorities
• Suspend accounts pending compliance review

HashBack may, at its sole discretion:

• Delay, reject, cancel, or reverse transactions
• Set transaction limits
• Suspend services due to risk, fraud, or regulatory requirements

All applicable fees will be communicated through the platform or official channels. You agree that:

• Fees may change with notice
• Transaction fees are non-refundable, except where required by law

See our Pricing Page for current rates.

• Users are responsible for verifying transaction details before submission
• HashBack does not guarantee reversals of completed transactions
• Duplicate or erroneous payments may be addressed at HashBack's discretion
• Failed B2C payouts — amount returned, fee retained. Where a payout (including a payroll row) is submitted to M-Pesa and is then declined at the recipient's end — the number is not registered for M-Pesa, the name does not match, the account is restricted or the recipient's limits are exceeded — the principal is credited back to your wallet and the transaction fee is not refunded. The fee pays for the payout attempt, which was made and billed to us. Verify the payee's number before sending.
• Where a payout is rejected before it reaches M-Pesa, nothing is debited and no fee arises.

You agree:

• Not to use the platform for illegal or fraudulent purposes
• To verify the legitimacy of your customers
• To comply with all applicable laws and regulations

You are solely responsible for:

• Fraudulent transactions initiated through your account
• Disputes with your customers

• Fraud committed by your customers or third parties
• Unauthorized payments resulting from your system vulnerabilities
• Social engineering or phishing attacks affecting your account

HashBack relies on third-party providers including mobile networks and financial institutions. We are not responsible for:

• Downtime or failures from mobile networks or banks
• Delays in transaction processing
• Errors caused by external systems

You grant HashBack a non-exclusive, worldwide license to use, store, and process data you submit, and to analyze transaction data for service improvement and compliance.

14.1 — Statutory framework and definitions

This Section is governed by the Data Protection Act, 2019 (the "DPA") and the regulations made under it. The expressions personal data, sensitive personal data, data subject, data controller, data processor and processing bear the meanings given to them in section 2 of the DPA. "ODPC" means the Office of the Data Protection Commissioner. "Client Data" means personal data of your customers, payers, payees, employees, recipients and messaging contacts which is processed through the Services. Where these Terms conflict with a mandatory provision of the DPA, the DPA prevails to the extent of the conflict and the remainder of this Section continues in force.

14.2 — You are the Data Controller

If you are a business user, merchant, developer or partner, you are the Data Controller of Client Data for all purposes of the DPA. You alone determine the purpose and the means of its processing; HashBack does not. Accordingly, and at your own cost, you are solely responsible for: registration as a data controller with the ODPC where section 18 of the DPA requires it; establishing and documenting a lawful basis under section 30 of the DPA for every processing operation you instruct; publishing and maintaining a DPA-compliant privacy policy and giving the notice required by section 29; conducting any data protection impact assessment required by section 31; responding to data subject requests within the statutory timelines; setting and applying a lawful retention period; and notifying the ODPC and affected data subjects of a personal data breach within your own systems as required by section 43.

14.3 — HashBack acts strictly as Data Processor

In performing the Services on your behalf — including, without limitation, the receipt, parsing and storage of M-Pesa C2B and B2C callbacks, MSISDN hash decoding under Section 4.5, the routing of bulk and transactional SMS and WhatsApp messages, wallet, payout, payroll, bulk disbursement and withdrawal processing, payment links, checkout, receipting and reconciliation — HashBack acts strictly as a Data Processor acting on, and only on, your instructions. We process Client Data for no independent purpose of our own. Your instructions are given by, and are limited to, the API calls you make, the configuration you set in your dashboard and any written instruction accepted by us in writing. We do not sell Client Data, and do not use it for our own advertising, marketing, credit scoring or profiling.

You authorise HashBack to engage sub-processors in order to deliver the Services, including Safaricom PLC, our licensed messaging partner, Meta Platforms in respect of WhatsApp traffic, and our hosting and infrastructure providers. We remain responsible to you for the performance of a sub-processor's obligations in respect of Client Data.

14.4 — Where HashBack is itself a Data Controller

HashBack acts as Data Controller, and not as your processor, only in respect of data it processes for its own account: your registration, KYC and identity records; your billing, credit, token and settlement records; authentication, session and device data of your users of our dashboard; fraud, abuse and watchlist controls, including the payer-number controls in Section 4.8; system, security and audit logs; and records we are required to keep under the Proceeds of Crime and Anti-Money Laundering Act, applicable Central Bank of Kenya guidance and tax law. For that data the rights of access, correction, deletion, objection and portability under Part V of the DPA may be exercised against us directly using the contact details in Section 24, subject to the statutory retention periods that apply to us.

14.5 — Our obligations as Processor

As Data Processor, and in accordance with section 42 of the DPA, HashBack shall: process Client Data only on your instructions; keep it confidential and impose equivalent confidentiality on its personnel; implement appropriate technical and organisational measures, including encryption of data in transit, access controls, segregation by account and audit logging; not transfer Client Data outside Kenya except where the safeguards in sections 48 and 49 of the DPA are met; assist you, at your reasonable cost, with data subject requests, impact assessments and ODPC enquiries; notify you without undue delay, and in any event within forty-eight (48) hours of confirmation, of a personal data breach affecting Client Data in our custody; and, on termination, delete or return Client Data at your written election, save for data we are required by law to retain.

14.6 — Data Controller warranty (consent)

You warrant, represent and undertake to HashBack, on a continuing basis and afresh on each occasion you call the APIs or submit data to the Services, that:

• You have obtained from each data subject explicit, informed, freely given, specific, documented and auditable consent — or you can demonstrate another lawful basis under section 30 of the DPA — to the collection, transmission to HashBack and its sub-processors, processing, storage, disclosure and, in the case of a hashed MSISDN, the decoding, of their personal data, including their mobile telephone number.
• You have given each data subject the notice required by section 29 of the DPA, disclosing that a third-party payment, messaging and decoding processor is used on your behalf.
• You maintain a published, accessible and DPA-compliant privacy policy covering every purpose for which you instruct us to process Client Data.
• Records evidencing that consent or other lawful basis are retained by you for as long as the data is processed, and will be produced to HashBack, to Safaricom PLC or to the ODPC within forty-eight (48) hours of a request.
• Every instruction you give is lawful, is within the permitted purposes of these Terms, and does not require HashBack to act in breach of the DPA, the Kenya Information and Communications Act, the Computer Misuse and Cybercrimes Act, or the terms on which our access to Safaricom's platform is granted.
• You do not transmit to us sensitive personal data within the meaning of the DPA except where the Services expressly require it, and never in a free-text or message field.

HashBack is entitled to rely on these warranties without inquiry, is under no duty to verify the existence of consent, and has no obligation to monitor the lawfulness of your instructions. Nothing we do in the course of providing the Services constitutes advice that your processing is lawful.

14.7 — Data subject requests

A request, complaint or objection received by HashBack from your data subject in respect of Client Data will be referred to you, and you shall deal with it in your own name and within the timelines set by the DPA. We will not respond substantively on your behalf unless you instruct us in writing and we agree, and we may charge for assistance so provided.

14.8 — Indemnity

In addition to and without limiting Section 16, you shall fully indemnify, defend and hold harmless HashBack Solutions, its directors, officers, employees, agents and sub-processors, on demand and on a full-indemnity basis, against every fine, administrative penalty, compensation order, enforcement notice, assessment, loss, liability, claim, demand, award and cost (including advocate–client costs and the cost of responding to any audit, investigation or enforcement action) imposed by or arising from proceedings before the ODPC, the Communications Authority of Kenya, the Central Bank of Kenya, any court, tribunal or regulator, or from any claim by a data subject or other third party, to the extent arising out of or in connection with:

• Your failure to obtain, record, maintain or evidence consent or another lawful basis for any processing you instructed, including any MSISDN decode;
• The absence, inadequacy or inaccuracy of your privacy policy or of the notice required by section 29 of the DPA;
• Any instruction that was unlawful, excessive, outside the permitted purposes of Section 4.5, or that we performed in good faith in reliance on your warranties in Section 14.6;
• Any breach, compromise, misuse or loss of Client Data occurring within your systems, personnel or supply chain, or through credentials issued to you;
• Your retention, enrichment, onward disclosure, resale or secondary use of decoded numbers or other Client Data;
• Your failure to register with the ODPC, to notify a breach, or to answer a data subject request as the DPA requires.

This indemnity is uncapped, is not subject to the limitations in Section 17, and survives termination of these Terms. HashBack may elect to conduct the defence of any such claim or regulatory proceeding, in which case you shall cooperate fully and meet the costs as incurred; you shall not settle, compromise or admit liability in any manner that binds, or purports to bind, HashBack without our prior written consent.

14.9 — Suspension on data protection grounds

Where HashBack reasonably believes that continued processing on your instructions would be unlawful, or where directed by the ODPC, the Communications Authority of Kenya or Safaricom PLC, we may suspend or terminate the affected Service immediately and without prior notice, and may preserve, disclose or surrender Client Data where legally compelled to do so. Suspension on these grounds does not entitle you to a refund and does not relieve you of accrued charges.

All platform content, APIs, and systems are owned by HashBack. You may not:

• Copy, modify, or reverse engineer the platform
• Use the platform beyond the permitted scope of these Terms

You agree to indemnify and hold harmless HashBack from any claims, damages, or losses arising from:

• Your misuse of the Services
• Your violation of these Terms
• Disputes between you and your customers

HashBack may suspend or terminate your account for:

• Violation of these Terms
• Suspected fraud or illegal activity
• Regulatory or compliance reasons

Any disputes shall be resolved through:

• 1.Negotiation in good faith between the parties
• 2.If unresolved, arbitration in Nairobi, Kenya in accordance with applicable arbitration laws

These Terms are governed by and construed under the laws of the Republic of Kenya.

These Terms constitute the entire agreement between you and HashBack and supersede all prior agreements, representations, and understandings.

If any provision of these Terms is found invalid or unenforceable by a court of competent jurisdiction, the remaining provisions shall continue in full force and effect.

HashBack may update these Terms at any time. Significant changes will be communicated via email or dashboard alerts.

For legal inquiries or questions about these Terms, contact us at:

• ✉hashbacksolutions@gmail.com

This section applies specifically to users of the HashPay Peer-to-Peer (P2P) payment services, including P2P gateways, payment automations, and related integrations.

25.1 — Data Ownership & Exclusivity

• All data generated through your use of HashPay P2P services — including transaction records, recipient details, gateway configurations, and automation rules — belongs exclusively to you, the user.
• This data is used solely to power your own gateway and your own automations. It is not pooled, sold, or made accessible to other users or external parties.

25.2 — No Third-Party Data Sharing

• HashPay will not sell, rent, or otherwise disclose your P2P data to any third party.
• Your P2P data will not be shared with advertisers, data brokers, or any commercial third parties.
• Disclosure may occur only where required by law (e.g., court order, regulatory directive) or as strictly necessary to process your transactions through mobile network operators and financial institutions under Section 11.

25.3 — Service Improvement & Analytics

HashBack may use aggregated, anonymised analytics derived from P2P activity across the platform to:

• Improve the reliability, performance, and security of the HashPay P2P infrastructure
• Develop new features and optimise existing P2P gateway capabilities
• Monitor platform health and detect fraud patterns at a systemic level

25.4 — Data Retention

• P2P transaction data is retained for as long as your account is active and as required by applicable Kenyan law and regulatory obligations.
• Upon account termination, your personal P2P data will be deleted or anonymised within a reasonable period, except where retention is legally required.

25.5 — Your Rights

• You may request access to your P2P data at any time by contacting HashBack support.
• You may request correction of inaccurate data or deletion of data where legally permissible.