Privacy Policy
Effective date: 20 October 2026
This policy explains what personal information Kewa collects, why we collect it, who can see it, and the rights you have. Kewa helps people split shared costs and settle up. It never holds or moves money.
Who we are
Kewa is provided by Kewa Technologies, Inc., a Delaware corporation ("Kewa", "we", "us"). We decide how and why your personal information is used, so we are responsible for it (its "controller").
Our Privacy Officer is responsible for this policy and for how we handle personal information, including as the person in charge of the protection of personal information under Quebec law. Write to them at privacy@getkewa.com or at:
Kewa Technologies, Inc.131 Continental Dr, Suite 305
Newark, DE 19713
United States
+1 (929) 312-7801
What we collect
Information you give us
- Phone number, to create your account and sign you in.
- Email address, to sign you in with a link, to confirm the address, and to tell you about important changes to your account.
- Name and profile photo, so the people in your groups know who you are. You choose the photo from your photo library; we resize it. Kewa does not use your camera for it.
- Payment details you add so people can pay you. Depending on the method: a bank or wallet account number (Nigeria); a mobile money number or bank account (Ghana); a sort code, account number and account holder name (UK); a Zelle email or phone number and name, a Cash App cashtag or a Venmo username (US); an Interac email or phone number and name (Canada). Where a provider can check an account, we also keep the name on the account that it returns, to show people before they pay.
- What you record in Kewa: groups, expenses, payment requests, payments you mark as made or received, and receipt photos if you choose to scan one.
- People you add who don't use Kewa ("guests"): the name you give them and, if you add it, their phone number. Please only add people who expect to hear from you.
- Messages you send us: if you email us for help, we keep your email address and what you write, to reply.
- Waitlist sign-ups: if you join the waitlist on getkewa.com, we keep your name, email address and what you split most, with the time you agreed that we may email you about early access.
Information created as you use Kewa
- A device identifier: a random code the app creates on your phone, so we can recognise a device you have used before when you sign in. Our servers keep only a scrambled (hashed) form of it.
- Your IP address, used to limit repeated sign-in attempts and waitlist sign-ups. We keep it only in hashed form, in records that expire automatically. Our hosting provider also keeps standard request logs.
- Sign-in codes and links, which we store only in hashed form and which expire within minutes to a day.
- Your settings, such as the currency you settle in and your time zone.
- A push token for your device, if you turn on notifications.
What we don't collect
We don't read your contacts or address book. We don't collect your location. We don't use advertising identifiers, analytics, crash reporting or tracking tools, in the app or on this website. We never see the password to your bank or payment app, and we never have access to your money.
How we use it, and why
| Purpose | Information | Legal basis |
|---|---|---|
| Create your account and sign you in | Phone, email, device identifier | Providing the service you asked for (our contract with you) |
| Show your groups who you are and how to pay you | Name, photo, payment details | Our contract with you |
| Work out balances and record payments | What you record in Kewa | Our contract with you |
| Check that an account belongs to the name given, where a provider supports it | Payment details | Our contract with you, and our legitimate interest in stopping payments to the wrong person |
| Keep Kewa secure and stop abuse | Hashed IP address, device identifier, sign-in records | Our legitimate interest in security; legal obligations |
| Send sign-in codes and important account notices | Phone, email | Our contract with you |
| Send notifications you turn on | Push token | Your consent, which you can withdraw in your phone settings |
| Email you about early access, if you join the waitlist | Name, email, what you split most | Your consent, which you can withdraw at any time by emailing privacy@getkewa.com |
| Meet legal obligations and handle disputes | What is needed for the purpose | Legal obligations; legitimate interests |
We do not sell your personal information. We do not share it for targeted or cross-context behavioural advertising, and we do not use it to profile you.
Who can see your information
- People in your groups see your name and photo, the expenses you are part of, and the payment details on a request you send them.
- Guests see only their own request, including your name and the payment details on it.
- Our service providers, listed below, only to run Kewa for us and under contracts that protect your information.
- Authorities, when the law requires it, or when needed to protect people from harm or fraud.
- Kewa staff see waitlist sign-ups, and no one else does.
- A buyer or successor, if Kewa is sold or merged, who must keep to this policy.
Service providers
| Provider | What they do | Since |
|---|---|---|
| Google (Firebase and Google Cloud) | Hosts our database, files, sign-in, servers, this website and the waitlist, and carries our email (Google Workspace), including the note that tells us about a waitlist sign-up. Your data is stored in Belgium. | Now |
| Expo (650 Industries, Inc.) | Builds and updates the Kewa app | Now |
| Twilio | Delivers sign-in codes by SMS and WhatsApp | When phone sign-in launches |
| Meta (WhatsApp) | Carries sign-in codes you ask for on WhatsApp | When phone sign-in launches |
| An email delivery service | Sends sign-in and confirmation emails. We will name it here before it is used. | When email sign-in launches |
| Paystack or Flutterwave | Checks the name on a Nigerian bank or wallet account. We will name the one we use. | When account checks launch |
| An AI image service | Reads the items and totals on receipts you choose to scan. We will name it here before it is used. | When receipt scanning launches |
| Apple and Google | Deliver push notifications to your phone | When notifications launch |
International transfers
Kewa Technologies, Inc. is based in the United States, and we store your information with Google in Belgium. Our service providers may handle it in other countries, including the United States.
When we transfer personal information out of Nigeria, Ghana, the United Kingdom, Canada or another country, we use the safeguards the law there requires, such as contracts that protect it. Before personal information of people in Quebec leaves Quebec, we assess the risks as Quebec law requires. Ask privacy@getkewa.com for details.
How long we keep it
- Your account information: while your account is open.
- When you delete your account: we delete your phone number, email address, photo and payment details, and show "Deleted user" in place of your name. We keep the expenses and payments you shared with others, without your details, because their balances depend on them.
- Sign-in codes and links: until they expire, at most 24 hours.
- Records that limit sign-in attempts and waitlist sign-ups: until they expire automatically.
- Devices you have signed in on: while your account is open.
- Receipt photos: until you delete them or your account.
- Emails you send us: as long as needed to help you.
- Waitlist sign-ups: until we invite you, then 12 months, or sooner if you ask us to remove them.
- Website request logs: kept by our hosting provider for a short time, for security.
We may keep information longer when the law requires it or to settle a dispute.
Your rights
Wherever you live, you can ask us to show you the personal information we hold about you and give you a copy, to correct it, to delete it, and to explain how we use it. Email privacy@getkewa.com from the email address on your account, or tell us the phone number on it. We may ask you to confirm it is you. We reply within one month, and we never charge you or treat you differently for asking.
| Where you live | Your rights include | Where to complain |
|---|---|---|
| Nigeria (Nigeria Data Protection Act 2023) | Access, correction, deletion, restriction, objection, data portability, withdrawing consent, and not being subject to decisions made only by automated means | Nigeria Data Protection Commission |
| Ghana (Data Protection Act 2012) | Access, correction, deletion, and objecting to processing | Data Protection Commission, Ghana |
| United Kingdom (UK GDPR) | Access, correction, deletion, restriction, objection, data portability, and withdrawing consent | Information Commissioner's Office (ICO) |
| Canada (PIPEDA) | Access, correction, and withdrawing consent | Office of the Privacy Commissioner of Canada |
| Quebec (Law 25) | The rights above, plus data portability, de-indexing, and being told about decisions made only by automated means | Commission d'accès à l'information du Québec |
| United States (state privacy laws, such as California, Virginia, Colorado, Connecticut and Texas) | Depending on your state: knowing and accessing, correcting, deleting and porting your information, and opting out of sale, targeted advertising and profiling (Kewa does none of these). If we refuse a request, you can appeal by replying to our answer. | Your state's attorney general, if your appeal is refused |
Security
We protect your information with encryption in transit and at rest, access rules that let each person see only what they should, and hashing for sign-in codes, links and device identifiers. No system is perfectly secure. If a breach puts your information at risk, we will tell you and the regulators as the law requires.
Children
Kewa is for people aged 18 and over. We don't knowingly collect information from anyone under 18. If you think a child has given us information, email privacy@getkewa.com and we will delete it.
This website
getkewa.com uses no cookies, analytics, advertising or tracking tools, and it loads nothing from other websites. Like any website, our hosting provider (Google) records basic request information, such as your IP address, the page and the time, to run and protect the site. The waitlist form sends what you type to our server. It sets no cookie.
Text messages and WhatsApp
We send a sign-in code by SMS or WhatsApp only when you ask for one. Our SMS and WhatsApp Terms explain how it works and how to stop.
No mobile information will be sold or shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be shared with any third parties.
Changes to this policy
If we change this policy, we will update the effective date above. If a change is significant, we will tell you in the app or by email before it takes effect.