Forexia

Legal

Privacy Policy

Last updated 9 August 2026 · Forexia is operated by Northbit Labs

Forexia is a custodial foreign-exchange marketplace licensed to operate in Kenya. This policy explains what information the Forexia mobile app collects, why, and how it's handled.

Who we are

Forexia is operated by Northbit Labs Ltd ("Forexia", "we", "us"), registered in Kenya at Number 8, Nosim Road, Kiserian, Kajiado North District, Kenya (P.O. Box 00511, Ongata Rongai, Kenya).

Information we collect

  • Account information — Full name, phone number, email address, and a hashed PIN. The PIN itself is never stored in plain text; biometric unlock, if enabled, is handled entirely on-device by iOS/Android and never transmitted to us.
  • Identity verification (KYC) — To comply with Kenyan financial regulations, we verify your identity through our KYC provider, Didit, before you can transact. This includes a government ID (National ID or passport) and a live selfie, processed by Didit on our behalf.
  • Financial and transaction data — Wallet balances, deal history (currency pairs, locked rates, amounts), and payment metadata for funding methods you use (M-Pesa, Pesalink, card). We do not store full card numbers; card payments are processed by our payment processor and only a reference/last-4 is retained on our side.
  • Device and usage information — Device type, OS version, app version, and crash/diagnostic logs, used to keep the app working and secure.

How we use this information

We do not sell your personal information, and we do not use your financial or identity data for advertising.

  • To verify your identity and meet Kenyan KYC/AML regulatory requirements.
  • To open and operate your wallet, process deals, and settle funds.
  • To detect and prevent fraud, account takeover, and money-laundering risk.
  • To provide customer support.
  • To meet our own record-keeping obligations under financial regulation.

Third parties we share data with

  • Didit — Identity verification (KYC). Your ID document and selfie are shared with Didit to confirm your identity; see Didit's own privacy policy for how they handle that data during verification.
  • Payment providers — M-Pesa (Safaricom), Pesalink, and our card payment processor, to move money in and out of your wallet.
  • We may disclose information where required by law, regulation, or a valid order from the Central Bank of Kenya or another competent authority.

Data retention

We retain account, KYC, and transaction records for as long as your account is active and for seven (7) years afterward, in line with Kenyan financial record-keeping regulations. You can request deletion of your account; identity/transaction records within the 7-year retention period cannot be deleted before it expires.

Your rights

Under the Data Protection Act, 2019 (Kenya), you have the right to access, correct, or request deletion of your personal data (subject to the retention limits above), and to lodge a complaint with the Office of the Data Protection Commissioner. To exercise these rights, contact us at support@northbit.co.ke.

Security

Your PIN is never stored in plain text. Money-moving actions require a fresh PIN/biometric confirmation. We hold customer funds in escrow, segregated from operating funds, until a deal is fulfilled.

Children

Forexia is not directed at, and may not be used by, anyone under 18.

Changes to this policy

We'll update the "Last updated" date above when this policy changes, and notify you in-app of material changes.

Contact us

Questions about this policy or your data can be sent to support@northbit.co.ke. Northbit Labs Ltd, Number 8, Nosim Road, Kiserian, Kajiado North District, Kenya (P.O. Box 00511, Ongata Rongai, Kenya).