Hebua — Terms & Conditions

1. Who We Are

Hebua is a personal finance tracking application developed and operated by Kife ("the Developer", "we", "us", "our"), an independent software developer based in Nairobi, Kenya.

Hebua is not a bank, financial institution, payment service provider, loan app, or regulated financial entity. We do not hold, move, lend, or invest your money. We only help you track it.

Contact: Email: support@hebua.co.ke | Website: hebua.app / hebua.co.ke | Location: Nairobi, Kenya

2. Acceptance of Terms

By doing any of the following, you confirm you have read, understood, and agreed to these Terms and Conditions in full:

• Downloading or installing the Hebua app
• Creating a Hebua account
• Tapping "I Agree" on the in-app Terms popup
• Using any feature of the app, even without an account

These Terms apply to all users of Hebua across Kenya, Uganda, Tanzania, Rwanda, and any other country where the app is accessed. If you use Hebua on behalf of a business, you confirm you have authority to bind that entity to these Terms.

3. Eligibility

You must be at least 18 years old to use Hebua. By agreeing to these Terms, you confirm that you are 18 or older. We do not knowingly collect data from users under 18. If we discover a user is under 18, we will terminate their account and delete their data.

4. What Hebua Does

Hebua reads financial transaction SMS messages delivered to your device by M-PESA, Airtel Money, T-Kash, and Kenyan banks and Saccos. It parses these messages to extract transaction amount, direction (credit or debit), counterparty, balance (where available), reference, and date/time.

Parsed data is shown inside the app as a personal financial dashboard — spending history, budgets, insights, and balance summaries. You can also add transactions manually or paste SMS text into the Smart Parser (all plans).

Hebua does not:

• Send money on your behalf
• Access your mobile money PIN, passwords, or banking credentials
• Read your bank app or other apps on your device
• Fetch bank data from the internet on your behalf
• Execute any transactions

5. SMS Permission — How We Use It

On Android, Hebua requires the READ_SMS permission as its core function for automatic transaction capture (Pro and Premium plans). Without SMS permission, auto-capture cannot run; manual entry and Smart Parser remain available on all plans.

We use SMS access exclusively to:

• Detect incoming transaction SMS from known financial senders (M-PESA, Airtel Money, T-Kash, banks, Saccos)
• Parse financial content (amount, balance, counterparty, reference) on your device
• Store extracted transaction data locally and, if you sign in, in your secure cloud account

We do not:

• Read personal or non-financial SMS messages
• Upload or transmit raw SMS text to external servers
• Share SMS content with third parties
• Use SMS data for advertising, profiling, loans, or marketing
• Sell your personal data

You grant SMS permission explicitly and can turn off auto-capture anytime in Settings. See our Privacy Policy for full details. This usage complies with Google Play's SMS policy and Kenya's Data Protection Act, 2019.

6. Data We Collect

Data you provide: Name, email, app preferences, subscription info (processed by Paystack/IntaSend — we do not store card numbers).

Data captured automatically: Parsed transaction fields from financial SMS, anonymized usage analytics, device type and OS version (for crash reporting).

We never collect: Raw SMS text, PINs or banking passwords, location, contacts, call logs, or biometric data. Full details are in our Privacy Policy.

7. How We Store and Protect Your Data

Transaction data is stored first on your device. If you do not enable cloud sync, your data never leaves your device.

Cloud sync (Pro/Premium, when signed in) uses Supabase with TLS encryption in transit and AES-256 at rest. We never sell or license your data for commercial purposes.

Account deletion: personal data is permanently deleted within 30 days of your deletion request.

8. Your Rights Under Kenya Data Protection Act, 2019

You have rights to be informed, access, rectification, erasure, object, data portability, and withdraw consent. Contact support@hebua.co.ke. We respond within 21 days as required by the DPA. You may also lodge complaints with the Office of the Data Protection Commissioner (ODPC), odpc.go.ke.

9. User Accounts

You must provide accurate information, keep credentials secure, not share your account, and notify us at support@hebua.co.ke if you suspect unauthorized access. We may suspend or terminate accounts that violate these Terms.

10. Subscription Plans and Billing

All upgrades are purchased inside the Hebua app. Monthly and yearly billing only — no lifetime plan.

Payments: Paystack (cards) and IntaSend (M-PESA, Airtel Money). We do not store card details.

Auto-renewal: Subscriptions renew unless cancelled in Settings → Subscription before the billing period ends.

Refunds: All payments are final except technical failures preventing paid features for 7+ consecutive days, or duplicate charges — request within 7 days at support@hebua.co.ke.

Price changes: We give at least 30 days' notice before price changes apply to active subscriptions.

11. Data Accuracy Disclaimer

Hebua parses SMS using pattern matching. We cannot guarantee 100% accuracy for every provider format. Categories are suggestions. Always verify critical financial information against official M-PESA, bank, or mobile money statements. Hebua data is for personal tracking only — not an official financial record.

12. Limitation of Liability

Hebua is a tracking tool — not financial, investment, tax, or legal advice. Do not make significant financial decisions based solely on app data.

To the maximum extent permitted by Kenyan law, our total liability is limited to subscription fees paid in the 3 months preceding a claim. We are not liable for indirect, consequential, or punitive damages, or for third-party outages (Supabase, Paystack, IntaSend).

13. Intellectual Property

All Hebua content, branding, code, and the tagline "Know Your Money. Control Your Destiny." are the exclusive property of the Developer, protected under Kenya's Copyright Act and Industrial Property Act. You receive a limited, non-exclusive, non-transferable license for personal use on your device(s) only.

14. Prohibited Use

You may not use Hebua for fraud, circumvent subscriptions, reverse-engineer the app, introduce malware, scrape data, impersonate others, track another person's finances without consent, or violate applicable law.

15. App Store Terms

Hebua is distributed via Google Play and Apple App Store. Your use is also subject to their terms. These Terms govern your relationship with the Developer; app stores are not parties to this agreement.

16. Updates

We may update the app and these Terms. Material changes: at least 14 days' in-app notice before effect. Continued use constitutes acceptance. If you disagree, stop using the app and delete your account before the effective date.

17. Account Termination

You may delete your account anytime in Settings. We may suspend or terminate accounts for Terms violations, fraud, or legal requirement. Service discontinuation: at least 30 days' notice and pro-rated refund for unused subscription days where applicable.

18. Data Breach Notification

We will notify ODPC within 72 hours and affected users without undue delay in the event of a breach likely to affect your rights.

19. Cross-Border Data Transfers

Transfers outside Kenya comply with Section 48 of Kenya's Data Protection Act. Supabase maintains appropriate safeguards and data processing agreements.

20. Children's Privacy

Hebua is not for users under 18. Contact support@hebua.co.ke if you believe a child has provided data.

21. Governing Law

These Terms are governed by Kenyan law. Disputes: attempt informal resolution for 30 days at support@hebua.co.ke, then exclusive jurisdiction of Nairobi courts.

22. Severability

Invalid provisions are modified or severed; remaining provisions continue in effect.

23. Entire Agreement

These Terms and our Privacy Policy constitute the entire agreement between you and the Developer.

24. Contact Us

Email: support@hebua.co.ke | Website: hebua.app | Response: 2 business days general; 21 days for DPA requests.

Data protection complaints: Office of the Data Protection Commissioner (ODPC), Britam Towers, Nairobi. odpc.go.ke