This policy explains what personal data FakkaPay collects when you use our app, why we collect it, who we share it with, how long we keep it and the rights you have.
Effective date: 26 September 2026
Who we are and what this policy covers
FakkaPay (“we”, “us”) provides the FakkaPay app: a digital wallet with transfers, bill payments and a virtual card, plus investing in Egyptian stocks, digital gold and investment funds. FakkaPay is available only to people aged 18 or over who live in Egypt.
We decide how and why your personal data is used, so we’re responsible for it under Egypt’s Personal Data Protection Law No. 151 of 2020. This policy covers the app, your conversations with our support team and this website. You can browse this website without giving us any personal information.
The data we collect
We collect personal data from you (when you sign up, verify your identity, pay, invest or contact us), from your phone (device and connection details) and from others involved in your transactions — for example, a bank, Fawry or a biller confirming a payment, an identity-verification provider returning a result, or a user who sends you money or invites you with their referral code.
| Data category | Examples | Why we use it | How long we keep it |
|---|---|---|---|
| Account and contact details | Your name as it appears on your national ID, mobile number, email address and app language; the @username, FakkaPay ID and referral code we create for you | To open and run your account, sign you in, contact you and let people pay you | While your account is open, then the legal retention period |
| Sign-in and security | Your passcode (stored only as a one-way hash), SMS verification codes, security settings and failed sign-in attempts | To confirm it’s you and protect your account | Verification codes: deleted about a day after they expire. The rest: while your account is open, then the legal retention period |
| Device and connection | An ID the app creates for your installation, your phone’s name and operating system, IP address, sign-in times and your list of trusted devices | To keep you signed in, show where your account is signed in and spot unusual activity | Sign-in sessions (with their IP address): deleted when they expire, within 30 days. Device list and sign-up IP address: while your account is open, then the legal retention period |
| Identity verification | Your Egyptian national ID (front and back), a selfie with a liveness check matched to your ID photo, tax registration details for investment income, proof of address, and our review decision | To confirm who you are, meet anti-money-laundering and know-your-customer rules, and set your limits | While your account is open, then the legal retention period |
| Payments and wallet | Balances; top-ups (bank transfer, InstaPay, Fawry or debit card); transfers, the people you pay and your notes; bills and the account, meter or phone number you enter; withdrawals and linked bank accounts; your virtual card; statements you request | To move money as you ask, keep accurate records, show your activity and spending insights, and prevent fraud | While your account is open, then the legal retention period |
| Investments | Orders (instrument, buy or sell, quantity, price and fee), your holdings of stocks, gold and fund units, your portfolio’s value over time, your watchlist and price alerts | To carry out your orders, show your portfolio and send the alerts you set | While your account is open, then the legal retention period |
| Support and messages | Chats with the FakkaPay assistant and our team, emails you send us, notifications we send you and your notification settings | To help you, keep a record of requests and complaints, and keep you informed | While your account is open, then the legal retention period |
| Rewards and referrals | Your tier and points, who invited you or whom you invited, and the status of referral rewards | To run rewards and pay referral rewards | While your account is open, then the legal retention period |
The “legal retention period” is explained in How long we keep your data.
We also record actions our staff take on your account, such as a verification decision or the reason an account was frozen, and some actions you take, such as signing up, changing your profile or viewing your card details.
What stays on your phone
Some information is kept only on your phone: your app settings, the mobile number you last signed in with (to fill in the sign-in screen), and the tokens that keep you signed in, which are stored in your phone’s secure keychain.
What we don’t collect
The app doesn’t ask for access to your location, contacts, photos or microphone. The “Contacts” in Send Money are FakkaPay users you’ve paid before, not your phone’s address book. The app contains no third-party advertising, analytics or tracking tools.
How we use your data and why we’re allowed to
As Law No. 151 of 2020 requires, we use personal data only for a clear, lawful reason:
- To provide FakkaPay — run your account, move money and pay bills as you ask, run your virtual card, carry out investment orders, show your activity and portfolio, email your statements and answer your questions. Reason: performing our agreement with you (our Terms of Use).
- To meet our legal obligations — verify your identity, apply limits, detect and report money laundering, terrorist financing and fraud, keep financial records and answer lawful requests from the authorities. Reason: legal obligation.
- To keep you and FakkaPay safe — alert you to sign-ins from new devices and to security changes, pause sign-in after repeated wrong passcodes, investigate problems and fix errors. Reason: our legitimate interest in protecting your account and our service, and our legal obligations.
- To keep you informed — messages about your transactions, your account’s security and changes to our terms are part of the service. Offers and news are optional: you choose whether to get them in Profile → Notifications. Reason: our agreement with you; your consent for offers and news.
- To run rewards and referrals — award points, set your tier and pay referral rewards. Reason: our agreement with you.
- To use your camera and biometrics — only when you allow it, as described below. Reason: your consent.
We don’t sell your personal data, and we don’t use it for third-party advertising.
Camera and biometrics
Camera
The app uses your camera only to scan FakkaPay payment QR codes, and only after you allow it. The code is read on your phone; no photo or video is recorded or sent to us. We use only what the code contains — a FakkaPay ID, @username, name and any requested amount — to fill in a payment for you to review, and no payment is made until you approve it. You can turn camera access off in your phone’s settings and enter a FakkaPay ID instead.
Face ID and fingerprint
If you turn on biometric sign-in, your phone’s operating system checks your face or fingerprint. FakkaPay never receives or stores your face data or fingerprints — your phone only tells the app whether the check succeeded. The app then uses a secure credential kept in your phone’s keychain to sign you in or approve a payment. You can turn biometric sign-in off in Profile → Security and use your passcode instead.
Who we share your data with
We share personal data only when it’s needed to provide FakkaPay, when the law requires it, or when you ask us to:
- Other FakkaPay users. When someone finds you by your @username, FakkaPay ID or mobile number, or scans your QR code, they see your name, @username and FakkaPay ID so they can check they’re paying the right person. When you send money, the recipient sees your name and any note you add. When you share a payment link, QR code or receipt, you choose who gets it.
- Service providers working on our behalf, such as cloud hosting and database providers, SMS providers that deliver verification codes, email providers that deliver statements and support replies, and identity-verification providers.
- Payment and investment partners needed to do what you ask: banks, InstaPay, Fawry, card payment processors and billers for top-ups, withdrawals, bill payments and card payments, and the partners that execute your investment orders and hold your investments.
- Authorities, such as regulators, courts and law-enforcement agencies, when Egyptian law requires it — including reports required by anti-money-laundering rules.
- A new owner, if FakkaPay’s business is reorganised, merged or sold. They must protect your data as this policy describes.
Everyone we share personal data with must protect it to the same standard as this policy and Egyptian law, and may use it only for the purpose we shared it for.
Transfers outside Egypt
Some service providers, such as cloud hosting providers, may store or process data outside Egypt. If your personal data is transferred outside Egypt, we’ll do so only as Law No. 151 of 2020 allows — to a country with a level of protection at least equal to Egypt’s, and with any licence or permit the law requires — and we’ll protect it with safeguards such as written contracts, encrypted connections and strict access controls.
How long we keep your data
We keep your personal data while your account is open, for as long as we need it to provide FakkaPay.
After your account is closed — whether you delete it or we close it — Egyptian anti-money-laundering and know-your-customer rules require us to keep identity and transaction records for a period after our relationship ends. So we keep your personal data for the period required by Egyptian law (the “legal retention period”). During that time it’s stored securely, only authorised staff can access it, and it isn’t used for anything else. When the period ends, we delete it or anonymise it so it can no longer identify you.
Some technical data is deleted automatically much sooner: SMS verification codes about a day after they expire, payment approvals about an hour after they expire, and sign-in sessions (with the IP address and device details recorded with them) when they expire, at most 30 days after you sign in.
Your rights and how to use them
Under Law No. 151 of 2020, you have the right to:
- Access — know what personal data we hold about you and get a copy.
- Correction — have inaccurate or incomplete data corrected or updated.
- Deletion — ask us to delete your data. We’ll delete what we can; records the law requires us to keep are deleted when the legal retention period ends.
- Objection and restriction — object to how we use your data, or ask us to limit it to specific purposes.
- Withdrawing consent — where we rely on your consent (camera, biometrics, offers and news), withdraw it at any time. This doesn’t affect what we did before.
You can do much of this yourself in the app:
- Update your name, email address and mobile number in Profile → Personal information.
- Choose your notifications in Profile → Notifications.
- Turn biometric sign-in off, or sign out other devices, in Profile → Security.
- Get a copy of your activity by email in Profile → Statement.
- Delete your account in Profile → Security → Delete account — see how account deletion works.
For anything else, email [email protected] from the email address registered on your account. We’ll confirm your identity before acting and reply within the time the law allows. If you’re not satisfied with our answer, you can complain to Egypt’s Personal Data Protection Center.
How we protect your data
- Your passcode. You choose a 6-digit passcode, and easy codes such as 123456 aren’t allowed. We store it only as a one-way hash, so no one at FakkaPay can read it. Sign-in pauses for 15 minutes after five wrong attempts.
- Approval for every money movement. Adding, sending, withdrawing and transferring money, paying bills, placing investment orders and viewing your card details each need a fresh approval with your passcode or biometrics. Each approval works once and expires after 5 minutes.
- Encrypted connections. The app communicates with our servers over encrypted connections.
- Secure storage on your phone. Sign-in tokens are kept in your phone’s secure keychain, short-lived access tokens only in the app’s memory, and sessions expire automatically.
- Alerts and control. We alert you in the app to sign-ins from new devices and to security changes, and you can see and sign out your devices in Profile → Security. Resetting your passcode signs you out everywhere.
- Limited staff access. What our staff can see and do depends on their role, and every change they make to a customer’s account is recorded in an audit log.
No system is completely secure, so please keep your passcode and phone safe. FakkaPay will never ask for your passcode or SMS codes. If you think your account has been compromised, contact us straight away. If a breach affects your personal data, we’ll tell you and the authorities as the law requires.
Children
FakkaPay isn’t for anyone under 18. We don’t knowingly open accounts for, or collect personal data from, people under 18. If we learn that someone under 18 has an account, we’ll close it and handle their data as the law requires. If you think a child has signed up, please tell us.
Changes to this policy
We may update this policy when our services or the law change. We’ll publish the new version on this page with a new effective date and, if the changes are significant, tell you in the app or by email before they take effect.
Contact us
- Privacy questions and requests: [email protected]
- Everything else: [email protected], or chat with us in the app from Profile → Help & support
We’re available every day, 9 AM – 9 PM (Cairo time). For more ways to get help, see our Help & support page.