Cookie Policy

1. What Are Cookies?

Cookies are small text files placed on your device (computer, tablet, or smartphone) when you visit a website or web application. They allow the application to remember your actions and preferences over a period of time, so you do not have to re-enter information every time you visit or navigate between pages. Cookies are not programs — they cannot execute code or deliver viruses. ChamaCore uses cookies solely to keep the Platform functional and secure.

2. Types of Cookies We Use

ChamaCore uses only two categories of cookies — both strictly necessary for the Platform to function:

• Session Cookies: Temporary cookies that exist only while your browser session is active. They are automatically deleted when you close your browser. ChamaCore uses session cookies to maintain your authenticated state as you navigate between different modules (e.g. moving from the Member Register to the Loan Management dashboard without being logged out).
• Persistent Cookies: Cookies that remain on your device for a defined period after your session ends or until you manually delete them. ChamaCore uses persistent cookies only to remember your interface preferences (e.g. theme settings, table column configurations) so the Platform loads in your preferred state on your next visit. These cookies contain no personal financial data.

3. Cookies Set by ChamaCore

The following cookies are set directly by the ChamaCore platform:

• __cc_session — Purpose: Maintains your authenticated login session. Type: Session cookie. Duration: Deleted on browser close. Contains: An encrypted session token — no personal data. Essential: Yes.
• __cc_csrf — Purpose: Cross-Site Request Forgery (CSRF) protection. Validates that form submissions and M-Pesa configuration requests originate from your authenticated session and not from a malicious third-party site. Type: Session cookie. Duration: Deleted on browser close. Essential: Yes.
• __cc_prefs — Purpose: Stores your UI preferences including table view settings, date format selection, and dark/light mode. Type: Persistent cookie. Duration: 90 days. Contains: Anonymised preference identifiers only — no personal or financial data. Essential: No, but Platform experience degrades without it.

4. Third-Party Cookies

ChamaCore does not use third-party advertising cookies, social media tracking pixels, or any analytics cookies that share data with external marketing platforms. Specifically:

• No Google Analytics, Google Ads, Facebook Pixel, or similar advertising technology cookies are present on the Platform.
• No cookie-based retargeting or behavioural advertising takes place on ChamaCore.
• If the Platform links to external resources (e.g. Safaricom's M-Pesa portal, SASRA's regulatory portal), those external sites may set their own cookies governed by their own cookie policies. ChamaCore has no control over these.

5. Legal Basis for Using Cookies

ChamaCore relies on the following legal bases for cookie use under the Kenya Data Protection Act 2019 and the Computer Misuse and Cybercrimes Act 2018:

• Strictly Necessary Cookies (__cc_session, __cc_csrf): Used on the basis of contractual necessity — these cookies are essential to provide the service you subscribed to. No consent is required, and they cannot be disabled without rendering the Platform non-functional.
• Preference Cookies (__cc_prefs): Used on the basis of your implied consent when you configure your Platform preferences. You may clear these cookies at any time using your browser settings without losing Platform access.

6. Managing and Disabling Cookies

You can control cookies at the browser level. The following links provide guidance for major browsers:

• Google Chrome: Settings → Privacy and Security → Cookies and other site data.
• Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data.
• Microsoft Edge: Settings → Cookies and site permissions.
• Safari (macOS/iOS): Preferences → Privacy → Manage Website Data.

7. Impact of Disabling Cookies

If you disable or block cookies for the ChamaCore Platform, the following impacts will occur:

• Blocking __cc_session: You will not be able to log in or maintain an authenticated session. The Platform will be inaccessible.
• Blocking __cc_csrf: Form submissions — including M-Pesa paybill configurations, member additions, and loan approvals — will be rejected as a security measure. You will be unable to perform any write operations.
• Blocking __cc_prefs: The Platform will revert to default display settings on each visit. Your preference configurations will not persist. All core functionality remains available.
• ChamaCore recommends that you allowlist chamacore.co.ke in your browser's cookie settings to ensure full Platform functionality.

8. Browser Fingerprinting and Local Storage

ChamaCore does not use browser fingerprinting, canvas fingerprinting, or any form of supercookies as an alternative tracking mechanism. localStorage is used solely to persist non-sensitive UI state (e.g. whether a sidebar is collapsed) and contains no personal or financial data. This data never leaves your device and is not transmitted to ChamaCore servers.

9. Changes to This Cookie Policy

We may update this Cookie Policy if we change the cookies we use or if regulatory requirements change. Updates will be reflected by a revised "Last updated" date on this page. Material changes will be communicated via in-platform notification.

10. Contact

For questions about cookies or this policy, contact us at privacy@chamacore.co.ke.