Terms of Service

These Terms of Service ("Terms") are a legal agreement between you ("you", "the merchant") and Moses Mrima Mbanga, an individual based in Kenya who operates the service under the name "paylod" ("paylod", "we", "us", "our"), and they govern your access to and use of the paylod platform, dashboard, API, SDKs, MCP server, and related services (together, the "Service"). paylod is run by a single individual operator, not a registered company. By creating an account or using the Service, you agree to these Terms. If you do not agree, do not use the Service.

Please read these Terms together with our Privacy & Data Protection Policy.

1. What paylod is

paylod is a hosted Backend-as-a-Service for Safaricom's M-Pesa Daraja API. You bring your own Safaricom shortcode (Paybill or Till) and your own Daraja credentials; paylod hosts the Daraja callback, refreshes your OAuth token, decodes result codes, and delivers you a signed, idempotent webhook, so that a single API request can trigger an STK Push and confirm the payment. paylod is a developer tool that sits between you and Daraja — it is not a bank, a payment service provider, a deposit-taker, or a money-remittance business.

2. Eligibility and your account

To use the Service you must be at least 18 years old and able to enter a binding contract, and you must operate a lawful business that is eligible to hold a Safaricom shortcode and Daraja credentials. You are responsible for the accuracy of the information you give us, for all activity under your account, and for the acts of every team member you invite. Keep your login credentials confidential and tell us promptly at [email protected] if you suspect any unauthorised use.

3. Your Daraja credentials and your relationship with Safaricom

The Service works with your own Safaricom account. You are solely responsible for:

• obtaining, maintaining, and complying with the terms of your Safaricom shortcode and Daraja credentials (consumer key, consumer secret, passkey, initiator credentials);
• your entire relationship with Safaricom, including any Safaricom fees, KYC, go-live approval, and compliance obligations; and
• the accuracy and lawful use of the credentials you store with us.

Safaricom's own terms place responsibility for the security and use of Daraja credentials on the account holder. That responsibility remains yours. paylod encrypts your credentials at rest and stores them write-only (no paylod tool or endpoint can read them back), but we are not a party to, and cannot control, your agreement with Safaricom, and we are not responsible for Safaricom's availability, decisions, fees, or acts.

4. paylod never takes custody of your funds

paylod does not hold, receive, control, or move your money. Funds settle directly between the payer and your own Safaricom shortcode. paylod initiates and reports on payment requests using your credentials, but at no point does money pass through, or come into the custody of, paylod. You are responsible for reconciling settlement against your Safaricom records. Because we never take custody of funds, paylod does not provide, and is not responsible for, settlement, refunds, chargebacks, or the movement of money — those are handled through Safaricom and your own systems.

5. Sandbox and live environments

The Service offers a sandbox environment for testing (using Daraja's sandbox) and a live environment for real payments. Sandbox is for development only and may return simulated results. You are responsible for testing your integration in sandbox before going live, and for the correctness of your live integration — including keeping the payment amount on your own server, as described in our security guidance.

6. API keys and security

We issue API keys that authenticate you, the merchant. Keys are secrets: keep mp_live_… and mp_test_… keys server-side only and never embed them in a browser, mobile app, or other client. You are responsible for all activity carried out with your keys, your callback URL, and your mint tokens. If a key is compromised, revoke it in the dashboard and issue a new one. You agree to follow our published security guidance; failure to do so — for example, letting a client control both the key and the payment amount — is at your own risk.

7. Acceptable use

You agree not to, and not to permit anyone to:

• use the Service for any unlawful, fraudulent, or deceptive purpose, or for any transaction that breaches Safaricom's terms or Kenyan law;
• use the Service for money laundering, terrorism financing, or any sanctioned or prohibited activity;
• process payments for goods or services you are not lawfully entitled to sell;
• probe, scan, overload, or attempt to breach the security or integrity of the Service, or circumvent rate limits;
• reverse engineer, resell, or provide the Service to third parties except as expressly permitted;
• upload special-category personal data, or any personal data you are not entitled to process, through account reference or metadata fields; or
• infringe the intellectual property or other rights of paylod or any third party.

We may investigate suspected violations and cooperate with law enforcement.

8. Fees — free during early access

The Service is currently offered free of charge as part of an early-access programme. There are no paylod fees for use of the Service at this time. (Safaricom's own charges, if any, are separate and remain your responsibility.)

We reserve the right to introduce fees in future. If we do, we will give you at least 30 days' notice by email or in-product before any charges begin, and you may stop using the Service before they take effect. Continuing to use the Service after fees take effect means you accept them.

9. No affiliation with Safaricom

M-Pesa and Daraja are trademarks of Safaricom PLC. paylod is an independent developer tool and is not affiliated with, endorsed by, sponsored by, or in partnership with Safaricom PLC. References to M-Pesa, Daraja, or Safaricom are for identification and interoperability only. Your use of M-Pesa and Daraja is governed by your own agreement with Safaricom.

10. Data protection

Our handling of personal data is described in our Privacy & Data Protection Policy. Where you use the Service to process your own customers' personal data, you are the data controller and paylod acts as your data processor, governed by a Data Processing Agreement. You are responsible for having a lawful basis to process your customers' data and for meeting your own obligations under the Data Protection Act, 2019.

11. Service availability and warranties

We work to keep the Service reliable, but we provide it "as is" and "as available", without warranties of any kind, whether express or implied, including any implied warranties of merchantability, fitness for a particular purpose, non-infringement, uninterrupted availability, or that the Service will be error-free. We do not warrant the availability, accuracy, or performance of the Daraja API or any third-party service, and we are not responsible for delays, failures, downtime, or incorrect results originating from Safaricom, AWS, Cloudflare, or any network between you and them.

12. Limitation of liability

To the maximum extent permitted by law:

• paylod will not be liable for any indirect, incidental, special, consequential, or punitive damages, or for any loss of profits, revenue, goodwill, data, or business, arising out of or relating to the Service, even if we were advised of the possibility.
• Because paylod never takes custody of funds, we are not liable for any loss of, or failure to settle, any payment, or for any dispute between you and a payer, or between you and Safaricom.
• Our total aggregate liability arising out of or relating to the Service will not exceed the greater of (a) the total fees you paid us for the Service in the 12 months before the event giving rise to the claim, or (b) KES 10,000. While the Service is free, fees paid to paylod are zero.

Nothing in these Terms excludes liability that cannot be excluded under Kenyan law.

13. Indemnity

You agree to indemnify and hold harmless paylod and its operator, and anyone acting on its behalf, from any claim, loss, liability, or expense (including reasonable legal fees) arising out of your use of the Service, your breach of these Terms, your violation of any law or of any third party's rights (including your customers' or Safaricom's), or your handling of personal data as a controller.

14. Suspension and termination

You may stop using the Service and close your account at any time. We may suspend or terminate your access, with or without notice, if you breach these Terms, if we reasonably suspect fraud, abuse, or a security or legal risk, or if required by Safaricom or by law. On termination, your right to use the Service ends; sections that by their nature should survive (including fees accrued, disclaimers, limitation of liability, indemnity, and governing law) will survive. We will handle any personal data on termination as described in the Privacy Policy and any Data Processing Agreement.

15. Changes to these Terms

We may update these Terms from time to time. When we make material changes, we will update the effective date at the top of the page and, where appropriate, notify you. Your continued use of the Service after a change takes effect means you accept the updated Terms.

16. Governing law and disputes

These Terms are governed by the laws of the Republic of Kenya, and you submit to the exclusive jurisdiction of the courts of Kenya for any dispute arising out of or relating to them. Before starting formal proceedings, you agree to contact us at [email protected] so we can try to resolve the matter in good faith.

17. Contact

• Support, legal and privacy: [email protected] (single contact for all enquiries)
• Operator: Moses Mrima Mbanga, an individual based in Kenya, operating the Service under the name "paylod". paylod is not a registered company and has no registered office; please reach us by email.