Privacy Policy

This policy explains what information HisaFlow collects when you use the app or this website, why we collect it, and the choices you have. It is written for the Kenya Data Protection Act, 2019 (the “DPA”).

Who we are

HisaFlow is a business management app for Kenyan small businesses, built and operated in Kenya. For questions about this policy or your data, contact us at privacy@hisaflow.co.ke.

Information we collect

• Account details: your name, email address and phone number, handled by our authentication provider, Clerk, so you can sign in.
• Business data: the products, sales, customers, bookings, invoices and other records you enter into your organization. This belongs to your business.
• Payment data: subscription payments are processed by Paystack. We receive confirmation and a payment reference; we do not store full card numbers or M-Pesa PINs.
• Usage data: basic technical information such as device type and page views, used to keep the service working and improve it.

How we use it

• To provide, operate and secure the HisaFlow service.
• To process subscriptions and send billing and service messages.
• To give you support when you ask for it.
• To understand how the product is used so we can improve it.

Legal basis

We process personal data to perform our contract with you, to comply with legal obligations (for example, tax and accounting records), for our legitimate interest in running and securing the service, and, where required, on the basis of your consent. You can withdraw consent at any time without affecting earlier processing.

Sharing

We do not sell your personal data. We share it only with service providers that help us run HisaFlow, under contract and only as needed: Clerk (authentication), Paystack (payments), and the hosting and infrastructure providers that run the service. We may disclose data where the law requires it.

Retention

We keep business records for as long as your organization is active and for any period required by law afterwards. When you close your account, we delete or anonymise personal data unless we are legally required to keep it.

Your rights

Under the DPA you can ask to access, correct or delete your personal data, object to or restrict certain processing, and request a copy of data you provided. Contact us and we will respond within the time the law allows. You may also complain to the Office of the Data Protection Commissioner.

Security

We use access controls so staff only see the organization they belong to, encrypt data in transit, and limit who inside HisaFlow can access production systems. No system is perfectly secure, but we work to protect your data and to tell you about significant incidents.

Changes to this policy

If we make material changes we will update the date above and, where appropriate, tell you in the app or by email.

This is a plain-language summary prepared for review. It does not replace legal advice, and the wording is subject to review by qualified counsel before launch.