Privacy Policy

1. The two roles we play

For information about you and your business — your name, email, restaurant details, billing records — we are the data controller. We decide how it is used, and this policy explains that.

For information you record about your own customers — for example a customer's name and phone number against a credit sale — you are the data controller and we are your data processor. We hold that information on your behalf and act on your instructions. If you are a customer of a restaurant and want to know how your details are used, please contact that restaurant directly; we will support them in answering you.

2. Information we collect

Account and business information: your full name, email address, phone number, role, restaurant name and branch name.

Billing information: the M-Pesa number used for payment, transaction references and receipts, subscription status and payment history. We never receive or store your M-Pesa PIN — you enter it on your own handset.

Operational information you enter: menu items and prices, orders, payments recorded against orders, end-of-day figures, and customer credit records (customer name, phone number, amount and due date).

Technical information: IP address, device and app version, timestamps, error reports, and security logs such as sign-in attempts and administrative actions.

Support communications: messages you send us by email or WhatsApp and our replies.

3. Why we use it, and our legal basis

• To provide the Service and your account — necessary to perform our contract with you.
• To take payment and manage your Subscription, including sending payment prompts and receipts — necessary to perform our contract.
• To provide support you request — necessary to perform our contract.
• To keep the Service secure, prevent fraud and abuse, and investigate incidents — our legitimate interest in protecting users, and yours.
• To meet tax, accounting and other legal obligations — compliance with a legal obligation.
• To improve the Service using aggregated or anonymised usage information — our legitimate interest, using data that cannot identify you.
• To send you service messages (billing notices, security alerts, material changes). These are not marketing and you cannot opt out of them while you hold an account.
• To send optional product news, only if you have asked for it — consent, withdrawable at any time.

4. Who we share it with

We do not sell personal information, and we do not share it for advertising.

We share only what is necessary with:

• Safaricom PLC, to process M-Pesa payments through the Daraja platform.
• Our hosting and infrastructure providers, who store and run the Service on our behalf.
• Our email delivery provider, to send account and billing emails.
• Professional advisers such as accountants and lawyers, where needed and under a duty of confidence.
• Regulators, law enforcement or courts, where we are legally required to disclose.
• A buyer or successor, if the business is sold or reorganised. We would tell you before your information became subject to a different privacy policy.

Every provider acting on our behalf is bound to use the information only for the purposes we specify.

5. Where your information is held

The Service is hosted on infrastructure that may be located outside Kenya.

Where personal information is transferred out of Kenya, we take the steps the Data Protection Act, 2019 requires — including satisfying ourselves that the receiving country or provider offers adequate protection, and putting appropriate contractual safeguards in place.

6. How long we keep it

Account and operational data: for as long as your account is active.

After you close or delete your account: deleted within thirty (30) days, except the records described below.

After suspension for non-payment: retained for 90 days so you can restore access, then eligible for permanent deletion.

Financial and transaction records: kept for five (5) years, as required by Kenyan tax and accounting law.

Security and audit logs: kept for five (5) months, then deleted.

Anonymised statistics: kept indefinitely, as they cannot identify anyone.

7. How we protect it

• All traffic between the app and our servers is encrypted in transit.
• Passwords are stored only as salted hashes; nobody at Karibu POS can read your password.
• Each restaurant's data is separated, and requests are checked so one restaurant cannot reach another's records.
• Sign-in attempts are rate limited and accounts lock temporarily after repeated failures.
• Administrative access is restricted, and administrative actions are written to an audit log.

No system is perfectly secure. If a breach occurs that is likely to cause you harm, we will notify you and the Office of the Data Protection Commissioner as the Data Protection Act, 2019 requires.

8. Your rights

Under the Data Protection Act, 2019 you have the right to:

• be told how your personal data is being used;
• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data deleted, where there is no good reason for us to keep it;
• object to processing based on our legitimate interests;
• ask us to restrict processing while a concern is resolved;
• receive your data in a portable format, or have it transferred where technically feasible;
• withdraw consent at any time, where we rely on consent.

To exercise any of these, email karibupos@gmail.com. We will respond within the period the law allows, and we may ask you to verify your identity first.

If you are unhappy with our response, you may complain to the Office of the Data Protection Commissioner of Kenya.

9. Automated decisions

We do not make decisions about you by purely automated means that produce legal or similarly significant effects. Suspension for non-payment follows the billing rules set out in our Terms, and you can always reach a person at karibupos@gmail.com.

10. Children

Karibu POS is a business tool and is not intended for anyone under 18. We do not knowingly collect information from children. If you believe a child has provided us information, contact karibupos@gmail.com and we will delete it.

11. Cookies and tracking

We do not use advertising cookies, and we do not track you across other websites.

We use Vercel Web Analytics to count page views and understand which screens are used. It does not use cookies and does not build a profile of you or follow you between sites. It records the page visited, and coarse technical details such as country, browser and device type. Before any page address is sent, we remove everything after the '?' — so links that carry a one-time code, such as an email confirmation link, are never included.

We store a session token on your device so you stay signed in, and we keep technical logs as described above.

12. Changes to this policy

We may update this policy. If a change materially affects how we handle your information, we will notify you by email or in the app before it takes effect.

The effective date at the top shows when this version took effect.

13. Contact us

Karibu Pos

General support: karibupos@gmail.com