Privacy Policy

InuaBiz (“InuaBiz”, “we”, “us”, or “our”) operates the micro-POS and shop operations platform available at https://inuabiz.co.ke, including our marketing site, the vendor till, optional Companion APK, subscription billing, support tools and public receipt verification.

This Privacy Policy explains how we collect, use, store, share and protect personal data when you visit our website, create a shop account, use the till, install Companion, contact us or otherwise interact with InuaBiz.

Questions about this policy or data protection rights: hello@inuabiz.co.ke. We operate from Nairobi, Kenya.

InuaBiz acts as the data controller for personal data relating to account holders — shop owners, invited staff and operators who register for or log in to InuaBiz.

When you use InuaBiz to record information about your customers, suppliers, debtors or other third parties (for example names, phones, credit balances, invoices or sale lines), you are the data controller for that information. InuaBiz processes it on your instructions solely to provide the service described in our Terms of Service.

You are responsible for ensuring you have a lawful basis to collect and process your customers’ and suppliers’ data, and for providing them with appropriate privacy notices.

We may collect the following categories depending on how you use InuaBiz:

• Account and identity: name, shop name, email, phone, shop category, GPS pin, password (stored as a secure hash) and profile details you provide during onboarding or settings.
• Authentication and security: login sessions, device and browser metadata needed to keep sessions secure, and audit records of sensitive admin actions where applicable.
• Business and till settings: payment destinations (personal M-Pesa, Pochi, till or paybill), invoice branding, notification preferences and shop configuration.
• Operational data you enter: products, stock, sales, credit (kukopesha) ledgers, customer and supplier contacts, invoices, receipts and related notes.
• Payment and billing: subscription amounts in Kenyan Shillings, M-Pesa phone numbers used for payment prompts, mobile-money transaction references, payment confirmation metadata and billing history. We do not store full payment card numbers.
• Companion / SMS matching: device pairing tokens, last-seen timestamps and structured fields extracted from inbound M-Pesa received SMS on a paired handset (amount, confirmation code, sender/payee identifiers needed to match an open sale). See section 4.
• Support and communications: contact form messages, support tickets, newsletter subscriptions, in-app notifications and optional email/SMS/WhatsApp/push delivery preferences.
• AI interactions: prompts and responses for vendor insights, website chatbot or support tools when those features are enabled, plus related usage logs.
• Analytics and diagnostics: page views, product usage events and error or performance telemetry when monitoring tools are enabled, to improve reliability and the product.

The optional InuaBiz Companion APK runs on the business phone that receives shop M-Pesa SMS (personal, Pochi, till or paybill). It is not distributed through Google Play Store. After you pair a device token from Settings, Companion reads inbound M-Pesa received SMS so we can match amount and confirmation code to an open sale on the till. If the handset was offline or a sale was opened after the SMS arrived, Companion may re-read recent M-Pesa inbox messages on that phone and we may rematch stored confirmation SMS to still waiting sales.

SMS content is processed only for payment matching and related reliability. You can revoke a device token in Settings at any time; after revocation the paired handset should stop sending new SMS-derived events to your shop.

Matching may also occur via manual receipt codes you enter, or via till/paybill payment notifications from the mobile-money network where configured. We work to keep matching accurate; network delay, duplicate SMS or missed messages can still occur.

We use personal data to:

• Provide, operate and maintain the till, inventory, credit ledger, invoices and multi-shop features.
• Match customer M-Pesa payments to sales and surface confirmation on the till.
• Authenticate users, manage shops and staff access, and protect against unauthorised use.
• Process subscription trials, renewals, M-Pesa payment prompts, optional standing-order renewals and billing notices.
• Send operational messages such as daily till email, stock alerts, trial and payment notices, according to your preferences and plan.
• Respond to support requests and improve support quality (including AI-assisted tools where enabled).
• Analyse product usage and reliability, and improve InuaBiz.
• Comply with applicable law and enforce our Terms of Service.

We do not sell your personal data.

Under the Kenya Data Protection Act, 2019, we rely on the following bases depending on the activity:

• Contract: processing necessary to provide the service you signed up for, including account management, till operations, payment matching and subscription billing.
• Consent: where you opt into marketing communications, install Companion and grant SMS access, enable push notifications, or submit optional forms beyond what is required to run the core till.
• Legitimate interests: security monitoring, fraud prevention, service improvement and internal reporting, balanced against your rights.
• Legal obligation: retaining records required for tax, accounting, dispute resolution or regulatory purposes.

You may withdraw consent for marketing or optional features at any time without affecting processing required to provide the core service. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya if you believe your data protection rights have been violated.

We use cookies and browser storage to operate InuaBiz and improve your experience:

• Authentication / session storage: keeps you signed in to the till securely.
• Preferences: UI state such as sidebar open/closed, theme or demo category choices stored in cookies or localStorage.
• Offline till: temporary outbox and cache data on your device so sales can sync when connectivity returns.
• Analytics / diagnostics: when enabled, our monitoring tools may set their own cookies or collect usage and error data under their respective policies.

We share personal data with trusted processors only as needed to operate InuaBiz. For quieter operational security we describe them by role rather than brand on this page:

• Cloud application host — authentication, database, file storage and server-side functions.
• Subscription payment processor — M-Pesa payment prompts and confirmations when you pay InuaBiz for a plan or extra shop.
• Mobile-money network — M-Pesa payment matching, digital invoices into a buyer’s M-Pesa menu, optional standing-order renewals and related payment confirmations where configured.
• Email delivery provider — transactional and operational email.
• AI processing providers — optional insights, website chatbot and support features; relevant prompts or context may be transmitted for processing.
• Analytics and error-monitoring providers — product usage and reliability telemetry when enabled.
• Map / location providers — map views used in internal operations tooling where enabled.
• Website hosting / CDN — delivery of the public site and app assets.

We require processors to handle data only on our instructions and in line with applicable data protection requirements. A current list of named processors is available on request from hello@inuabiz.co.ke.

Some providers may process data outside Kenya, including in the European Union, United States or other jurisdictions. Where data is transferred internationally, we take steps to ensure appropriate safeguards are in place, such as contractual protections with vendors.

We retain personal data only as long as needed for the purposes in this policy:

• Account and shop data: for the life of the subscription or trial and a reasonable period afterward to allow export, resolve disputes or meet legal obligations.
• Sales, stock, credit and invoices: retained with the shop record while the account is active and as required for accounting or disputes.
• Payment and billing records: as required for tax, accounting and payment dispute resolution.
• Companion device tokens: until you revoke them or the account is closed.
• Support tickets and contact messages: for as long as needed to resolve the request and improve operations.
• Security and diagnostic logs: for a limited period unless a longer retention is needed for an investigation.

When data is no longer needed, we delete or anonymise it in line with our internal practices. You may cancel Standard from Billing; we keep records as long as the law or a dispute requires.

We implement technical and organisational measures designed to protect personal data, including encrypted transport (HTTPS), access controls that isolate shop data, hashed credentials, isolated backups, and device-token controls for Companion. Sensitive payment and integration credentials are handled on our servers — not exposed in the shop UI.

No internet service is 100% secure. You are responsible for PIN and login hygiene on shop phones, for who you invite as staff, and for notifying us promptly of suspected unauthorised access.

Subject to applicable law, you may request access to, correction of, or deletion of your personal data; object to or restrict certain processing; withdraw consent where processing is consent-based; and receive a copy of your data in a portable format where technically feasible.

To make a request, email hello@inuabiz.co.ke with enough detail for us to verify your identity and locate your shop. We will respond within a reasonable timeframe as required by law.

If you are a merchant processing your customers’ data through InuaBiz, requests from those customers should generally be directed to you as the data controller. We will assist you where required by law.

InuaBiz is a business platform and is not directed at individuals under 18. We do not knowingly collect personal data from children. If you believe we have collected a child’s data in error, contact us and we will take steps to delete it.

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will reflect the latest version. Material changes may also be communicated by email or in-app notice. Continued use of InuaBiz after changes take effect constitutes acceptance of the updated policy.

Privacy questions: hello@inuabiz.co.ke or use the Contact page. We aim to reply the same business day.

This Privacy Policy is provided for transparency and operational purposes. It does not constitute legal advice. We recommend that you obtain independent legal review, including regarding ODPC registration and your own customer privacy notices, before relying on this document for formal compliance purposes.