Privacy Policy

1. Information We Collect

When you register for a SmartRetail account or use our POS system, we collect the following categories of information:

• Organization & SME Profile: Company name, KRA PIN, physical store address, contact phone numbers, and subscription tier preferences.
• User Credentials: Staff names, business email addresses, encrypted password hashes (bcrypt salted), and assigned system roles (Admin, Manager, Cashier).
• Store Operational Data: Product inventory counts, barcode SKUs, wholesale/retail prices, supplier invoices, shift register logs, and sales transaction history.
• M-Pesa & Payment Information: Payment reference codes, transaction timestamps, and masked phone numbers processed via Safaricom M-Pesa Daraja APIs. We do not store raw mobile banking PINs.
• Technical Telemetry: IP addresses, browser agent strings, desktop OS versions, and local database sync timestamps.

2. How We Use Your Information

We process your business and operational data strictly to fulfill our services to you:

3. Data Sharing & Third-Party Processors

SmartRetail does not sell, rent, or trade SME business data to advertisers. Data is shared only with trusted infrastructure providers required to deliver our service:

• Safaricom PLC (M-Pesa API): For processing customer M-Pesa till/paybill transactions.
• Stripe & Paystack: For processing debit/credit card subscription billing.
• Cloud Database Hosting: Encrypted PostgreSQL databases hosted in secure Tier-3 data centers.

4. Your Rights Under Kenya Law

Under the Kenya Data Protection Act 2019, you have the right to request access to your stored business records, export your complete inventory catalog, correct inaccurate details, or request account deletion upon subscription termination.