This Privacy Policy explains how SalesTrack ("SalesTrack", "we", "us", "our") collects, uses, stores and protects information when you use our point-of-sale and business management application (the "Service"), including the SalesTrack web app, our mobile-installable app (PWA), and our public website pages such as shop pages and digital receipts.
SalesTrack is operated as a sole proprietorship based in Nairobi, Kenya, currently in the process of formal business registration. We primarily serve businesses in Kenya, and also serve businesses in Uganda, Tanzania, Ethiopia, Rwanda and other countries. This policy is written to align with Kenya's Data Protection Act, 2019 ("DPA"), and we apply the same standard of care to users regardless of which country they are in.
1. Who this policy applies to
There are two kinds of people whose data we handle, and we treat them differently:
- Shop owners and staff ("Account Users") — people who register for SalesTrack, log in, and use it to run their business. You are a "data controller" of your own shop's data under the DPA; we act as the "data processor" that stores and processes it on your behalf.
- Customers of shop owners ("End Customers") — people who buy from, book appointments with, or interact with a business that uses SalesTrack (for example, by receiving a digital receipt or booking a service). We hold this data on behalf of the shop owner, who is responsible for how it is collected and used.
2. Information we collect
From Account Users (shop owners and staff)
- Name, email address, phone number, business name, business address, business type
- Login credentials (your password is stored encrypted — we cannot see it in plain text)
- Profile photo / avatar, if you choose to upload one
- Business records you create: products, prices, stock levels, sales transactions, expenses, customer records, appointments, staff records, and financial reports
- Payment and subscription information processed via M-Pesa (Safaricom Daraja API) — we receive confirmation of payment and a transaction reference; we do not store your M-Pesa PIN or full account credentials
- Usage data: pages visited within the app, device type, approximate location (country-level, inferred from network), and basic diagnostic logs to help us fix bugs
From End Customers (your customers)
- Name and phone number (collected by the shop owner at point of sale, booking, or via our lead-capture forms)
- Purchase history and appointment history with that specific shop
- Reviews or ratings, where a shop has this feature enabled
From website visitors (before signing up)
- If you fill in a demo request or affiliate application form on our landing page: your name, phone number, business type, town/city, and any notes you provide
What we do not collect: we do not collect your M-Pesa PIN, your bank account credentials, your national ID number, or any biometric data. We do not knowingly collect data from children under 18.
3. How we use your information
| Purpose | Data used |
|---|
| Operate the Service — store your sales, inventory, customers and reports | Account User business records |
| Process subscription payments | M-Pesa transaction confirmation, phone number |
| Send service messages (WhatsApp/SMS) — receipts, appointment reminders, low-stock alerts | Phone numbers, transaction/appointment data |
| Provide AI-generated business insights | Your own shop's sales data only — never shared across shops |
| Respond to support requests | Contact details, account information |
| Follow up on demo or affiliate applications | Lead form details |
| Improve and secure the Service | Usage and diagnostic data |
| Comply with tax law (KRA eTIMS, where enabled) | Sales transaction data |
4. Shop data isolation
Every shop's data is technically isolated from every other shop on SalesTrack. Staff and owners can only see data belonging to their own shop. We do not share one shop's customer list, sales figures, or business data with another shop, a competitor, or any third party for marketing purposes.
5. Who we share information with
We do not sell your data. We share information only with:
- Safaricom (M-Pesa Daraja API) — to process subscription payments and customer transactions where M-Pesa is used as a payment method
- PocketBase / Fly.io (our database host) — where your data is securely stored
- Vercel — our application hosting provider
- Kenya Revenue Authority (KRA eTIMS) — only for shops that have enabled eTIMS tax compliance, and only the transaction data legally required
- WhatsApp (via wa.me links) — when you or your customer choose to send a message; this opens WhatsApp directly and we do not access your WhatsApp account or messages
- Law enforcement or regulators, only if legally required to do so
6. Data storage and security
- Data is encrypted in transit (HTTPS/TLS) and stored on servers operated by our database host
- Passwords are stored using one-way encryption (hashing) — we cannot view or recover your actual password
- Completed sales and stock movement records are immutable — they cannot be edited or deleted by any user, including shop owners and SalesTrack staff, once created. This is by design, both to protect shop owners from internal fraud and to keep financial records (like the Lender Pack) trustworthy
- We take reasonable technical and organizational measures to protect your data, but no system is 100% secure. We will notify affected Account Users without undue delay if we become aware of a data breach affecting their data
7. Data retention
We retain your data for as long as your account is active. If you cancel your subscription, your data is retained in read-only form so you can still access and export your records. If you wish to permanently delete your account and associated data, contact us and we will action this within a reasonable timeframe, except where we are legally required to retain certain records (for example, transaction records relevant to tax compliance).
8. Your rights
Under the Kenya Data Protection Act and similar laws in other countries we serve, you have the right to:
- Know what personal data we hold about you
- Request a copy of your data (data export)
- Request correction of inaccurate data
- Request deletion of your data, subject to legal retention requirements
- Object to or restrict certain processing
- Withdraw consent where processing is based on consent (e.g. marketing follow-ups)
To exercise any of these rights, contact us using the details below. End Customers should first contact the specific shop they interacted with, since that shop controls its own customer data; we will assist the shop in fulfilling the request.
9. Cookies and similar technologies
Our website and app use limited local browser storage (not third-party advertising cookies) to keep you logged in, remember your preferences, and allow offline functionality. We do not use tracking cookies for advertising, and we do not sell data to ad networks. See our Cookie Policy for details.
10. International data transfers
Our infrastructure providers may process data outside Kenya. Where this happens, we take steps to ensure your data continues to receive an appropriate level of protection consistent with the Kenya Data Protection Act.
11. Changes to this policy
We may update this Privacy Policy from time to time as SalesTrack grows. We will update the "Last updated" date above when we do. Continued use of the Service after a change means you accept the updated policy.