Privacy Policy
1. Who is responsible
JacotePOS (jacote.blog) is run by Jacote in Kenya. Business registration: [registered business name and number to be added].
Contact for privacy questions: jacotewambura@gmail.com · WhatsApp +254 799 654 411 · Calls +254 713 074 137.
- For shop account details (section 2a), JacotePOS is the data controller.
- For the records a shop enters about its customers, farmers and staff (section 2b), the shop is the data controller and JacotePOS is its data processor: we keep that information only to run the till for the shop, and follow the shop's instructions.
2. What we collect
a) Shop account details: shop name, owner's name, phone number, town or area, sign-in email address and password (the password is handled by Google Firebase and we cannot see it), and the date the shop registered.
b) Records the shop enters:
- Products, prices, stock, restocks, sales, refunds, discounts and cash-ups.
- Staff names, roles and PINs (PINs are stored only in scrambled form).
- Customers on credit (deni): name, phone number, credit limit, what they owe and pay.
- Milk farmers: name, phone number, deliveries, payouts and statements.
- M-Pesa or card reference codes typed in at a sale.
c) Technical information: the device keeps a copy of the till and unsent sales in its browser storage so it can work offline, and a short device code used in receipt numbers. Our hosting providers keep basic logs (such as IP address and time of a request) for security.
We do not use advertising trackers, and we do not collect location or contacts from your phone.
3. Why we use it
- To run the till: record sales, stock, credit, farmer accounts and reports for the shop.
- To approve, support and, if needed, suspend shop accounts.
- To keep the service secure and to keep backups.
- To contact the shop about its account, support, changes and (later) billing.
Our lawful basis is the contract with the shop (to provide the service), our legitimate interest in keeping it secure and working, and legal obligations such as tax records. Shops are responsible for having a lawful basis for the information they enter about their own customers, farmers and staff, and for telling those people.
4. Who else handles the information
We use trusted service providers. They only process information to provide their service to us.
| Provider | What for | Where |
|---|---|---|
| Google Firebase (Google LLC) | Sign-in and storing shop records | Data centres in Europe (eur3) |
| Vercel Inc. | Hosting the jacote.blog website | Global network, mainly USA and Europe |
| Google reCAPTCHA (App Check) | Checking that requests come from the real JacotePOS website, not from scripts or bots | Global network |
| GitHub (Microsoft) | Running JacotePOS's automatic checks of shop accounts every 30 minutes, for the administrator | USA |
| Cloudflare Inc. (Workers) | Running the JacotePOS server that sends SMS and connects a shop's own M-Pesa, when the shop turns these on | Global network |
| Talksasa (Kenya) | Delivering SMS a shop chooses to send: the customer's or owner's phone number and the message (a receipt, a balance reminder, a gas refill reminder or the day's summary) | Kenya |
| Safaricom PLC (M-Pesa Daraja) | Payment prompts and payment confirmations on the shop's own Till or Paybill, when the shop connects it: the customer's phone number, the amount and the M-Pesa code | Kenya |
| Telegram (or CallMeBot for WhatsApp) | Sending alerts to the JacotePOS administrator only: a shop's name, town and phone number, and the amount and M-Pesa code of a subscription payment it reports | Europe |
| Vercel Web Analytics | Counting visits to the website pages and where visitors came from, without cookies and without identifying anyone | Global network |
| Google Fonts, cdnjs (Cloudflare) | Loading the lettering, the receipt-picture tool, the spreadsheet reader and the PDF maker (files you import and reports you download are made on your device, not sent to them) | Global network |
| WhatsApp, SMS, your phone's share options | Only when a user chooses to send a receipt or statement | As chosen by the user |
Information leaving Kenya. Shop records are stored outside Kenya, in Europe. We rely on providers with strong security and data protection commitments, as allowed by the Data Protection Act, 2019, and we will update these arrangements as the Data Commissioner's guidance requires.
We do not sell or rent personal information, and we do not share one shop's records with another shop. We will share information with authorities only where Kenyan law requires it.
5. How long we keep it
- While a shop is active, its records are kept so the shop can see its history and reports.
- After a shop is closed, we keep its records for 90 days so the shop can ask for a copy, then delete them. Copies in backups are deleted as those backups are replaced.
- A shop can delete a customer, farmer or staff member from its own records; where the shop must keep sales or tax history, the related entries may remain.
6. How we protect it
- Each shop can only reach its own records, and every connection is encrypted.
- Passwords are handled by Google Firebase; staff PINs are scrambled before they are saved.
- Only the JacotePOS administrator can approve shops, and administrator access to shop records is read-only, for support and backups.
- If a data breach is likely to put people at risk, we will tell the Office of the Data Protection Commissioner within 72 hours of finding out, and tell the affected shops without delay.
Shops should also protect their devices: use a screen lock, lock the till when away, and do not share PINs.
7. Your rights
Under the Data Protection Act, 2019 you have the right to:
- be told how your information is used (this policy);
- see the information held about you;
- have wrong information corrected;
- have information deleted, or object to its use, where the law allows;
- get a copy of your information in a usable form.
Customers, farmers and staff of a shop should first ask that shop, because the shop controls those records. We will help the shop answer. You can also contact us directly using the details in section 1; we will reply within 14 days where we can. If you are unhappy with our answer, you may complain to the Office of the Data Protection Commissioner (odpc.go.ke).
8. Children
JacotePOS is for businesses. Shop accounts must be opened by adults (18+).
9. Changes to this policy
We may update this policy. We will change the date at the top and tell shops about important changes.
Privacy questions? Email jacotewambura@gmail.com or WhatsApp +254 799 654 411. · Terms of Service · Back to JacotePOS