Privacy policy

• Your account: email address, and the password you choose (stored only as a secure hash — we can never see it).
• Your books: everything you and your staff record — sales, expenses, products and stock, customers and suppliers (names and any phone numbers you add), debtors, creditors, bank confirmations and notes.
• Who did what: which account recorded each entry, and basic usage — which pages are opened and when — so we can see what's useful and fix what isn't.
• Payments: when you pay by M-Pesa and send us the confirmation, we see the name, phone number and amount on it.
• Messages you send us through Feedback or WhatsApp.

• To run the app: calculate your stock, profit, balances and reports, and let your staff work in your books.
• To email you about your account — sign-in links, your daily shop summary (you can switch this off), and reminders before a trial or subscription ends.
• To activate your subscription when you pay.
• To keep the service secure and working, and to improve it.

You, and the people you invite. Staff with a sales-only login see just the sales form and their own sales — never your costs, margins, stock value or other records. You can remove anyone at any time.

Us, only when needed — to fix a problem you've reported, to investigate an error in the books, or to activate a payment. We never look at your figures out of curiosity, and never use them for any other purpose.

A few trusted companies run parts of the service for us. They process data only on our instructions:

• Supabase — database and sign-in.
• Vercel — hosts the website.
• Resend — sends our emails.
• GitHub — stores encrypted nightly backups.
• ntfy — sends us an alert when a new account is created or a workspace's books stop balancing.

Their servers may be outside Kenya. Where data leaves Kenya we rely on these providers' security safeguards, as the Data Protection Act requires.

For as long as your account is open. Delete a workspace and its books are removed immediately; ask us to close your account and we delete it within 30 days. Encrypted backups roll over after 30 days, so deleted data is gone from those too within a month.

You can ask us to:

• tell you what data we hold about you, and give you a copy;
• correct anything that's wrong;
• delete your data or close your account;
• stop sending you non-essential emails.

You can also export any month of your books to Excel yourself, at any time, from Records. Write to info@fukuchani.com and we'll respond within 14 days. If you're unhappy with our answer, you may complain to the Office of the Data Protection Commissioner (odpc.go.ke).

Data travels encrypted (HTTPS). Each workspace is walled off from every other at the database level, so no account can read another business's books. Backups are encrypted before they leave the database. No system is perfectly secure — if a breach ever affected your data, we would tell you and the Data Commissioner promptly.

We use only what the app needs to work: a sign-in cookie, and small settings saved in your browser (like which workspace you last opened). No advertising or tracking cookies.

If we change this policy in a way that matters, we'll tell you in the app or by email before it takes effect.