Legal
Privacy Policy
Plain-language document. This text describes how mydukapos works and what we ask of you. It has not been reviewed by a lawyer; if your business needs a reviewed contract, contact us before relying on it.
1. What we collect
- Account details: your name, business name, phone number, email address and a salted, one-way hash of your password (we cannot read your password).
- Consent record: when you accept the Terms, the document versions, the time, where you signed up (website or app) and the country your connection appears to come from. We do not store your IP address for this.
- Business data you enter: products, sales, customers, staff and similar records, stored so your devices can sync.
- Messages you send us through the contact form or WhatsApp.
- Basic, cookieless usage counts for public pages (page views and referrer), without personal identifiers.
2. Why we use it
To create and secure your account, run and sync your tills, send verification and password-reset messages, answer your questions, prevent abuse, and keep the service working.
3. Who processes it
Our service is hosted on Cloudflare. Verification and reset messages are sent through email and WhatsApp providers. They handle data only to deliver the service.
4. Retention and your choices
We keep account data while your account exists. You can ask us to correct, export or delete your data using the contact page. We aim to handle personal data in line with the Kenya Data Protection Act, 2019; this page is not a claim of registration or certification.
5. Security
Passwords are stored as salted hashes, traffic uses HTTPS, and sign-in attempts are rate-limited. No system is perfectly secure, so use a strong, unique password.
6. Cookies
See the Cookies page.
7. Changes
Updates are published here with a new version number.