Privacy policy

Version 2026-11-03 · Last updated 3 November 2026

This policy explains how Kennivate Technologies (the provider of Shopnasi), Nairobi, Kenya ("we"), handles personal information when you use Shopnasi. It follows the Kenya Data Protection Act, 2019.

1. Two kinds of information

• About you and your team (the people who use Shopnasi): we decide how this is used, so we are the data controller.
• About your customers and suppliers (the contacts, sales and orders you store): the business decides how this is used and is the data controller; we only process it on the business's behalf. See our Data processing terms. If you are a shop's customer, please contact that shop about your information.

2. What we collect about you

• Account details: name, email, phone, and your business's name, address and tax details.
• Sign-in details: password (stored only as a secure hash), POS PIN (hashed), two-step login settings, Google sign-in id if you use it.
• Billing: your plan, invoices and payment records. Card and M-Pesa details are handled by Paystack, not stored by us.
• Security and usage: sign-in times, IP address, browser and device, and actions in the account (an audit log).
• Screen recordings: to fix problems and improve the service we record how pages are used in the app and on shop websites. Typed values are masked. Recordings are deleted after 30 days (app) and 10 days (shop websites).
• Messages you send us and answers you give during setup.
• If you try the demo: a temporary copy of a sample shop is made for you, and a cookie on your browser lets you return to it. The copy and everything you do in it are deleted after 24 hours.

3. Why we use it (and our legal basis)

• To provide the service you signed up for and support you: to perform our contract with you.
• To bill your plan and keep accounting records: to perform the contract and meet legal duties.
• To keep accounts secure, prevent fraud and spam, and fix problems: our legitimate interests.
• To send service emails (sign-in codes, invoices, important changes): needed to run your account.
• To send product news or tips, only where you have not opted out; you can unsubscribe any time.

We do not sell personal information and we do not use your business data to advertise to your customers.

4. Who we share it with

Only providers we need to run Shopnasi, under contracts that protect the information:

• Hosting and storage: HostPinnacle, in Kenya.
• Amazon Web Services (email delivery for campaigns).
• Sentry (error reports, so we can fix problems; set up to leave out names, emails, passwords and what you type).
• Paystack (payments for our plans, and your shop's own payments through your Paystack account).
• Google (optional sign-in with Google; Firebase for app notifications).
• Cloudflare (protection against bots and attacks).

We may also share information when the law requires it, or to protect people's rights and safety.

5. Information outside Kenya

Some providers above store or process information outside Kenya (for example email delivery in the European Union). We only use providers that protect personal information to a standard the Data Protection Act accepts.

6. How long we keep it

• Account and business data: while the account is open.
• When a business is closed: everything is deleted after a 30-day period to change your mind, then removed from backups within 14 days. We keep our own billing records as the law requires.
• Screen recordings: 30 days (app), 10 days (shop websites).
• Audit log (who changed what in the account): 1 year.
• Sign-in history, security events and two-step login attempts: 180 days.
• Online payment attempts and payment notifications from the payment provider: 90 days.
• Notifications you have already read: 90 days.
• Expired sign-in sessions and links: 7 days after they end.
• Data exports you download: the file is available for 7 days.

7. Security

Connections are encrypted, passwords and PINs are hashed, secret keys (such as payment keys) are stored encrypted, access inside each business is controlled by roles, two-step login is available, and important actions are recorded. No system is perfectly secure; if a breach affects your information we will tell you and the regulator as the law requires.

8. Cookies

We use cookies that are needed to keep you signed in and secure. They can't be switched off without breaking sign-in. On our own website (shopnasi.co.ke) we also use Google Analytics, which sets cookies to count visits and see which pages are read and where visitors come from; Google processes this for us. We don't use advertising cookies.

9. Your rights

You can ask to see the information we hold about you, correct it, delete it, object to how it is used, or get a copy to take elsewhere. Business owners can export all their business data themselves. Email privacy@shopnasi.co.ke; we reply within the time the law sets. You can also complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).

10. Children

Shopnasi is for businesses and is not meant for anyone under 18.

11. Changes

We may update this policy and will tell you about important changes.

12. Contact

Kennivate Technologies (the provider of Shopnasi), Nairobi, Kenya. Privacy questions and requests: privacy@shopnasi.co.ke.