Privacy Policy

When you use Soostori, we collect information you provide directly, information generated automatically as you use the service, and information from third-party sources.

Account Information

• Your name, phone number, and email address.
• Business name, physical address, and KRA PIN (if applicable).
• Staff member names and phone numbers you add to your account.

Transaction Data

• Sales transactions, including products, quantities, prices, and payment method.
• Customer names and phone numbers (for debt tracking and WhatsApp reminders).
• Inventory levels and stock movements.

Device Information

• Device type, operating system, and app version.
• IP address and usage logs (collected anonymously).

We use the information we collect to:

• Provide, maintain, and improve the Soostori service.
• Process transactions and sync your shop data across devices.
• Send you important updates, reminders, and notifications (including WhatsApp debt reminders with your explicit consent).
• Respond to your support requests and provide customer service.
• Detect, prevent, and address fraud, security issues, and technical problems.
• Comply with legal obligations, including Kenyan tax and data protection laws.

Soostori does not sell your personal data. We share your information only in the following circumstances:

• Service Providers: We share data with trusted vendors who help us deliver Soostori (cloud hosting, M-Pesa integration, WhatsApp messaging). These providers are contractually bound to protect your data.
• Legal Requirements: We may disclose your data if required by Kenyan law, court order, or government authority.
• Business Transfers: If Soostori is acquired or merged, user data may transfer to the new entity under the same privacy protections.

We take data security seriously and implement the following measures:

• All data is encrypted in transit using TLS 1.2+.
• Data is encrypted at rest using AES-256 encryption.
• Access to user data is restricted to authorized personnel only.
• We perform regular security audits and penetration testing.
• Data is stored in secure, ISO 27001-certified data centres.

Under the Kenya Data Protection Act 2019, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate personal data.
• Request deletion of your personal data (subject to legal retention requirements).
• Withdraw consent for specific uses of your data (e.g., WhatsApp reminders).
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe your rights have been violated.

To exercise any of these rights, contact us at privacy@soostori.co.ke.

We retain your personal data for as long as your Soostori account is active and for a period of up to 7 years after account closure to comply with Kenyan tax and business record requirements. You may request earlier deletion, which we will honour subject to legal requirements. Data exported by you (e.g., via CSV) is your property and retention is your responsibility.

Soostori uses minimal cookies to provide essential functionality. These cookies are used solely for authentication, session management, and security. We do not use advertising or tracking cookies. You can disable cookies in your browser, but this may affect the functionality of the service.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email, in-app notification, or by posting the updated policy on this page with a revised "Last updated" date. Continued use of Soostori after any changes constitutes your acceptance of the updated policy.