Privacy Policy

Last updated: 11 November 2026

Biashara Core is a point-of-sale service made by Tsalwa Biashara Softwares Limited ("we", "us"). This policy explains what personal data we handle when you use Biashara Core and this website, why, and the rights you have under Kenya's Data Protection Act, 2019.

1. Who is responsible for your data

• Your account and business details: we decide how this data is used, so we are the data controller.
• Data a shop records about its own customers and staff (for example a customer's name, phone number and credit balance): the shop decides why it's collected, so the shop is the data controller and we are its data processor. We only use that data to provide the service to the shop.

2. What we collect

• Sign-in details from Google: your name, email address and profile picture, when you choose "Continue with Google". We never see your Google password.
• Business details: business name and type, branches, KRA PIN (if you add it), contact phone number.
• Staff details: names, roles and a scrambled (hashed) version of each cashier's PIN. We cannot read the PIN itself.
• Shop records: products, prices, stock, sales, receipts, payments, expenses, suppliers, and customers you choose to record.
• Payment details: when you pay us, Paystack processes the payment. When your customers pay you by M-Pesa, Safaricom processes it. We receive confirmations such as amounts, M-Pesa transaction codes and the payer's name or phone number as provided by Safaricom. We never receive card numbers or M-Pesa PINs.
• Device and technical data: device and browser type, app version, sync times, and error reports used to fix problems.
• Messages you send us by WhatsApp, phone or email.

This website does not use advertising or tracking cookies.

3. Why we use it (lawful basis)

• To provide the service you signed up for (performance of a contract): your account, syncing your data between devices, receipts, reports, M-Pesa and billing.
• To meet legal obligations, such as keeping financial and tax records.
• Legitimate interests: keeping the service secure, preventing fraud and abuse (for example repeated free trials), fixing errors and improving the product.
• Consent, where required, for example before sending you marketing messages. You can withdraw consent at any time.

We do not sell personal data.

4. Where your data is stored

Biashara Core works offline, so your shop's data is first saved on your own device, then copied to our cloud servers when there's a connection. We use these service providers, some of which store data outside Kenya:

• Vercel (website and app hosting) and Neon (database, hosted in the European Union).
• Google (sign-in), Paystack (subscription payments), Safaricom (M-Pesa).
• Sentry (error reports, if enabled).

Where data leaves Kenya, we rely on the safeguards required by the Data Protection Act, 2019, including providers' contractual and security commitments.

5. How long we keep it

• We keep your data while your account is active.
• If you close your account, we delete or anonymise your data within 90 days. The exception is records we must keep by law, such as payment and tax records, which we keep only as long as the law requires.
• Data on your own devices stays there until you clear it or uninstall the app.

6. How we protect it

Data is encrypted in transit (HTTPS). Each business's data is kept separate on our servers, and access is limited to signed-in users and registered devices. A business owner can revoke a lost or stolen device. Cashier PINs are stored only in hashed form. No system is perfectly secure, so please protect your devices with a screen lock and sync regularly.

7. Your rights

Under the Data Protection Act, 2019 you have the right to:

• be told how your data is used (this policy);
• access the personal data we hold about you;
• have inaccurate data corrected;
• have data deleted, where we have no legal reason to keep it;
• object to processing, and withdraw consent;
• receive your data in a portable format. Business owners can export their records from the app.

To use these rights, contact us using the details below. If a shop recorded your details as its customer, please contact that shop first; we'll help them respond. You may also complain to the Office of the Data Protection Commissioner.

8. Children

Biashara Core is a business tool and is not meant for people under 18.

9. Changes to this policy

If we make important changes, we'll tell business owners in the app or by email before they take effect. The date at the top shows the latest version.

10. Contact us