1. Information we collect
We collect:
- Account details — your name, email address, phone number, and password (stored only as a secure hash).
- Workspace data — the business records you enter, such as products, customers, suppliers, branches, sales, purchases, and finance entries.
- Usage and technical data — sign-in events, IP address, device/browser (user-agent), and activity logs used to secure and operate the service.
- Communications — messages you send us, for example support requests.
2. How we use your information
We use the information to:
- provide and operate the platform and your workspace;
- authenticate you, including two-factor and one-time codes, and alert you to sign-ins from unrecognised devices;
- send transactional notifications you'd expect — registration, approval, invitations, and security alerts — by email and SMS;
- maintain security, prevent abuse, debug problems, and keep audit records; and
- comply with legal obligations.
3. Legal bases
We process your information to perform our contract with you, to pursue our legitimate interests in running and securing the service, to comply with the law, and — where applicable — with your consent (which you may withdraw).
4. Cookies and sessions
We use a session cookie to keep you signed in. It is essential to the service and is not used for advertising. Sessions are held server-side; clearing the cookie or signing out ends the session.
5. Sharing and service providers
We do not sell your personal information. We share it only with providers who help us run the service under appropriate safeguards — for example cloud hosting, email delivery, and SMS delivery for notifications and one-time codes — and where required by law or to protect rights and safety. Each tenant’s workspace data is logically separated from others.
6. Retention
We keep your information for as long as your account is active and as needed to provide the service, then for any additional period required to meet legal, tax, accounting, or security obligations. You can request deletion as described below; some records may be retained where the law requires it.
7. Security
We take reasonable technical and organisational measures to protect your information — passwords are hashed, codes are single-use and time-limited, and access is scoped per workspace and role. No system is perfectly secure, so please use a strong, unique password and enable two-factor authentication in your settings.
8. Your rights
Subject to applicable law, you may request access to, correction of, or deletion of your personal information, and you may object to or restrict certain processing. Business owners can also export their workspace data. To exercise these rights, contact us at info@kesho.co.tz.
9. Children
The platform is intended for businesses and is not directed at children. We do not knowingly collect personal information from children.
10. Changes to this policy
We may update this policy from time to time. When we make material changes we will update the date above and, where appropriate, notify you.
11. Contact
For any privacy question or request, contact us at info@kesho.co.tz.