Privacy Policy

1Overview

BizTrack ("we", "us", "our") is committed to protecting the privacy of every business owner and individual who uses our platform. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have over it.

By creating a BizTrack account or using our services — including our web platform, mobile application, USSD service (*384*123#), or API — you agree to the practices described in this policy. If you do not agree, please discontinue use of our services.

This policy is written in plain English to ensure you can understand it fully. Where we use legal or technical terms, we explain them.

2Who We Are

BizTrack is a financial management platform operated by BizTrack Technologies Limited, a company registered in Kenya under the Companies Act (Cap 486). Our registered address is:

For purposes of the Kenya Data Protection Act, 2019, BizTrack Technologies Limited is the Data Controller for personal data collected through our platform.

3Data We Collect

We collect the following categories of personal and business data:

3.1 Account and Identity Data

• Full name and display name
• Phone number (used for account authentication and USSD)
• Email address
• Password (stored as a one-way cryptographic hash — we never see your raw password)
• Profile photo (optional)
• National ID or PIN number (for credit scoring and KYC purposes, Pro plan only)

3.2 Business Data

• Business name, type, and sector
• Business location (county, sub-county)
• M-Pesa Paybill or Till number
• Sales records: items, quantities, prices, timestamps
• Expense records: descriptions, amounts, categories, receipts
• Customer names and contact details you add to the system
• Invoice data and payment status
• Inventory records

3.3 Financial Transaction Data

• M-Pesa transaction references (MPesa confirmation codes)
• STK Push payment records initiated through BizTrack
• Subscription payment records
• Loan application data (if you apply for credit)

3.4 Technical and Usage Data

• IP address and approximate location
• Device type, operating system, browser
• App version and platform (web, mobile, USSD)
• Pages visited, features used, time spent
• Error logs and crash reports
• Login timestamps and session data

3.5 USSD Session Data

• Phone number dialling *384*123#
• Menu selections and session inputs
• Session timestamps and network carrier

4How We Collect It

We collect data through the following means:

• Directly from you — when you register, fill forms, record sales, or contact support
• Automatically — through cookies, analytics tools, and server logs when you use our platform
• Via USSD — Africa's Talking USSD gateway forwards session data to our servers when you dial our code
• Via M-Pesa — Safaricom's Daraja API sends us payment callbacks when transactions occur on your linked Paybill or Till number
• From third parties — credit reference bureaus (for loan applications), with your explicit consent

5How We Use Your Data

We use your data strictly to provide and improve BizTrack. The legal bases under the Kenya Data Protection Act, 2019 are stated in brackets.

We will never use your data for purposes incompatible with those listed above without notifying you and obtaining fresh consent where required.

6Who We Share Your Data With

We share data with the following categories of third parties only as necessary to provide our service:

• Safaricom / M-Pesa (Daraja API) — to initiate STK Push payments and receive payment callbacks
• Africa's Talking — USSD session routing and SMS delivery
• Cloud hosting providers — our servers are hosted on reputable cloud infrastructure with data encryption at rest
• Upstash Redis — task queue and caching infrastructure (no personal data stored permanently)
• Email delivery providers — for transactional emails (invoice delivery, account notifications)
• Credit reference bureaus — only when you explicitly apply for a loan, and only with your signed consent
• Law enforcement / regulators — where legally compelled by a valid Kenyan court order, subpoena, or regulatory demand

All third-party processors are bound by data processing agreements requiring them to protect your data to at least the same standard we do.

7M-Pesa & Payment Data

When you use M-Pesa features on BizTrack, the following applies:

• We never store your M-Pesa PIN. PIN entry always happens on Safaricom's encrypted STK Push prompt, not within our app.
• We receive only the transaction result from Safaricom: amount, reference number, phone number, and timestamp.
• M-Pesa transaction data is used solely to reconcile your business records and generate reports.
• Your M-Pesa transaction history within BizTrack is encrypted at rest in our database.
• For loan applications, aggregated transaction patterns — not raw transaction data — are shared with lending partners, subject to your explicit consent.

8Data Retention

We retain your data for as long as your account is active and for a period thereafter as required by law or legitimate business need.

After the applicable retention period, data is securely deleted or anonymised so it can no longer be linked to you.

9Security

We implement industry-standard security measures to protect your data:

• Encryption in transit: All data between your device and our servers is encrypted using TLS 1.2 or higher (HTTPS).
• Encryption at rest: Sensitive database fields (financial data, personal identifiers) are encrypted at the storage level.
• Password hashing: Passwords are hashed using bcrypt — we cannot recover or read your password.
• Two-factor authentication (2FA): Available and recommended for all accounts.
• Access controls: Only authorised BizTrack engineers can access production data, under strict audit logging.
• Regular security audits: We conduct periodic vulnerability assessments and penetration tests.
• Incident response: We have a documented data breach response plan. If your data is compromised, we will notify you and the Office of the Data Protection Commissioner (ODPC) within 72 hours as required by law.

No system is 100% secure. You are responsible for keeping your account credentials confidential and for ensuring your device is secure.

10Your Rights

Under the Kenya Data Protection Act, 2019 (and applicable to all our users), you have the following rights:

• Right of access — Request a copy of the personal data we hold about you.
• Right to rectification — Ask us to correct inaccurate or incomplete data.
• Right to erasure — Request deletion of your data, subject to legal retention obligations (e.g. tax records must be kept for 7 years).
• Right to restrict processing — Ask us to limit how we use your data while a dispute is resolved.
• Right to data portability — Request your business data in a machine-readable format (CSV/JSON) to transfer to another provider.
• Right to object — Object to processing based on legitimate interest, including direct marketing.
• Right to withdraw consent — Where processing is based on consent (e.g. credit scoring), you may withdraw it at any time without affecting prior processing.

To exercise any right, email privacy@biztracksme.com with your name, registered phone number, and specific request. We will respond within 30 days. We may request identity verification before acting on your request.

If you are unsatisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.

11Cookies & Tracking

We use cookies and similar technologies to operate and improve our web platform.

Essential cookies are necessary for the platform to function and cannot be disabled. You may disable functional and analytics cookies through your browser settings or our cookie preferences panel. This will not affect your ability to use BizTrack but may degrade some features.

We do not use third-party advertising cookies or sell cookie data to ad networks.

12Children's Privacy

BizTrack is a business financial management platform intended for adults operating businesses. Our service is not directed at persons under 18 years of age. We do not knowingly collect personal data from minors.

If you believe a minor has created an account or submitted personal data to us without parental consent, please contact us at privacy@biztracksme.com and we will promptly delete the relevant data.

13Cross-Border Data Transfers

Your data is primarily stored and processed in Kenya. Some of our third-party service providers (such as cloud infrastructure and email delivery) may process data outside Kenya.

Whenever we transfer data internationally, we ensure appropriate safeguards are in place, including:

• Transferring only to countries with adequate data protection laws
• Executing standard contractual clauses with processors
• Ensuring processors are certified under recognised international frameworks (ISO 27001, SOC 2)

These transfers are necessary to provide our service and are covered by the consent you provide when you agree to this policy.

14Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make significant changes:

• We will post the updated policy on this page with a new "Last updated" date
• We will send you a notification via email or in-app message at least 14 days before major changes take effect
• For material changes that affect your rights, we will request fresh consent where required by law

Your continued use of BizTrack after the effective date of a revised policy constitutes acceptance of the changes.

15Contact Us

For privacy-related questions, data requests, or to report a concern: