Privacy Policy | sell.ke

sell.ke ("sell.ke", "we", "us", "our") provides point-of-sale, inventory, and ecommerce software to businesses in Kenya and beyond ("the Service"). This Privacy Policy explains what data we collect, why, how we use and protect it, and the choices you have — including how to request deletion of your account and data.

This policy applies to the sell.ke marketing site (sell.ke), the POS and admin applications, and the sell.ke mobile app. It is written to comply with Kenya's Data Protection Act, 2019.

1. Who this applies to

There are two kinds of people whose data we handle, and we treat them differently:

Business accounts ("tenants") — the owners and staff of a business that signs up to use sell.ke to run their operations.
End customers — the customers of a tenant's business (e.g. someone buying from a tenant's shop or online store). Their data is entered and controlled by the tenant, and sell.ke processes it on the tenant's behalf as a data processor.

2. What we collect

Account & business information

Name, email address, phone number, and password (stored as a salted hash, never in plain text).
Business name, KRA PIN, VAT number, business type, and address/branch details you provide.
Subscription plan, billing history, and support communications.

Operational data you generate

Products, categories, prices, stock levels, and inventory movements.
Orders, receipts, quotations, and payment records processed through the Service.
Customer records you create (names, phone numbers, purchase history) for your own business.
Staff accounts, roles, and activity logs within your business account.

Payment information

We do not store your M-Pesa PIN or full card numbers. Card and mobile-money payments are processed by our licensed payment partners — Safaricom M-Pesa and Paystack — who handle and secure that data under their own PCI-DSS-compliant systems. We only receive transaction confirmations (amount, status, reference number).

Technical & usage data

Device, browser, and IP address, for security and fraud prevention.
Log data such as login times, feature usage, and error reports.

3. How we use your data

To provide, operate, and maintain the Service you signed up for.
To process payments and subscriptions, including via M-Pesa and Paystack.
To generate KRA eTIMS-compliant tax invoices where applicable.
To send you account, billing, and security notifications by email or SMS.
To provide customer support and respond to your requests.
To detect, prevent, and investigate fraud, abuse, or security incidents.
To improve the Service through aggregated, anonymised analytics.

4. Who we share it with

We share data only where necessary to run the Service:

Payment processors — Safaricom M-Pesa and Paystack, to process transactions.
KRA eTIMS — for tenants who enable automated tax invoice filing.
Infrastructure providers — cloud hosting and file storage providers who host our servers and your data on our behalf, under confidentiality obligations.
Email & SMS providers — to deliver receipts, notifications, and OTPs.
Legal & safety — where required by law, court order, or to protect the rights, property, or safety of sell.ke, our users, or the public.

We do not sell your personal data to third parties, ever.

5. Data retention

We retain account and transaction data for as long as your account is active, and for a reasonable period afterward to comply with tax, accounting, and legal obligations under Kenyan law (typically up to 7 years for financial records). When you request deletion of your account (see Section 7), we delete your business data from our production systems, subject to any residual copies in encrypted backups, which are purged on our normal backup-rotation schedule.

6. Your rights

Under Kenya's Data Protection Act, 2019, you have the right to:

Access the personal data we hold about you.
Request correction of inaccurate or incomplete data.
Request deletion of your data (see Section 7 below).
Object to or restrict certain processing of your data.
Request a copy of your data in a portable format.
Lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya.

To exercise any of these rights, email us at info@sell.ke.

7. Deleting your account & data

Business owners can permanently delete their entire business account and all associated data at any time. This is a self-service, owner-only action — see our Delete My Data page for how it works and what gets removed.

8. Cookies

Our marketing website (sell.ke) uses minimal, privacy-respecting analytics cookies to understand aggregate traffic and improve our content. We do not use third-party advertising trackers.

9. Children's privacy

The Service is intended for business use by adults. We do not knowingly collect data from children under 18.

10. Security

We use industry-standard measures — encrypted connections (HTTPS/TLS), hashed passwords, role-based access controls, and regular backups — to protect your data. No system is 100% secure, but we work continuously to safeguard your information.

11. Changes to this policy

We may update this policy from time to time. Material changes will be announced via email or an in-app notice. Continued use of the Service after a change constitutes acceptance of the updated policy.

12. Contact us

Questions about this policy or your data? Reach us at info@sell.ke or call 0143 959 559. We're based in Nairobi, Kenya.