Privacy Policy

Last updated: 30 October 2026

This policy explains how Shajara handles personal data, in line with the Kenya Data Protection Act, 2019. For records your business keeps about its own customers and staff, your business is the data controller and Shajara acts as the data processor on your behalf.

1. Data we collect

Account data: names, email addresses, phone numbers and roles of owners and staff.
Business data: business name, KRA PIN, branches, products, sales, purchases, expenses, debts and reports.
Your customers' data: names, phone numbers and balances you choose to record.
Usage data: sign-in times, device and browser details, and an activity log of changes made in the system.

2. How we use it

To run the service, keep your records and produce your reports.
To send account emails such as invitations, password resets and billing notices.
To provide support, prevent fraud and keep the system secure.

We do not sell personal data and do not use your business data for advertising.

3. Keeping businesses separate

Each business workspace is isolated. Staff only see the branches and sections their owner grants them, and no business can see another's records.

4. Who we share with

Only with service providers needed to run Shajara (cloud hosting, email delivery) and with services you connect yourself, such as M-Pesa, Kopo Kopo or KRA eTIMS. We disclose data to authorities only when Kenyan law requires it.

5. Security

Data is encrypted in transit, access is controlled by role, and important changes are recorded in an audit log. No system is perfectly secure; if a breach affects your data we will notify you and the Data Commissioner as the law requires.

6. Retention

We keep your data while your workspace is active. After closure you have 30 days to request an export, after which data is deleted, except records we must keep by law (for example billing records).

7. Your rights

Under the Data Protection Act you may ask to access, correct, export or delete personal data, or object to how it is used. Your business's customers should contact the business directly; you can also email support@myshajara.co.ke. You may complain to the Office of the Data Protection Commissioner.

8. Cookies

We use only essential browser storage to keep you signed in and remember device settings such as receipt printer size. We do not use advertising cookies.

9. Changes and contact

We will post updates here and notify account owners of material changes. Contact: support@myshajara.co.ke.

Questions? Email support@myshajara.co.ke.