Privacy Policy

Who we are

StockRada is inventory and sales software for businesses, run by StockRada ("we", "us"). If you have a question about anything on this page, write to us at [email protected].

Two kinds of information

It helps to separate what we hold about you from what a business keeps in StockRada.

Your account. When you sign up or a business invites you, we hold your details so you can sign in and so we can run the service. For this information we decide what happens to it, and we answer to you for it.
A business's records. A business uses StockRada to record its stock, sales and customers. Those records belong to the business. We store and process them only so the business can use StockRada, and only on its instructions. If you are one of a shop's customers and want to know what that shop holds about you, ask the shop first; we will help it answer you.

What we collect, and why

When you sign up

Your name, email address, business name, the workspace address you choose, your country, currency and time zone, the plan you picked and your line of business. Your password is stored only as a scrambled hash; nobody here can read it. We send a code to your email to confirm the address is yours. If you never confirm, we delete the half-finished sign-up within about a day.

When you use your account

Your name, email and phone number, your role in the business and which branches you work in.
When you last signed in, and a record of important actions: sign-ins, sales, handovers, settings changes. Each entry keeps the IP address and the browser it came from, so a business can see who did what and spot an account being misused.
An approximate location worked out from that IP address: a town and country, never your exact position. Businesses use it to see where their sales happen and to notice a sign-in from somewhere unexpected. A business can switch this off in its settings.
If you turn on phone notifications, the address your browser gives us to deliver them.

What a business records about its customers

Depending on how it works, a business may record a customer's name, phone numbers, email, ID number, KRA PIN, address and notes, along with sales, credit and lay-by payments, warranties, returns and follow-ups. The business decides what to record. We keep it safe, separate from every other business, and do not use it for anything of our own.

If a business sends text messages from StockRada (payment confirmations, reminders, receipts), we keep the number and the message sent so the business can see what went out. A customer who asks a business to stop texting them is marked so, and StockRada then refuses to text that number for that business.

Payments

When you pay us, or a business takes M-Pesa payments through StockRada, we keep the payment details Safaricom sends back: the phone number (often masked), the payer's name, the amount and the M-Pesa reference. We need these to match payments to invoices and to answer any dispute later.

Visiting our website

On our public website (not inside any workspace) we use Google Analytics to see how many people visit, which pages they read and whether they go on to sign up. We have switched off Google's advertising features, we do not send Google the parts of a web address that can carry codes or tokens, and we do not load it at all if your browser asks sites not to track you (Do Not Track or Global Privacy Control).

Who else sees it

We do not sell personal information, and we do not share it for anybody's advertising. We use a small number of companies to run the service, and each one gets only what its job needs:

Contabo hosts our servers, in Europe. Everything stored in StockRada lives there.
Cloudflare sits in front of our website and passes traffic to our servers. It also serves the map tools used on the sales map.
Safaricom handles M-Pesa payments: the phone number being charged and the amount.
Onfon Media delivers text messages: the phone number and the message.
Our email provider delivers sign-up codes, invoices and notices: your email address and the message.
Sentry receives a report when something breaks, so we can fix it. Passwords, cookies and the contents of forms are removed before a report leaves our servers.
findip.net receives an IP address and tells us roughly where it is, for the location feature above.
Google receives website visit data through Google Analytics, on the public website only.
KRA, only if a business has connected StockRada to eTIMS: its sales, as tax law requires, including a customer's name and PIN where the business recorded them.
Your browser's notification service (Google, Apple or Mozilla) delivers phone notifications you turned on. It sees a short alert, never your records.
OpenStreetMap supplies the map pictures on the sales map. Your browser asks it for map tiles directly.

Some of these companies are outside Kenya, so your information may be stored or handled in other countries. We choose providers that protect it properly. We will also give information to the police or a court where the law requires us to, and no further than it requires.

Our own staff see a business's records only when the business lets them in. An owner or admin grants support access from their settings, for a set time (one hour up to three days) and can withdraw it at any moment. Every visit is recorded.

Cookies and storage on your device

Signing in. One cookie keeps you signed in. It expires after 8 hours without use. A second protects forms from being submitted by another website.
Working offline. StockRada can keep working when your connection drops. Sales and changes made offline wait in your browser's storage until the connection is back. The pages it saved are cleared when you sign out.
Small preferences. Things like light or dark mode, and which notices you closed.
Google Analytics sets its own cookies, on the public website only.

How long we keep it

An unconfirmed sign-up: about a day.
Your account and a business's records: for as long as the business uses StockRada.
When a business stops paying, its workspace becomes read-only and is closed after about four months. Closing deletes nothing, so the business can come back.
After a business leaves, we keep its records for at least 90 days in case it changes its mind or needs a copy, and then delete them when asked or when we close the account for good.
Invoices and payment records are kept after that, because tax and accounting rules require it.
Backups are kept for a limited time and replaced as new ones are made, so deleted information can stay in a backup a little longer before it is gone.

How we protect it

Every business's records are kept apart at the database itself, not only in our code, so one business cannot read another's. All traffic is encrypted. Passwords are stored as hashes, sign-in attempts are limited, and the payment and tax credentials a business gives us are encrypted. No system is perfectly safe, so if something did go wrong, we would tell the businesses affected and the Data Protection Commissioner as the law requires.

Your rights

Under Kenya's Data Protection Act you can ask us:

what we hold about you, and for a copy of it;
to correct anything that is wrong;
to delete it, where we have no legal reason to keep it;
to stop using it for a particular purpose.

Write to [email protected]. We will reply within a reasonable time, and we may ask you to show that the account is yours first. A business can also ask us for a full copy of its records, or to close and delete its workspace.

If you are not happy with how we handled your request, you can complain to the Office of the Data Protection Commissioner at odpc.go.ke.

Children

StockRada is made for businesses and is not meant for anyone under 18.

Changes to this policy

When we change how we handle personal information, we update this page and the date at the top. If a change matters to how a business uses StockRada, we will tell its owners before it takes effect.