Privacy Policy

This policy explains what personal data Siniam Enterprises Ltd ("Siniam", "we", "us") collects, why, who we share it with and the rights you have. It covers our website, sign-up, the Siniam service and our communications with you. We comply with Kenya's Data Protection Act, 2019, and, where the EU or UK GDPR applies to you, with that too.

1. Our two roles

• When we decide how data is used, we're the controller. This covers people who visit our website, contact us, sign up, sign in, or pay us.
• When you keep records in your workspace, you're the controller and we're your processor. This covers your customers, suppliers and staff whose details are in your workspace. We handle that data only to provide the Service and on your instructions, as set out in our Terms of Service. If you're a customer of a business that uses Siniam, please contact that business about your data.

2. What we collect

When you sign up and use Siniam

• Your name, business name, email address, optional phone number, username, country, city, currency and time zone.
• Your password, stored only as a one-way hash we can't read.
• The code we email to confirm your address. Only a keyed hash of it is stored, and it expires after 15 minutes.

When you pay us

• Invoices, plan and payment records. Online payments are handled by our payment provider; we don't receive or store full card numbers.

While the Service runs

• Sign-in records, IP address, browser and device information, and server logs, used for security and to fix problems.
• Measurements of your workspace's use, such as database size, files stored and activity, used for billing and capacity.
• When our team signs in to your workspace to help you, a record of who did it and when.

On our website

• What you send through the contact form: name, business, email, optional phone and message, plus your IP address.
• How visitors use the public website, through Google Analytics — only if you accept analytics cookies in the cookie banner. Analytics runs on the public website only, never inside workspaces.
• A security check by Cloudflare Turnstile on sign-up, sign-in and contact forms, to keep out automated abuse.

In the Siniam app

• The phone's model, system version, the app's version and a random identifier the app creates when it's installed. We use them to show you which devices are signed in and to warn you by email when a new one signs in.
• Your sign-in is kept in the phone's secure storage. If you set a PIN, only a salted, one-way hash of it is kept, on the phone itself, and is never sent to us. Fingerprint or face unlock is handled by the phone; we never receive your fingerprint or face data.
• The camera is used only to scan barcodes and, when you choose, to photograph a product. Scanning happens on the phone; only photos you choose to save are sent to your workspace.
• Bluetooth is used only to connect to receipt printers you pair. The app doesn't use your location.
• Sales and records you make while offline are kept on the phone until they're sent to your workspace, then cleared.
• The app has no advertising and no analytics or tracking tools.

3. Why we use it

We don't sell personal data, and we don't use the records in your workspace to advertise to you or anyone else.

4. Who we share it with

We share personal data only with providers who help us run the Service, under contracts that require them to protect it and use it only for us:

• DigitalOcean: servers and databases (United States).
• Cloudflare: network delivery, security and Turnstile checks (global).
• Zoho (ZeptoMail): delivery of emails such as sign-up codes and sign-in links.
• Paystack: payment processing.
• Africa's Talking: text-message notices about your account, when we send them by SMS.
• Google: website analytics (public website only).

We may also share data with professional advisers under confidentiality, with authorities when the law requires it, or with a buyer if our business is sold, in which case this policy continues to protect it.

5. International transfers

Our servers are in the United States, so your data is transferred outside Kenya. We rely on providers that offer appropriate safeguards for personal data, under contracts that bind them to protect it, as the Data Protection Act requires.

6. How we protect it

• Every workspace has its own database with its own credentials, so one business's data can't be reached from another's.
• Data travels encrypted (HTTPS/TLS). Passwords and verification codes are stored only as hashes.
• Our team's accounts use two-step verification, access is limited to what each role needs, and support sign-ins to workspaces are recorded.
• Databases are backed up, and backups expire on a short cycle.

No system is perfectly secure. If a breach affects your personal data, we'll notify you and the Data Protection Commissioner as the law requires.

7. How long we keep it

• Workspace data: while your subscription is active, and for 90 days after it ends so you can reactivate it or take a copy. After that the workspace may be closed: the live workspace is removed and an archive of its database and files is kept for 12 months so it can be restored on request, then permanently deleted. Routine backups expire within days.
• Sign-ups that are never confirmed: deleted within a day.
• Billing records: as long as tax law requires (in Kenya, generally five years).
• Contact-form messages: as long as needed to answer and follow up, and no longer than two years.
• Server logs: up to 14 days.

8. Your rights

You can ask us to:

• tell you whether we hold your personal data, and give you a copy;
• correct data that's wrong or incomplete;
• delete data we no longer have a reason to keep;
• stop or limit using it, or object to our using it for legitimate interests;
• give you your data in a portable format.

Send requests to [email protected]. We may need to confirm your identity first, and we'll respond within the time the law sets. If the data is in a business's workspace, we'll pass your request to that business, which decides on it. To close your workspace or delete your account, see Delete your account. You can also complain to the Office of the Data Protection Commissioner (odpc.go.ke) or, in the EU or UK, your local data protection authority.

9. Cookies

• Essential: they keep you signed in, protect forms from forgery, and remember which workspaces you've used on that device so we can take you straight to them.
• Security: Cloudflare Turnstile checks that a visitor is a person.
• Analytics: Google Analytics cookies, on the public website only and only after you accept them in the cookie banner. Until then no analytics cookies are set, and Google receives only cookieless signals that don't identify you. Change your choice any time with Cookie settings at the bottom of every page; declining also removes analytics cookies already set.

10. Children

Siniam is for businesses and isn't meant for anyone under 18. We don't knowingly collect children's personal data. Where a business records details about children in its workspace, that business is responsible for doing so lawfully.

11. Changes to this policy

We'll update this policy when our practices change. The date at the top shows when it last changed. For significant changes we'll tell account owners by email or in their workspace.

12. Contact us

Siniam Enterprises Ltd, Western Heights, 8th Floor, Karuna Road, Westlands, Nairobi, Kenya · [email protected]