HOW WE HANDLE YOUR DATA
This policy is written against what Rekodi actually does — the data it really stores and the services it really sends it to — not a template. If anything here is unclear, ask us before you rely on it.
ON THIS PAGE
When you use Rekodi, we hold the following. We have listed it plainly, because some of it may be more than you expect.
To understand a message written in ordinary language, Rekodi sends its content to a third-party AI provider in the United States (OpenAI), which interprets it and returns a structured result:
This means the content of what you text — which can include the names and phone numbers of your customers and staff — leaves our server and is processed by this provider. We send only what is needed to interpret the message. We do not sell your data or use it for advertising. The provider processes it under its business terms, which govern retention: [[OPENAI_TIER_AND_RETENTION]].
We process this data to provide the service you asked for: to record your transactions, keep your books, answer your questions, and manage your subscription. Under Kenya's Data Protection Act, 2019, our lawful bases are:
For the records you enter about other people, you are the party with the direct relationship, and Rekodi processes that data on your behalf (see section 07).
Your data is stored on servers operated by DigitalOcean in Frankfurt, Germany (region fra1). Because interpreting your messages uses OpenAI (section 02), some message content is also processed in the United States. By using Rekodi you understand that your data is transferred and processed outside Kenya for these purposes.
We take encrypted daily backups of the database, and we have tested that a backup actually restores correctly to the last cent. [[FLAG: off-site backup storage is being finalised — update this line to state the off-site location and encryption once it is live; do not claim off-site storage until then.]]
Access is limited to what the service needs:
We keep your records for as long as your shop uses Rekodi, so your books stay complete and correct over time. At present, the log of your WhatsApp messages is retained indefinitely. We intend to introduce a defined retention period after which older message logs are removed, and we will state that period here once it is in place.
If your subscription lapses, your data is not deleted — it is kept so you don't lose your books, and is available again when you resubscribe. If you ask us to delete your shop, we will (see section 08).
When you record a customer's debt, a staff member's number, or a delivery address, you are entering personal data about someone who has not signed up to Rekodi themselves and has not directly agreed to this policy. This is a real responsibility under the Data Protection Act, 2019, and most services quietly ignore it.
As the shop owner, you are responsible for having a proper reason to hold that information — normally your own business relationship with that person. Rekodi acts as your processor for it.
If someone whose data a shop holds in Rekodi wants it removed, they can ask the shop owner, or contact us at [[CONTACT_EMAIL]] and we will help the shop owner remove it. We can delete an individual customer, supplier or staff record on request.
Under the Data Protection Act, 2019 you can ask to access, correct, export or delete your data. Today these are handled by request rather than a self-service button:
You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya.
No system is perfectly secure, but we take reasonable steps appropriate to a service holding financial records.
We will update this policy as Rekodi grows — particularly as we complete ODPC registration and finalise our providers. When we make a material change, we will update the date at the top and, where appropriate, tell you on WhatsApp.
For any privacy question or request, contact the data controller: