Privacy policy
Last updated 16 October 2026
This policy explains what information ShelfWise collects when you use shelfwise.co.ke and the ShelfWise app, why we need it, and the rights you have under the data protection law of your country — Kenya, Tanzania, Uganda or Nigeria (see “Where you are” below). If anything here is unclear, email hello@shelfwise.co.ke.
What we collect
- Account details: your name, email address, optional phone number and a securely hashed password (we never store your password itself).
- Business records you enter: your business name and location, products, stock levels and movements, sales, suppliers and their contact details, purchase orders and deliveries.
- Customer details, only if you add them: for example a customer name or phone number on a credit sale.
- Payment references: when you pay for a subscription, our payment provider Paystack handles your card details. We receive and keep only the transaction reference, amount, status and payment channel — never full card numbers.
- Technical records: sign-in times, the IP address recorded with important account changes, and server logs used to keep the service secure and working.
How we use it
- To run the service you signed up for: keeping your stock records, suggesting reorders and preparing supplier orders.
- To send account emails such as password resets, invitations and stock alerts you have turned on.
- To process and confirm subscription payments.
- To keep accounts secure, investigate problems and improve the product. We record which features a business has started using (for example “first sale recorded”), not the contents of your records.
We do not sell your information, and we do not use your business records for advertising.
When you ask for financing
If ShelfWise offers financing to your business and you ask ShelfWise to pay a supplier, you are asked to agree before we look at your business’s figures. With that agreement, ShelfWise staff see summaries only — sales and gross margin by month, trading days, stock value at cost, what customers owe you, what you owe suppliers, how your orders were received and paid, and your record with earlier financing — together with the order you want financed. We never see individual customers, sales or prices for this. A copy of the summaries as they were when you asked is kept with the request, and we use them only to decide and manage your financing.
When you order hardware or setup
If you order devices or setup from ShelfWise, we keep the contact name, phone number and delivery address you give, and share them only with the people who supply, deliver or set up your order.
Your business’s customers and suppliers
When your business records details about its own customers or suppliers (for example a name and phone number on a credit sale), your business decides what is recorded and why, and is responsible for having a lawful reason to keep it. ShelfWise stores and processes those details only on your business’s instructions, to provide the service.
Who we share it with
- Paystack, to process subscription payments.
- Our hosting and email providers, who store and send data on our behalf. Our servers are currently hosted by DigitalOcean in Frankfurt, Germany.
- WhatsApp: when you choose to send an order, ShelfWise opens WhatsApp with the message filled in. Nothing is sent until you press send in WhatsApp, and from then on WhatsApp’s own terms apply.
- Authorities, only where the law requires it.
Because our servers are in Germany, using ShelfWise means your information is transferred outside your country. Germany is covered by the EU’s General Data Protection Regulation. Where the law of your country sets conditions for such transfers, we rely on the safeguards it allows, such as contractual protections with our providers, and we will tell you if that changes.
Cookies
We use only the cookies needed to keep you signed in and protect your account. We do not use advertising or third-party tracking cookies. The app also stores recently viewed data on your device so it can work during a poor connection; signing out clears it.
Keeping it safe and how long we keep it
Connections are encrypted, each business’s records are kept separate from every other business, and access within a business follows the roles the owner assigns. We keep your records while your account is open. Database backups are kept for up to four weeks. To close your account and have its data deleted, email us from the account owner’s address.
Your rights
You can ask to see the personal information we hold about you, correct it, have it deleted, or object to how it is used. You can export your products, stock movements and reports as CSV files at any time from inside the app. If you are not satisfied with our answer, you can complain to the regulator in your country (below).
Where you are
- Kenya: the Data Protection Act, 2019. Regulator: the Office of the Data Protection Commissioner.
- Tanzania: the Personal Data Protection Act, 2022. Regulator: the Personal Data Protection Commission.
- Uganda: the Data Protection and Privacy Act, 2019. Regulator: the Personal Data Protection Office.
- Nigeria: the Nigeria Data Protection Act, 2023. Regulator: the Nigeria Data Protection Commission.
If we learn of a security breach that is likely to put your information at risk, we will tell affected account owners and the relevant regulator within the time the applicable law requires.
Changes
If we change this policy in a way that matters, we will tell account owners by email before the change takes effect.