Privacy Policy

Effective Date: December 1, 2024 · Last Updated: April 2026

Kappanetics Limited (“we,” “us,” “SumsPOS”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the SumsPOS platform.

1. Information We Collect

1.1 Account Information

When you create a SumsPOS account, we collect:

• Business name, address, and industry
• Owner/administrator name and contact details (email, phone number)
• Staff names, usernames, and contact details
• Login credentials (passwords are hashed using bcrypt; we never store plaintext passwords)

1.2 Transaction Data

In the course of using SumsPOS, we process:

• Sales transactions, including items sold, amounts, payment methods, and timestamps
• Customer information you choose to record (names, phone numbers, email addresses)
• Inventory data (products, stock levels, stock movements)
• Financial records (expenses, invoices, quotes, purchase orders)
• Payment provider references (M-Pesa transaction IDs, card tokenization references)

1.3 Device and Usage Data

We automatically collect:

• IP address and approximate location
• Browser type and version
• Device type and operating system
• Session duration and pages visited
• Device identifiers for multi-device session management

1.4 Payment Information

For subscription billing, payment is processed through M-Pesa and licensed card-payment providers. We do not store your credit card numbers. Payment provider credentials for your business (M-Pesa API keys, etc.) are encrypted using AES-256-GCM encryption at rest.

2. How We Use Your Information

We use your information to:

• Provide and operate the SumsPOS platform
• Process transactions and payments
• Generate business reports and analytics
• Send transactional communications (receipts, invoices, payment confirmations)
• Provide customer support
• Improve the platform and develop new features
• Ensure security, prevent fraud, and enforce our Terms of Service
• Comply with legal obligations

3. Data Sharing

We do not sell your personal data. We share information only in the following circumstances:

• Payment processors: We share necessary transaction data with M-Pesa (Safaricom) and licensed card-payment providers to process payments on your behalf.
• Email/SMS providers: We use third-party services to send receipts, notifications, and communications on your behalf.
• Legal requirements: We may disclose information when required by law, court order, or regulatory authority.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the new entity.

4. Data Security

We implement industry-standard security measures, including:

• Encryption at rest: Sensitive data (payment credentials, API keys) encrypted with AES-256-GCM
• Encryption in transit: All data transmitted over HTTPS/TLS
• Tenant isolation: Row-level security ensures your data is completely separated from other businesses
• Password hashing: Passwords hashed with bcrypt (cost factor 12); PINs hashed with bcrypt (cost factor 10)
• Audit trail: Immutable log of all data-modifying actions
• Session management: Automatic session expiration, device-based session tracking
• Rate limiting: Protection against brute-force attacks

5. Data Retention

We retain your data as follows:

• Account data: For the duration of your active subscription plus 30 days after termination
• Transaction records: 7 years (for financial/regulatory compliance)
• Audit logs: 7 years
• Session data: 30 days after session expiration
• Backups: Daily backups retained for 30 days; weekly backups retained for 12 months

You may request data deletion at any time by contacting us. We will comply within 30 days, subject to legal retention requirements.

6. Your Rights

Under Kenya's Data Protection Act, 2019 and applicable international privacy laws, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Deletion: Request deletion of your data (subject to legal retention requirements)
• Portability: Export your data in standard formats (CSV, JSON)
• Objection: Object to processing of your data for specific purposes
• Restriction: Request limitation of processing
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, contact us at support@sumspos.com.

7. International Data Transfers

SumsPOS operates globally. Your data may be processed in jurisdictions outside your country of residence, including Kenya, where our primary servers are located. Where data is transferred internationally, we ensure appropriate safeguards are in place, including standard contractual clauses and adequacy assessments.

8. Children's Privacy

SumsPOS is a business tool and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will delete it promptly.

9. Third-Party Links

SumsPOS may contain links to third-party websites or services (payment providers, support tools). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 30 days before taking effect. The “Last Updated” date at the top of this page indicates the most recent revision.

11. Contact Us