Privacy policy

Last updated 5 November 2026

This explains what information BlueDuka keeps, why, who else sees it, how long we keep it and the rights you have under Kenya's Data Protection Act, 2019. It covers the website blueduka.co.ke, the BlueDuka app (in the browser, on Android, on iPhone and iPad and on Windows), shops' online shop pages and the BlueDuka API.

Who we are

This policy is from BlueDuka, Nairobi, Kenya ("BlueDuka", "we"). For anything about personal data (our data protection contact), email support@blueduka.co.ke, or call or WhatsApp +254 727 177 155, and say it is about privacy.

We play two roles:

For your account and your subscription (your login, your plan and payments to BlueDuka), we decide how the information is used: we are the data controller.
For the records a shop keeps in BlueDuka (its sales, its customers, its staff, its suppliers), the shop decides what to record and why, so the shop is the data controller and BlueDuka is its data processor: we keep and handle those records only to run BlueDuka for that shop, on its instructions. If you are a shop's customer or staff member, ask the shop first about your information; we will help the shop answer.

Your agreement

To create a BlueDuka account you must tick that you agree to this privacy policy and our terms of service. By ticking it you agree, and give your consent, to BlueDuka collecting, storing, using and transferring information as this policy describes, including keeping it with the providers named below, some of them outside Kenya. We record when you agreed and which version of this policy it was. You can withdraw a consent at any time by contacting us; that does not affect what was done before, and withdrawing it may mean BlueDuka can no longer be provided to you.

What we collect

Account details: your email address, phone number, name if you give it, your password (stored only as a one-way hash, which we cannot read back), and when you accepted these terms and this policy. For staff, which shop they belong to, their role, permissions and branches. If you choose "Continue with Google", Google tells us your name, your email address (and that Google has confirmed it) and your Google account number, which we keep to recognise you next time. We don't receive your Google password, contacts, files or anything else from your Google account.
Shop records: everything the shop enters or BlueDuka creates while it works: products, prices, stock, sales and receipts, payments, returns, expenses, purchases, suppliers, till shifts, the accounting books, invoices, documents and the shop's settings (name, location, KRA PIN, VAT status, payment details).
Information about a shop's customers: names, phone numbers, what they bought, what they owe and what they paid, and, for online shop orders, the delivery address or the map pin they chose. A customer whose order is complete may leave a review (stars and a comment); it shows on the shop's page with their first name and the first letter of their last name only, never their phone number. The shop can hide a review but not change it.
Information about a shop's staff: clock-in and clock-out times, pay settings, commissions, advances and payslips, and who did what in the shop (the activity log).
Payments: when you pay for a plan by M-Pesa we get the phone number used, the amount and Safaricom's receipt number. When a shop connects its own M-Pesa till or paybill, we get the payer's phone number or name as Safaricom sends it, the amount and the transaction code. We never see or keep an M-Pesa PIN, and BlueDuka does not take card numbers.
Connection keys: keys a shop gives us to connect its own M-Pesa till or paybill, KRA eTIMS or other services. We keep them encrypted and use them only for that shop's connection.
Devices and security: the internet (IP) address a request comes from, which we use to stop password guessing and abuse; an identifier for each Windows computer a shop registers; and, if you turn on notifications, the address your browser's push service gives us.
Location: only a shop location the owner sets on the map, and a delivery pin a customer chooses when ordering. BlueDuka does not track where you or your phone are.
Messages with us: what you send when you call, WhatsApp or email support.

Why we use it

To provide BlueDuka: log you in, keep the shop's records, make receipts, invoices, reports and books, send receipts to KRA eTIMS and confirm payments, when the shop has switched those on (performance of our contract with you).
To take payment for plans and keep billing records (contract, and our legal duties to keep accounts).
To keep BlueDuka and your account safe: login limits, detecting fraud and misuse, the activity log, investigating problems (our legitimate interest in a secure service, and the shop's).
To send emails you need: confirming your email address, password reset codes and staff invitations.
To send notifications you switch on on your device, such as new online orders (consent, which you can withdraw at any time).
To send the debt reminders a shop chooses to send its own customers, on the shop's behalf (the shop's legitimate interest in being paid what it is owed). A customer who does not want reminders should tell the shop.
To make the BlueDuka Credit Score and certified credit reports the owner asks for (see below). The score is worked out automatically from the shop's own records and describes the business, not its customers. BlueDuka makes no decision about anyone with it; a lender who sees a report decides for itself.
To answer you when you contact us, and to obey the law, court orders and lawful requests from authorities.

We do not sell personal information, we do not show advertising, and we do not use shops' records to market to their customers.

Who else sees it

People in the shop. The owner, and staff the owner invites, see what their role and permissions allow. An outside accountant the owner invites sees the shop's books and reports.
Services that run BlueDuka for us (our processors), only for that purpose: Railway (servers and database), Cloudflare (the website, the app's files and the Windows download), Resend (sending emails), Africa's Talking (text-message reminders, when used), OpenStreetMap (map pictures and finding an address on the map) and the push services of browser makers such as Google, Mozilla and Apple (notifications, when turned on), and Google (when you sign in with Google: it confirms who you are). The app also loads its fonts and display engine from Google's servers. Scanning barcodes with the camera happens on your own phone or in your own browser: the camera picture is not sent to BlueDuka or anyone else, only the code it reads.
Services a shop connects: Safaricom (M-Pesa) and the Kenya Revenue Authority (eTIMS) receive what is needed for each payment or receipt, such as the amount, the phone number for a payment prompt, and for eTIMS the items, totals and, if the shop recorded them, the buyer's name, phone number and KRA PIN. Safaricom also handles payments for BlueDuka plans.
Lenders, only when the owner chooses. A certified credit report is shared by the owner. Anyone who has its serial number can check online that it is genuine and see the figures printed on it, until it expires or the owner withdraws it.
The marketer who referred you, if you created your account through a BlueDuka marketer's link or code: they see your email address partly hidden, the name of your first shop, whether you created a shop and which plan you first paid for, and the commission it earned them. Nothing else about your shop.
Meta (Facebook), only if you accept cookies on our website: that you visited, which page, and your browser's details, to measure our adverts. Never anything from inside the app or about your shop.
Authorities when Kenyan law requires it, and others when needed to protect people's safety or our legal rights.
A buyer of BlueDuka, if the business is ever sold, under the same promises as this policy.

Storage outside Kenya

Some of the services above, such as Railway, Cloudflare, Resend and Meta, keep data on servers outside Kenya. We transfer data abroad because it is needed to provide BlueDuka to you, with the consent you give when you create your account, to providers that protect it with encryption, access controls and contracts, and we send only what each service needs, as the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021 require. BlueDuka is not designed to hold sensitive personal data (such as health information), so shops should not record it.

How we protect it

All connections use HTTPS. Passwords are stored only as hashes; connection keys are encrypted.
Each shop's records are kept apart: every request is checked against the person's membership and permissions, and removed staff lose access on their very next request.
Repeated wrong passwords lock the login for a while; login tokens expire and can be used only once to renew.
Important changes are written to an activity log that cannot be edited.
Only people working on BlueDuka who need it can reach the live data, and only to run and support the service.

No system is perfectly secure. If a breach is likely to put your information at real risk, we tell the Data Commissioner within 72 hours of learning of it and the people affected as soon as we practically can. For records we keep for a shop, we tell the shop within 48 hours, so it can meet its own duties.

How long we keep it

A shop's records are kept while the shop uses BlueDuka, on any plan: ending a paid plan does not delete anything. When an owner asks us to close the shop and delete its records, we do so, except what we must keep by law. Businesses in Kenya must generally keep their business and tax records for five years, so we may keep a copy of the shop's records for that long after closing unless the owner has taken a full copy and asks us to delete it sooner.
Our own billing records are kept for as long as the tax laws require.
Security records are kept briefly: counts of wrong passwords for up to an hour, API request logs for 90 days, webhook delivery logs for 30 days.
Staff removed from a shop lose access at once; what they did stays in the shop's records and activity log.
Deleted information can remain in our backups until those backups are replaced in the normal cycle.

Your rights

Under the Data Protection Act, 2019 you may ask to: be told how your information is used; get a copy of it; correct it; delete it; object to or limit how it is used; receive it in a format you can take elsewhere; and withdraw consent you gave; and not to be subject to a decision based only on automated processing that seriously affects you. Owners can export much of the shop's information themselves (for example the books as spreadsheet files and stock lists), and can ask us to close the shop and delete its records. For these requests email support@blueduka.co.ke, or call or WhatsApp +254 727 177 155. We answer within the times set by the Data Protection (General) Regulations, 2021, may ask you to prove who you are first, and may keep what the law requires us to keep.

If you are a shop's customer or staff member, the shop controls those records, so ask the shop; we will help it. If you are not happy with our answer, you can complain to the Office of the Data Protection Commissioner.

Cookies and what is kept on your device

The website (blueduka.co.ke) asks separately before loading optional analytics or advertising tags. You can decline both, allow analytics only, or accept both. If you allow analytics and GA4 is configured for the site, Google Analytics 4 records page paths and events such as registration-button clicks, pricing and demo link clicks, WhatsApp enquiry clicks, completed email sign-ups and confirmed subscription payments. We do not send account email addresses, phone numbers, shop names or business records in these events. Google handles the analytics data under its own privacy terms. If you allow advertising, Meta's pixel records page visits so we can measure Facebook and Instagram adverts; Meta handles that under its own privacy policy. No optional analytics or advertising tag is loaded before the matching choice, or when you decline it. You can change your choice at any time with Cookie settings at the bottom of every page; your choice is kept in your browser. Our demo video comes from YouTube (Google): its preview picture is loaded from YouTube's servers, and the video itself, in YouTube's privacy-enhanced mode, only loads when you press play; YouTube then handles it under Google's privacy policy. The BlueDuka app itself never loads Meta's pixel. On the web app, a completed sign-up is sent to GA4 only when analytics is configured and you have allowed analytics. The app keeps your login on your device so you stay signed in, and remembers settings such as the receipt printer. The Windows and Android apps, and BlueDuka installed from the browser (added to an iPhone's Home Screen, or installed from Chrome or Edge), keep a copy of the business's data on that device so it can sell without internet, and upload what was done offline when the connection returns. The copy is kept in the app's private storage on the device; anyone who can unlock the device could reach it, so lock phones and computers and remove lost devices on the app's Computers page. A plain browser tab keeps no such copy. On a shared computer, log out when you finish.

Referral programme (BlueDuka Growth Network)

If you open a BlueDuka partner's link (a marketer, business ambassador, content creator or business partner), the website keeps their code in your browser for 30 days so the sign-up can fill it in. When you create your account we record which marketer referred you, when you opened the link and the internet address used, to pay the marketer and to stop fake or self-referrals. People who apply to be marketers give us their name, phone number, location and experience; we use them to review the application, to pay commissions by M-Pesa and to keep the records the law requires. Commission and payout records are kept like other financial records. When a partner makes a tracking link for a video, post or event, we count how often it is opened and record which link an account came from, so the partner sees which content works; we don't record who opened it. A partner can choose to appear on the public leaderboard: it then shows the name they chose, their town, partner type, level and how many paying businesses they brought, never their earnings, phone number or email, and they can switch it off at any time. Businesses a partner brought are never named on the leaderboard. Interns who complete the marketing internship get a certificate with its own number. Anyone who has that number (it is printed on the certificate and in its QR code) can open BlueDuka's check page, which shows the name on the certificate, the internship dates and whether it is genuine. The page is not listed or searchable, and we keep certificate records so a certificate can still be checked years later.

Children

BlueDuka is for businesses and is not meant for anyone under 18. Shops should not record children's information beyond what a normal sale needs.

Changes

When we change this policy we update the date at the top. If a change affects how your information is used in an important way, we tell owners in the app or by email before it applies.