Privacy notice

Your licence key; your email address, which we keep only as a hash (a one-way fingerprint) so support can find your licence; a random device identifier for each activated device; the edition you bought; and dates. Purpose: to issue your licence, activate it on up to 3 devices and help you if something goes wrong. Basis: performance of our contract with you. Giving an email is required to buy: without it we can't deliver your licence.

Card purchases are sold by Polar as merchant of record: Polar collects your card and billing details under its buyer terms, and we never see your card number. M-PESA purchases are processed by Paystack, which receives your phone number, email and the payment reference. From them we receive the order or reference, the amount, your email and the business name you enter. Basis: our contract with you, and our legal duty to keep sales records for tax.

With a Standard or Pro licence, the app backs up your books to our cloud storage about once a day while it is open, unless you turn this off. It is the same file as a backup you save yourself: encrypted on your device with AES-256-GCM before it is sent, and opened only by your passphrase or recovery key. We never receive either of them, so neither we nor Cloudflare can read your books. What we can read is the file's unencrypted label: your business name, when the copy was made, the app version and the country edition. With it we keep the file's size, when it arrived, your licence ID and a random ID for the business. The copies are stored with Cloudflare R2 in Western Europe.

We keep the newest copy of each of the last 7 days you backed up and one copy a month for the last 12 months, and delete older copies automatically. If your licence is refunded or revoked, we delete its backups 90 days later. You can delete them yourself at any time in the app (Settings, Backups, Delete my cloud backups) or ask us to delete every copy for your licence. Basis: our contract with you, for the backup included in your licence.

The Assistant answers questions about your books and can propose changes to them. Your books stay on your device: when the Assistant needs something, it asks the app, and the app answers from your device with only what that question needs (for example a month's totals, or the transactions that match). What leaves your device: your messages, any receipt photo or document you attach, and those answers. Never your whole books, your backups or your passwords. They go through our server and Cloudflare, our infrastructure provider, to an AI service provider we contract with in the USA, which writes the reply. Our contracts don't allow AI service providers to train on your data or keep it (zero data retention), and neither Cloudflare nor we log it on the way.

We keep each conversation (your messages, the Assistant's replies and the answers from your books) in Convex so it can continue where it left off, and delete it 30 days after you last used it, or straight away when you delete it in the app. Customer and supplier names can contain personal data: in Settings you can stop the app sending them, and it then sends stable stand-ins such as "Customer A". No change is made to your books until you approve it (or turn on automatic changes for that kind yourself), and you can undo most changes. You can switch the Assistant off entirely. Basis: our contract for the service you use, and your consent when you switch it on (Kenya DPA s.49 for any sensitive data processed outside Kenya).

For the one-off tasks of reading a receipt and sorting transactions, only the text or image you choose to send (for example the descriptions and amounts of selected transactions, and your category names) goes through our server and Cloudflare to an AI service provider we contract with in the USA, on the same terms: no training on it, not kept, not logged. Nothing is sent until you start a task, and the app shows its cost first. M-PESA descriptions can contain other people's names and phone numbers: only send lines you are comfortable sharing for this purpose. Basis: your consent, given when you run the task (Kenya DPA s.49 for any sensitive data processed outside Kenya), and our contract for the task you buy.

Your licence ID, credit balance, the type of task, the AI model used, how many tokens it processed and the credits it used. If you pay by card, Polar also receives these usage figures (never the content) to show them on your Polar account. Basis: contract. Usage records are deleted after 13 months.

When you ask the app to, our server passes your request to KRA's official services (GavaConnect) and returns KRA's answer to your device: checking a KRA PIN (yours, or a customer's or supplier's), checking a supplier's eTIMS invoice by its number and date, and fetching your tax obligations. To file a turnover tax or nil return through Hesafi, you first prove the PIN is yours: you type the ID number registered with it, KRA confirms the match, and we keep only the PIN, how it was confirmed and when. We never store the ID number. When you file, KRA receives your PIN, the period and, for turnover tax, your gross turnover; you confirm these figures before anything is sent.

We keep a record that each filing happened (PIN, type of return, period and whether KRA accepted it) so a return is never filed twice. The amounts, KRA's acknowledgement number and the payment number (PRN) stay on your device. Basis: our contract for the service you ask for. KRA uses what it receives under Kenyan tax law.

If you turn on eTIMS invoicing, each invoice or credit note you issue is sent through our server to KRA's eTIMS so KRA can sign it: your PIN and branch, the items with their KRA codes, quantities, prices and tax, the payment type, and your customer's PIN and name if you entered them. The app also sends the stock movements and supplier purchases eTIMS requires for goods. We keep your eTIMS device details and an encrypted device key, and for each document only its reference, status and when it was sent, to count your plan's documents. We do not keep the contents of your invoices. Basis: our contract, and your legal obligation to issue invoices through eTIMS.

We use Meta's tools to learn which of our ads bring people who go on to use Hesafi. On this website: Meta Pixel cookies (_fbp, _fbc), the pages you view and buttons you tap (never on the M-PESA converter or invoice generator pages). From the app and our server, through Meta's Conversions API: that you set up your books, started or completed a purchase, and the price of a licence you buy, with your IP address, browser user agent, a random device id and, when you have given it to us, your email or phone number as a hash. Purpose: measuring and improving our ads on Facebook and Instagram. Basis: our legitimate interest in knowing which advertising works, balanced by the small amount of data involved and your right to object (Kenya DPA s.30(1)(b); POPIA s.11(1)(f)). You accept this notice with our terms of use before you use the app. We never send Meta anything from your books: no amounts you record, no customers, no statements.

You can object at any time. In this browser, use the button on the cookie policy. To change how we measure ads for you, or to stop it on all your devices, write to ask@hesafi.com. To recognise your devices we match your email, your phone number or the random device id the app uses; we'll help you find it when you write. We then stop sending events about you. Where the law of your country requires your consent first (for example in the European Union), we ask for it before anything is measured.

If you message us on WhatsApp or by email, we keep the conversation to help you. WhatsApp is operated by Meta. Please don't send us your backup passphrase, recovery key or statement passwords.

Our product analytics and error monitoring run on our own infrastructure provider (Cloudflare) to understand which features work and diagnose failures. We send a hashed installation identifier, feature-use categories, app and device categories, and scrubbed technical errors; never book contents, names, contact details or tax PINs, and never session recordings. You can ask us to stop at ask@kasilabs.com.

Cloudflare processes your IP address to deliver this website and protect it from abuse (rate limiting). Request logging on our server is switched off.

If you turn on sync for a business, each change you make is encrypted on your device with a key that only your devices hold, and stored in Convex until your other devices have it. We cannot read the changes, the business name or the key. What we can see: your licence, a one-way fingerprint of each synced device, its browser name (for example "Chrome on Android"), when it last synced and how far it has caught up, and the size and time of each encrypted change. The key is also stored locked with your backup recovery key, so a new device can join with it. Basis: our contract for the service you turn on.