PRIVACY POLICY.
Last updated 17 October 2026
Iveson keeps your shop's data private, uses it only to run Iveson POS, and never sells it.
Who we are
Iveson POS is run by Amon Mwirikia under Iveson, Kenya. Contact: [email protected] or WhatsApp +254 742 702 670.
Our two roles
- Shop owners and their accounts: Iveson is the data controller. We decide how this data is used, and this policy covers it.
- A shop's staff, customers, suppliers and bookings: the shop is the data controller and Iveson is its data processor. We handle this data only on the shop's instructions, under the Data Agreement in our Terms of Service. If you are a shop's customer, contact the shop first. We will help it answer you.
What we hold
| Whose data | What | Why |
|---|---|---|
| Shop owners | Name, email, phone, business name and location, plan, payments to Iveson, sign-in records | To run your account, bill you, support you and keep the account secure |
| A shop's staff | Name, role, 4-digit PIN (stored only in scrambled, "hashed" form), sales made, commission, and salary and advances if the shop uses payroll | The shop's own records |
| A shop's customers | Name, phone, purchases, credit balance, loyalty points, preferred stylist, bookings and booking notes | The shop's own records |
| A shop's suppliers | Names, contacts, orders and payments | The shop's own records |
| People booking online | Name, phone, chosen service and time, and any note they type | To place the booking with the shop |
| Website and app visitors | Device and browser type, pages visited (counted without cookies), and an error report when something breaks | To keep the service working and secure |
Shops should not put health details (such as allergies) or ID numbers into notes. If a shop must, it needs the person's clear consent, because Kenyan law treats health data as sensitive.
What we never do
- Sell, rent or trade personal data.
- Use a shop's customers' data for Iveson's own marketing.
- Show one shop's data to another shop.
- Touch customers' money: M-Pesa payments go straight to the shop's own Till or Paybill.
Who helps us run the service
| Provider | What it does for us | Where the data is |
|---|---|---|
| Supabase | Database, sign-ins, backups | European Union (Frankfurt, Germany) |
| Cloudflare | Hosts the app and website, checks sign-ins for bots, counts visits without cookies | Worldwide network |
| Sentry | Error reports when the app breaks; phone numbers, M-Pesa codes and emails are removed first | European Union (Germany) |
| Resend | Sends sign-in and password emails | European Union (Ireland) |
| Safaricom | M-Pesa, using the shop's own Till or Paybill | Kenya |
| Google Fonts and unpkg | Deliver fonts and code libraries; they see a device's internet address when the app loads | Worldwide |
Each provider gets only what it needs and is bound by its own data-protection terms. We will update this list before adding any new provider, such as an SMS service for appointment reminders.
Storage outside Kenya
Our database and error reports are stored in the European Union (Germany), outside Kenya, and Cloudflare's network is worldwide. The Data Protection Act allows this with proper safeguards. We rely on each provider's data-protection agreement and security commitments.
How long we keep data
- While a shop uses Iveson POS: for as long as the account is open.
- After a shop leaves: until the owner asks us to delete it, or 12 months after the account ends, whichever comes first. We send two reminders before deleting. The owner can download a full copy at any time from Settings.
- Backups: daily copies are deleted after 14 days, so deleted data is fully gone within about three weeks.
- Error reports: Sentry deletes them after 30 days.
- Iveson's own billing records: as long as Kenyan tax law requires.
How we protect data
- Encrypted connections (HTTPS) everywhere; the database is encrypted on disk.
- Database rules keep each shop's data separate from every other shop's.
- Staff PINs are stored only in scrambled form, and lock after 5 wrong tries.
- Owner sign-in has a bot check.
- Iveson looks at a shop's data only to fix a problem or when the shop asks.
If something goes wrong
If a breach affects personal data, we tell the affected shops without undue delay and help them decide what to do. Where the law requires, we tell the Office of the Data Protection Commissioner (ODPC) within 72 hours.
Your rights
Under Kenya's Data Protection Act 2019 you can ask to know what data is held about you, get a copy, have wrong data corrected, have data deleted, and object to its use. Shop customers and staff should ask the shop; shop owners can email [email protected]. We answer as soon as we can. You can also complain to the ODPC.
Changes to this policy
We will tell shops in the app or by email at least 30 days before an important change.
See also our Refund & Cancellation Policy.