Privacy Policy

1. Who we are

Flakes Digital Solutions (“we”, “us”, “our”), a business registered in Kenya under registration number BN-MJS7ZA2M, of Westend Towers, Chiromo Lane, Westlands, Nairobi, Kenya, makes and operates Ecosys360 Retail & Ops Suite (the “Service”), a multi-tenant business platform for retail and operations — point of sale, catalog, inventory, accounting, HR, payroll, logistics, ecommerce and related modules.

For personal data about platform accounts, sign-in, billing, security logs and support conversations, we are the data controller under the Kenya Data Protection Act, 2019 (the “Act”). For the business records your organisation keeps in the Service, we are a data processor acting for your organisation (see section 4).

Privacy contact (data protection lead): app.flakescapital@gmail.com, phone +254 717 053 207.

2. Scope of this notice

This Privacy Policy explains how we process personal data when you visit our websites, create an account, join a workspace (tenant), use the Service as a staff user, pay for the Service, or contact us.

It does not replace your organisation’s own privacy notices to its customers, employees or suppliers. Your organisation is responsible for telling those people how it uses their data.

3. Personal data we collect as controller

Depending on how you use Ecosys360, we may collect:

• Identity and contact data — full name, email address, phone number, organisation or trading name, and job title or role labels
• Account and sign-in data — hashed passwords, session tokens, roles, memberships, preferences and profile fields
• Workspace data — workspace name and address, enabled modules, branch labels, approval status, plan and billing status
• Usage and technical data — IP address, approximate location derived from IP, device and browser type, pages and features used, timestamps, error and security logs
• Trial-abuse prevention signals — a first-party device cookie, a hashed browser fingerprint, hashed phone/email/business identifiers, and payment references (for example the M-Pesa number used to confirm a trial). We keep keyed hashes and short hints (such as the last four digits of a phone), not raw card numbers or full fingerprints
• Communications — emails, WhatsApp or phone conversations, and support requests you send us
• Payment data — plan, invoices, payment references and transaction status from M-Pesa, Paystack or other payment providers. We never store full card numbers or CVV codes
• Legal acceptance records — when you accepted the Terms, this Privacy Policy, the Cookie Policy and the Data Processing Addendum, and which version

4. Your organisation’s business data (our processor role)

When your organisation stores operational records in Ecosys360 — POS customers, sales, inventory, employees, payroll inputs, suppliers, shoppers or uploaded files — your organisation is the data controller and we are its data processor under the Act. We process that data only on your organisation’s instructions, as set out in the Data Processing Addendum.

Your organisation must have a lawful basis for that data, give the required notices to the people concerned, and register with the Office of the Data Protection Commissioner where the law requires it.

If you are a customer or employee of a business that uses Ecosys360 and want to access, correct or delete your data, contact that business first. We will help them respond.

5. Whether you must give us your data

Your name, email address, phone number and a password are required to create an account, and workspace and billing details are required to run a workspace. Without them we cannot provide the Service.

Everything else — such as a profile photo, job title or optional product feedback — is voluntary. Product analytics is optional and can be switched off on the Cookie Policy page.

6. How we collect data

We collect personal data:

• From you — when you sign up, complete onboarding, update your profile, pay, or contact support
• From your organisation’s administrators — when they invite you, assign roles, or configure your membership
• Automatically — through cookies, local storage, server logs and security monitoring when you use the Service
• From service providers — for example payment providers confirming whether a payment succeeded

7. Why we use your data and our lawful basis

Under section 30 of the Act we process personal data only where we have a lawful basis. Our purposes and bases are:

• Providing the Service — creating accounts and workspaces, signing you in and delivering the modules you enable — performance of our contract with you
• Billing, invoicing and keeping financial records — performance of the contract, and compliance with legal obligations such as tax record-keeping
• Security, fraud and trial-abuse prevention, rate limiting and investigating incidents — our legitimate interest in protecting the Service and our customers, balanced against your rights
• Understanding and improving the product with analytics — our legitimate interest, and you can switch analytics off at any time on the Cookie Policy page
• Service messages you need, such as security alerts, billing notices and changes to these terms — performance of the contract
• Marketing messages about new features or offers — only with your consent, or as otherwise allowed by section 37 of the Act, with an easy way to opt out in every message
• Complying with the law, responding to lawful requests from authorities, and establishing or defending legal claims — legal obligation and legitimate interests

8. Sensitive personal data

We do not ask platform users for sensitive personal data as defined in the Act (for example health, ethnic origin, religion, biometric or genetic data).

HR and payroll modules may let your organisation record information about its staff that is sensitive, such as sick leave or medical information. Your organisation, as controller, must have a ground under sections 44 to 46 of the Act before recording it. We protect that data as processor and do not use it for any purpose of our own.

9. Children

Ecosys360 is for businesses. You must be 18 or older to create an account, and we do not knowingly collect data from anyone under 18.

If your organisation records data about a child (for example a staff member’s dependant for payroll), it must first obtain the consent of the child’s parent or guardian as required by section 33 of the Act.

If you believe a child has given us personal data, contact app.flakescapital@gmail.com and we will delete it.

10. Who we share data with

We do not sell personal data. We share it only with service providers who help us run the Service, under contracts that require them to protect it and use it only on our instructions:

• Hosting — Contabo (servers and databases)
• Product analytics — PostHog, only if you have not switched analytics off
• Payments — Safaricom (M-Pesa Daraja), Paystack, UMS Pay and KCB, for platform billing and, where your workspace sets them up, your own customer payments
• Email delivery and push-notification services
• AI model providers (for example OpenAI, Anthropic, Google Gemini, DeepSeek, Groq, Mistral, OpenRouter, Together or xAI) — only when your workspace uses the AI assistant or briefings, and only the prompt and the data needed to answer it
• Map tiles — OpenStreetMap, when you view embedded maps
• Professional advisers (lawyers, accountants, auditors) under a duty of confidentiality
• Authorities such as the Kenya Revenue Authority, the Office of the Data Protection Commissioner, the police or the courts, when the law requires it

11. Transfers outside Kenya

Some of these providers store or process data outside Kenya. For example, our hosting provider Contabo operates data centres in Europe and other regions, PostHog processes analytics in the United States, Paystack is based in Nigeria, and AI model providers are mostly in the United States.

We transfer personal data out of Kenya only as sections 48 to 50 of the Act allow: where the recipient gives appropriate safeguards for the data (such as a written contract with data-protection terms), where the transfer is necessary to perform our contract with you or your organisation, or with your consent. We transfer sensitive personal data out of Kenya only with consent and appropriate safeguards.

To learn which countries your data goes to and the safeguards we use, contact app.flakescapital@gmail.com.

12. How long we keep data

We keep personal data only as long as we need it for the purposes above, as section 39 of the Act requires, and then delete or anonymise it.

• Account and workspace data — while your account or workspace is active, and for up to 12 months after closure for security and dispute handling
• Invoices, payments and other records of our own billing — at least five years, as Kenyan tax law requires
• Trial-abuse signals — while needed to prevent repeat free trials and fraud, and no longer than three years after your last trial
• Security and access logs — normally up to 12 months, unless an investigation or legal hold needs them longer
• Your organisation’s business data — as instructed by your organisation and set out in the Data Processing Addendum

13. How we protect data

We protect personal data with measures suited to the risk, as the Act requires, including encrypted connections (HTTPS/TLS), hashed passwords, encrypted storage of provider API keys, role-based access, separation between workspaces, and monitoring for abuse.

If a personal data breach creates a real risk of harm, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, as section 43 of the Act requires, and tell affected people as soon as reasonably possible with advice on protecting themselves. Report a suspected security problem to app.flakescapital@gmail.com.

Keep your password safe, sign out on shared devices, and tell us straight away if you think someone else has used your account.

14. Your rights

Under the Act you have the right to:

• Be informed of how your personal data is used — which is the purpose of this notice
• Access the personal data we hold about you and get a copy
• Object to our processing of all or part of your personal data, including for marketing
• Have false or misleading data corrected
• Have false, misleading or unlawfully processed data deleted
• Ask us to restrict processing, for example while we check the accuracy of your data
• Receive your data in a structured, commonly used, machine-readable format and have it sent to another service (data portability)
• Not be subject to a decision based only on automated processing that significantly affects you — see section 16
• Withdraw consent at any time where we rely on consent, without affecting processing that happened before
• Complain to the Office of the Data Protection Commissioner (ODPC) (https://www.odpc.go.ke) if you are unhappy with how we handle your data

15. How to use your rights

Email app.flakescapital@gmail.com with enough detail for us to confirm your identity and find your records. We do not charge for requests unless the law allows it (for example for manifestly unfounded or repeated requests).

We respond within the time limits set by the Data Protection (General) Regulations, 2021. If we cannot meet a request in full, we will tell you why and how to complain to the Data Protection Commissioner.

For data a business keeps about you in its Ecosys360 workspace (for example as its customer or employee), contact that business first. We will help it respond.

16. Automated decisions

To stop repeat free-trial abuse, our systems check new workspaces against trial-abuse signals. If the check flags a signup, the trial may need a small M-Pesa confirmation (credited to your future subscription) or a review by our staff.

You have the right to ask a person to review any automated trial decision. Email app.flakescapital@gmail.com and a member of our team will look at it and explain the outcome. We make no other decisions about you based only on automated processing.

17. AI assistant (Bee)

When your workspace uses the AI assistant (“Bee”) or executive briefings, we send your prompt and the data needed to answer it to the AI model providers configured for the platform or your workspace. We do this only when you ask a question or request a briefing; business data is not streamed to AI providers continuously.

AI answers can be wrong or incomplete. They are support for your own judgement, not professional accounting, legal, tax, payroll or financial advice.

18. Links and integrations

The Service links to and integrates with third-party services such as Safaricom M-Pesa. Their own privacy policies govern what they do with your data outside our instructions.

19. Changes to this policy

We may update this Privacy Policy. The “Last updated” date and version change when we do. For material changes we will give you notice in the Service or by email before they take effect.

Last updated: 29 September 2026.

20. Contact

Flakes Digital Solutions, Westend Towers, Chiromo Lane, Westlands, Nairobi, Kenya. Email app.flakescapital@gmail.com, phone +254 717 053 207.

You can also contact the Office of the Data Protection Commissioner (ODPC) at https://www.odpc.go.ke.