Privacy Policy

DuQana is a point-of-sale and shop-management service for retail businesses in Kenya and East Africa. This policy covers the DuQana mobile app, the DuQana web app, and this website.

If you have a question about anything here, email info@duqana.co.ke.

We collect only what the service needs to work:

• Account details: your name, email address, phone number, and password (stored only as a salted hash, never in readable form).
• Shop details: business name, address, county and sub-county, currency, tax rate, and logo.
• Business records you enter: products, stock levels, sales, purchases, suppliers, expenses, and staff accounts.
• Financial transaction data: M-Pesa receipt numbers, amounts, payer phone numbers, and payment status for sales and subscription payments.
• Device information: a device identifier, platform, and push-notification token, used to deliver alerts and to enforce one-device-per-staff sign-in.
• Diagnostic information: error reports and basic usage timings, used to fix crashes.

We do not collect your customers' names, ID numbers, or addresses. We do not track your location in the background, and we do not read your SMS messages. Where an M-Pesa confirmation is used to recover a payment, you paste the message yourself.

• To run your shop: recording sales, tracking stock, producing reports and receipts.
• To take payment for your subscription, and to bill for staff seats.
• To send you alerts you asked for: low stock, daily summaries, shift reconciliation, renewal reminders.
• To keep accounts secure: rate-limiting sign-ins, detecting reused refresh tokens, and enforcing one active device per staff account.
• To support you when you contact us.

We do not sell your data, and we do not use it to build advertising profiles.

Only the providers needed to deliver the service:

• Safaricom (M-Pesa / Daraja): to request and confirm payments. They receive the payer phone number and amount.
• Google Gemini: to generate AI business insights and answer your questions in Ask DuQana. See below.
• Google Firebase: to deliver push notifications.
• Vercel and MongoDB Atlas: hosting and database infrastructure.
• Cloudinary: to store shop logos you upload.

DuQana's AI insights and the Ask DuQana assistant work by sending a summary of your business data to Google Gemini: aggregated sales totals, stock levels, expenses, and staff performance figures. This is a transfer of your business data to a third party, so we want to be exact about it:

• No customer personal data is ever included.
• AI features are off unless your shop has an active subscription, and an owner can switch DuQana AI off entirely from Profile at any time.
• When it is off, nothing is sent to Gemini at all.

The app shows the same summary to you before you turn the feature on, from the "What data does Gemini see?" link next to the switch.

You can close your account from the app (Profile → Delete my account) or from this page. Closure is scheduled 14 days ahead so a mistaken or malicious request can be undone; your account works normally until then and one tap cancels it.

After 14 days we permanently delete your user record, your password hash, and all sign-in sessions. If you are a shop owner, we also delete the shop, its subscription, and every staff account belonging to it, so please make sure that is what you intend.

What we keep: completed sales, purchases, expenses, and payment records are retained as business accounting records, with personal identifiers detached from them. A shop cannot lawfully erase its own tax and bookkeeping history because an app account was closed, and these records may be required by the Kenya Revenue Authority. They are no longer linked to you personally, and they are not used for any other purpose.

So the app keeps working without a signal, DuQana stores a copy of your recent products and any sales waiting to sync in a private database on your device. It is removed when you sign out or uninstall the app.

• See and correct your account details from Profile in the app.
• Export your sales data from Reports.
• Close your account and have your personal data deleted, subject to the bookkeeping retention above.
• Turn off push notifications and AI features independently.
• Ask us what we hold about you, by emailing info@duqana.co.ke.

These rights are provided under Kenya's Data Protection Act, 2019, and we will respond to any request within 30 days.

DuQana is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18.

If we change what we collect or who we share it with, we will update this page and its "last updated" date, and notify shop owners in the app before the change takes effect.