Welcome to Ushuru Flow. We respect your privacy and are committed to protecting the financial, business, and personal data you entrust to us. This Privacy Policy explains how Ushuru Flow Ltd ("Ushuru Flow," "we," "our," or "us") collects, uses, stores, and safeguards your information when you access our platform, application, and web services (the "Service").
We process personal data in accordance with the Kenya Data Protection Act, 2019 (DPA 2019) and applicable guidance issued by the Office of the Data Protection Commissioner (ODPC).
Introduction & Scope
Ushuru Flow is a software platform designed to assist Kenyan businesses and taxpayers in automating VAT reconciliation, document extraction, and tax return filing for the Kenya Revenue Authority ("KRA"). Because tax and financial operations involve sensitive documents, we uphold strict standards of data confidentiality, encryption, and operational integrity.
By registering for an account or using our Service, you acknowledge that you have read and understood this Privacy Policy.
Information We Collect
We collect information required to deliver automated tax reconciliation and filing services effectively:
A. Information You Provide Directly
- Account & Profile Data: Full name, business name, work email address, phone number, and account password hash.
- Tax Identity Information: KRA Personal Identification Number (PIN), VAT registration numbers, business registration status, and physical/postal address.
- Uploaded Financial Documents: Tax invoices, ETIMS receipts, CSV export files, bank statements, purchase ledgers, and credit notes uploaded for processing.
- Integrations & Auth Credentials: Encrypted tokens or authorization details provided when connecting third-party gateways (e.g., GavaConnect API or iTax helper tools).
B. Automatically Collected Technical Information
- Usage & Performance Data: IP address, device type, operating system, browser configuration, page views, document upload metrics, and error logs (collected via monitoring tools like Sentry).
- Authentication Logs: Timestamps of logins, session tokens, and security audit logs to protect your account against unauthorized access.
C. Payment & Billing Data
- When you purchase subscriptions or credits, payment processing is handled by licensed mobile money operators (e.g., M-Pesa) or payment gateways. We collect transaction IDs, billing status, and mobile phone numbers, but we do not store full card details or sensitive mobile money PINs on our servers.
How We Use Your Information
We use the data we collect for the following specific purposes:
- Delivering Tax Reconciliation: Extracting line-item data from invoices, running discrepancy matching against KRA records, and generating compliant VAT3 or TOT return files.
- Filing & Gateway Submission: Submitting authorized tax filings directly to KRA systems or GavaConnect gateways upon your explicit request.
- Account Management & Support: Verifying your identity, providing customer support, processing subscription billing, and communicating critical system notices.
- Platform Security: Detecting, preventing, and responding to security incidents, fraudulent uploads, or unauthorized logins.
- System Optimization: Monitoring system uptime, resolving software bugs, and enhancing extraction accuracy.
Legal Basis for Processing (Data Protection Act, 2019)
Under the Data Protection Act 2019, our legal bases for processing your personal and financial data include:
- Performance of a Contract: Processing is required to fulfill our obligation to prepare, reconcile, and file tax returns as requested by you.
- Legal Compliance: Meeting statutory requirements under Kenyan tax laws (including the Value Added Tax Act and Tax Procedures Act).
- Legitimate Interests: Securing our infrastructure, preventing fraud, and ensuring reliable performance.
- Consent: Where required for optional features, marketing communications, or specialized third-party integrations. You may withdraw consent at any time.
AI & Automated Data Extraction
Ushuru Flow uses automated optical character recognition (OCR) and machine learning models to read financial documents and structure transaction ledgers.
Strict Data Policy: Your uploaded invoices, financial documents, and business transactions are processed solely to provide service to you. We do NOT use customer financial data or business returns to train public or third-party AI models without explicit opt-in consent.
Sharing & Data Disclosure
We do not sell, rent, or trade your personal or financial data to third parties for advertising or commercial purposes. Data is shared only under the following limited circumstances:
- Government & Tax Authorities (KRA): Tax returns, VAT3 exports, and related figures are transmitted to KRA or through GavaConnect API gateways strictly when initiated and authorized by you.
- Trusted Infrastructure Service Providers: We work with vetted sub-processors for cloud hosting (e.g., Supabase, VPS hosting), error logging (Sentry), and transaction notification (SMS/Email providers). All sub-processors are bound by data processing agreements and strict confidentiality obligations.
- Legal Requirements: If required to comply with a valid legal order, court summons, or regulatory directive under Kenyan law.
- Business Transfers: In the event of a merger, acquisition, or asset sale, customer data may be transferred as a business asset, subject to this Privacy Policy.
Data Security & Encryption
We enforce technical and organizational security measures to protect your sensitive tax and financial data:
- Data in Transit: All data transmitted between your browser, our servers, and external APIs is encrypted using TLS 1.3 encryption.
- Data at Rest: Sensitive database fields, authentication tokens, and credentials are encrypted using industry-standard AES-256 encryption algorithms.
- Access Controls: System access is strictly restricted to authorized systems on a need-to-know basis, backed by multi-factor authentication and access logging.
Data Retention & Deletion
We retain your account and financial data for as long as your account remains active or as needed to provide the Service.
- Account Termination: Following account closure, your uploaded documents and return history remain accessible for export for 30 days, after which they are permanently deleted from active database storage.
- Statutory Record Keeping: Please note that under the Kenyan Tax Procedures Act, taxpayers are legally required to maintain books of accounts and tax records for at least five (5) years. Users remain independently responsible for maintaining archival copies of their tax returns.
- Aggregated Logs: Anonymized usage statistics and non-identifiable audit logs may be retained for security and operational analysis.
Your Data Rights
Under the Kenya Data Protection Act 2019, you have the following rights regarding your personal data:
- Right to Access: Request confirmation of what personal data we hold about you and receive a copy.
- Right to Rectification: Request correction of inaccurate or incomplete personal or business data.
- Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data when it is no longer necessary for the purposes for which it was collected.
- Right to Restrict Processing: Request temporary restriction of data processing under specific legal conditions.
- Right to Data Portability: Export your uploaded transactions, reconciliation reports, and generated return files in structured electronic formats (CSV / Excel / XML).
- Right to Object: Object to processing based on legitimate interests or direct marketing.
- Right to Lodge a Complaint: You have the right to raise concerns or lodge a formal complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya if you believe your rights have been infringed.
Cookies & Local Storage
We use essential cookies and browser local storage mechanisms:
- Session Authentication: Secure session cookies to maintain your login status.
- Preferences: Local storage keys (e.g. ushuru-theme) to remember your dark/light mode UI preferences.
We do not use intrusive third-party tracking cookies or cross-site behavioral ad scripts.
Cross-Border Data Transfers
To ensure high availability and robust data redundancy, primary or backup cloud servers may be located in secure data centres outside Kenya. When transferring data internationally, we ensure adequate safeguards are implemented in compliance with Section 48 of the Kenya Data Protection Act 2019.
Children's Privacy
Our Service is intended exclusively for businesses and adult taxpayers. We do not knowingly collect or solicit personal data from individuals under the age of 18.
Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our operational practices or legal obligations. We will notify you of material changes by updating the "Last updated" date at the top of this page and, where appropriate, sending an email notification or in-app announcement at least fourteen (14) days before changes take effect.
Contact Us & Data Protection Enquiries
If you have questions, concerns, or wish to exercise any of your rights under this Privacy Policy or the Kenya Data Protection Act 2019, please reach out to us:
Your trust is paramount to us. Ushuru Flow is dedicated to ensuring your business tax automation remains secure, compliant, and private.