Privacy policy

Last updated 14 October 2026

This explains what information BlueDuka keeps, why, who else sees it, how long we keep it and the rights you have under Kenya's Data Protection Act, 2019. It covers the website blueduka.co.ke, the BlueDuka app (in the browser, on Android and on Windows), shops' online shop pages and the BlueDuka API.

Who we are

This policy is from BlueDuka, Nairobi, Kenya ("BlueDuka", "we"). To reach us about privacy, email support@blueduka.co.ke, or call or WhatsApp +254 727 177 155.

We play two roles:

For your account and your subscription (your login, your plan and payments to BlueDuka), we decide how the information is used: we are the data controller.
For the records a shop keeps in BlueDuka (its sales, its customers, its staff, its suppliers), the shop decides what to record and why, so the shop is the data controller and BlueDuka is its data processor: we keep and handle those records only to run BlueDuka for that shop, on its instructions. If you are a shop's customer or staff member, ask the shop first about your information; we will help the shop answer.

What we collect

Account details: your email address, phone number, name if you give it, and your password (stored only as a one-way hash, which we cannot read back). For staff, which shop they belong to, their role, permissions and branches.
Shop records: everything the shop enters or BlueDuka creates while it works: products, prices, stock, sales and receipts, payments, returns, expenses, purchases, suppliers, till shifts, the accounting books, invoices, documents and the shop's settings (name, location, KRA PIN, VAT status, payment details).
Information about a shop's customers: names, phone numbers, what they bought, what they owe and what they paid, and, for online shop orders, the delivery address or the map pin they chose.
Information about a shop's staff: clock-in and clock-out times, pay settings, commissions, advances and payslips, and who did what in the shop (the activity log).
Payments: when you pay for a plan by M-Pesa we get the phone number used, the amount and Safaricom's receipt number. When a shop connects its own M-Pesa till or paybill, we get the payer's phone number or name as Safaricom sends it, the amount and the transaction code. We never see or keep an M-Pesa PIN, and BlueDuka does not take card numbers.
Connection keys: keys a shop gives us to connect its own M-Pesa till or paybill, KRA eTIMS or other services. We keep them encrypted and use them only for that shop's connection.
Devices and security: the internet (IP) address a request comes from, which we use to stop password guessing and abuse; an identifier for each Windows computer a shop registers; and, if you turn on notifications, the address your browser's push service gives us.
Location: only a shop location the owner sets on the map, and a delivery pin a customer chooses when ordering. BlueDuka does not track where you or your phone are.
Messages with us: what you send when you call, WhatsApp or email support.

Why we use it

To provide BlueDuka: log you in, keep the shop's records, make receipts, invoices, reports and books, send receipts to KRA eTIMS and confirm payments, when the shop has switched those on (performance of our contract with you).
To take payment for plans and keep billing records (contract, and our legal duties to keep accounts).
To keep BlueDuka and your account safe: login limits, detecting fraud and misuse, the activity log, investigating problems (our legitimate interest in a secure service, and the shop's).
To send emails you need: confirming your email address, password reset codes and staff invitations.
To send notifications and reminders you switch on, such as new online orders or debt reminders the shop sends its customers (consent, which you can withdraw in the app at any time).
To make the BlueDuka Credit Score and certified credit reports the owner asks for (see below).
To answer you when you contact us, and to obey the law, court orders and lawful requests from authorities.

We do not sell personal information, we do not show advertising, and we do not use shops' records to market to their customers.

Who else sees it

People in the shop. The owner, and staff the owner invites, see what their role and permissions allow. An outside accountant the owner invites sees the shop's books and reports.
Services that run BlueDuka for us (our processors), only for that purpose: Railway (servers and database), Cloudflare (the website, the app's files and the Windows download), Resend (sending emails), Africa's Talking (text-message reminders, when used), OpenStreetMap (map pictures and finding an address on the map) and the push services of browser makers such as Google, Mozilla and Apple (notifications, when turned on). The app also loads its fonts and display engine from Google's servers.
Services a shop connects: Safaricom (M-Pesa) and the Kenya Revenue Authority (eTIMS) receive what is needed for each payment or receipt, such as the amount, the phone number for a payment prompt, and for eTIMS the items, totals and, if the shop recorded them, the buyer's name, phone number and KRA PIN. Safaricom also handles payments for BlueDuka plans.
Lenders, only when the owner chooses. A certified credit report is shared by the owner. Anyone who has its serial number can check online that it is genuine and see the figures printed on it, until it expires or the owner withdraws it.
Authorities when Kenyan law requires it, and others when needed to protect people's safety or our legal rights.
A buyer of BlueDuka, if the business is ever sold, under the same promises as this policy.

Storage outside Kenya

Some of the services above keep data on servers outside Kenya. We use providers that protect the data with encryption and contracts, and we send only what each service needs, as the Data Protection Act requires for such transfers.

How we protect it

All connections use HTTPS. Passwords are stored only as hashes; connection keys are encrypted.
Each shop's records are kept apart: every request is checked against the person's membership and permissions, and removed staff lose access on their very next request.
Repeated wrong passwords lock the login for a while; login tokens expire and can be used only once to renew.
Important changes are written to an activity log that cannot be edited.
Only people working on BlueDuka who need it can reach the live data, and only to run and support the service.

No system is perfectly secure. If a breach puts your information at real risk, we will tell the shops and people affected and the Data Commissioner, as the law requires.

How long we keep it

A shop's records are kept while the shop uses BlueDuka, on any plan: ending a paid plan does not delete anything. When an owner asks us to close the shop and delete its records, we do so, except what we must keep by law. Businesses in Kenya must generally keep their business and tax records for five years, so we may keep a copy of the shop's records for that long after closing unless the owner has taken a full copy and asks us to delete it sooner.
Our own billing records are kept for as long as the tax laws require.
Security records are kept briefly: counts of wrong passwords for up to an hour, API request logs for 90 days, webhook delivery logs for 30 days.
Staff removed from a shop lose access at once; what they did stays in the shop's records and activity log.

Your rights

Under the Data Protection Act, 2019 you may ask to: be told how your information is used; get a copy of it; correct it; delete it; object to or limit how it is used; receive it in a format you can take elsewhere; and withdraw consent you gave. Owners can export much of the shop's information themselves (for example the books as spreadsheet files and stock lists). For anything else email support@blueduka.co.ke, or call or WhatsApp +254 727 177 155. We will answer within the time the law allows and may ask you to prove who you are first.

If you are a shop's customer or staff member, the shop controls those records, so ask the shop; we will help it. If you are not happy with our answer, you can complain to the Office of the Data Protection Commissioner.

Cookies and what is kept on your device

The website uses no advertising or tracking cookies and no analytics. The app keeps your login on your device so you stay signed in, and remembers settings such as the receipt printer. The Windows app keeps a copy of the shop's data on the computer so it can sell without internet, and uploads what was done offline when the connection returns; anyone who can use that computer's Windows account could reach it, so lock the computer and remove lost computers on the app's Computers page. On a shared computer, log out when you finish.

Children

BlueDuka is for businesses and is not meant for anyone under 18. Shops should not record children's information beyond what a normal sale needs.

Changes

When we change this policy we update the date at the top. If a change affects how your information is used in an important way, we tell owners in the app or by email before it applies.