Privacy policy

Who controls your data

When a business uses Tynflo, that business decides what it records about its own customers, suppliers, and staff, and is responsible for that data. We process it for them to provide the service. For your own account and workspace details, we are responsible.

What we collect

• Account details: your name, email address, phone number, company name, account type, and role. Passwords are stored only as secure hashes by our authentication provider.
• Business records you enter: customers, leads, products, stock, invoices, estimates, receipts, payments, expenses, purchases, staff and payroll details, forms, newsletters, and notes.
• Files you upload: logos, product images, documents, and images added to messages.
• Payment information: card and mobile money payments are handled by Paystack. We receive the payment reference, amount, status, and payer email; we never see or store full card numbers.
• Sign-in and security data: session tokens, a device token that remembers trusted devices, sign-in codes, IP address, and timestamps used for rate limits, fraud prevention, and the audit trail.
• Camera: the Android app uses the camera only to scan product barcodes at the till, and only after you allow it. Camera images are processed on your device and are not uploaded or stored.
• Website analytics: our public website uses Google Analytics and Metricool to count visits and understand which pages help people. The Android app does not include analytics or advertising tools.

How we use it

• To create and run your account and workspace, and keep your records in sync across the web and the app.
• To send emails you ask for, such as invoices, receipts, sign-in codes, and broadcasts to your own contacts.
• To process payments for your sales and invoices through Paystack.
• To keep the service secure: verifying sign-ins, preventing abuse, and investigating problems.
• To send service messages about your account, plan, and important changes.

We do not sell your data, and we do not use it for advertising.

Who we share it with

We share data only with providers that help us run the service, and only what they need:

• Paystack, to process card and mobile money payments.
• Resend, to deliver email.
• Our hosting and database providers, which store the service's data on our behalf.
• Google Analytics and Metricool, for website visit statistics only.

We may also disclose data when the law requires it, or to protect the rights and safety of our users and the public.

Security

Data is encrypted in transit with HTTPS. Access is limited by workspace, role, and permission, and private keys never reach your device. The Android app stores its session in the device’s secure storage and excludes app data from device backups.

How long we keep it

We keep your data while your account is active. When you delete your account, we delete your data as described below. Records of payments you made to Tynflo for plans and modules are kept for as long as tax law requires (currently five years in Kenya), and technical logs are kept for up to 30 days.

Deleting your account

You can delete your account in the Android app under Settings → Delete account, or on the web at tynflo.com/delete-account.

• Team members: your login and profile are deleted right away. The business records you created stay with your employer's workspace.
• Workspace owners: the whole workspace and everything in it, including every team member's login, is permanently deleted after 30 days. You can cancel during those 30 days by signing in.

Your rights

Under the Kenya Data Protection Act, 2019 and similar laws, you can ask to access, correct, export, or delete your personal data, and object to how it is used. Most of this you can do yourself in the app. For anything else, email us. If your data was entered by a business that uses Tynflo, contact that business first.

Children

Tynflo is for businesses and is not meant for anyone under 18. We do not knowingly collect children’s data.

Changes and contact

If we change this policy, we will update the date above and tell account owners about important changes. Questions or requests: [email protected].