Privacy Policy

1. What this policy covers

This policy explains how Ora collects, uses, stores, and shares information when you use the Ora website, desktop app, or mobile app.

2. Information we collect

Ora may collect the following categories of information:

• Account information: your name, email address, phone number, and sign-in credentials managed through Supabase authentication.
• Business information: business names, locations, vertical type, product catalogs, variants, batches, stock counts, prices, and reports.
• Sales and payment metadata: orders, totals, timestamps, payment status, and M-Pesa STK push activity.
• Staff and access-control data: user roles, permissions, invitations, approval history, and security settings.
• Operational data: sync state, device information, crash logs, and diagnostic events needed to keep offline and reconnect sync working.
• Support communications: messages you send when you contact us for help or troubleshooting.

3. How we use information

• Provide the service, authenticate users, and keep business accounts separated.
• Sync your data between phone and desktop and preserve offline edits until connectivity returns.
• Process sales workflows, stock adjustments, reports, and permissions.
• Initiate and track M-Pesa STK push payments and related status updates.
• Improve reliability, diagnose issues, prevent misuse, and support customer requests.

4. Local storage and sync

Ora is designed to work offline. Data may be stored locally on your device so you can keep working when network access is unavailable. When connectivity returns, locally saved changes sync back to your account.

You are responsible for the device-level security of phones, tablets, and computers where Ora is signed in.

5. Children and minors

Ora is intended for business use and is not designed to collect personal data from children or minors. We do not knowingly collect information from children. If we learn that we have received personal data from a child, we will take steps to delete it as soon as reasonably possible.

6. Sharing and third parties

We do not sell your business data. We may share information with service providers that help us operate Ora, including infrastructure, authentication, storage, and update delivery services.

• Supabase for authentication, database storage, and sync-related backend services.
• Cloudflare for website hosting and release distribution infrastructure.
• M-Pesa / Safaricom integrations for payment initiation and callback handling.

We may also disclose information if required by law, to protect our rights, or to investigate abuse or security incidents.

7. Data retention and deletion

We keep personal and business records only for as long as is reasonably necessary to provide the service, support your account, comply with legal obligations, resolve disputes, and enforce agreements.

When data is no longer needed, we will delete, erase, anonymise, or pseudonymise it as appropriate. Some records may be kept longer where required by law or where we need them for security, accounting, or legal claims.

You may request deletion of your account data where applicable. If we are legally required to keep any part of it, we will explain that limitation in our response.

8. Account deletion

You have the right to request permanent deletion of your account and all associated business data. This action is irreversible and will remove all records tied to your account, including:

• Account information (name, email, sign-in credentials)
• Business information (business names, locations, products, inventory)
• Sales and payment records
• Staff and user access data
• Operational and sync data

How to request account deletion: Submit your request using our account deletion form with your business name, email, first and last name, and reason for deletion. We will verify your identity to ensure the request is legitimate.

Processing timeline: Deletion requests are typically processed within 5 business days. We will send a confirmation email once your account and data have been permanently deleted.

Legal retention: In some cases, we may be required by law to retain certain records (tax records, audit logs, or compliance documentation). We will notify you of any such retention when we process your deletion request.

9. Your rights

Under Kenya's Data Protection Act, 2019, you have the right to:

• Be informed about how your data is used.
• Access the personal data we hold about you.
• Object to all or part of the processing of your data.
• Correct inaccurate, outdated, incomplete, or misleading data.
• Delete data that is no longer needed, unlawfully held, or otherwise eligible for erasure.
• Restrict processing in certain situations while we review a request.
• Data portability where the law applies and the request is technically feasible.

You may also contact the Office of the Data Protection Commissioner if you are not satisfied with our response to a privacy request.

10. Security

We use reasonable technical and organizational safeguards to protect information, but no system is fully secure. You should use strong passwords, limit staff access, and keep your devices protected.

11. Your choices

You may be able to update account details, manage users, and request support-related changes to your data. If you need access, correction, or deletion assistance, contact us using the details below.

12. Contact

For privacy questions or requests, contact the Ora team at ora.appsupport@gmail.com.