1. Who we are
Urban Market, Nairobi, Kenya. Contact: tumabodadev@gmail.com
Two kinds of people appear in this policy: shopkeepers and their staff, who use the app, and customers of those shops, whose details a shopkeeper may record. The shop decides what to record about its customers; we store it on the shop’s behalf.
2. What the app collects
2.1 From the shop and its staff
- The shop’s own details: name, location, logo, catalogue, prices and stock.
- Staff names and PINs, and which parts of the app each person may use.
- A device identifier for each till, so a till stays paired to the right shop.
- Every sale: items, amounts, payment method, time, and which staff member made it.
2.2 About the shop’s customers, when the shopkeeper records them
- Name, phone number and email address.
- Purchases, loyalty points and any balance owed.
2.3 From the device
- The camera, only while scanning a barcode or taking a product photo. Nothing is streamed or stored except the photo the shopkeeper chooses to save to a product.
- Contacts, only when the cashier taps a contact to fill in a customer’s phone number. The app reads that one number at that moment; it does not upload the address book.
- Photos chosen by the shopkeeper for a product.
2.4 What the app does not collect
- Location.
- Advertising identifiers. There is no advertising or analytics SDK in the app.
- Payment card details. M-Pesa payments are taken on the shop’s own Safaricom till; the app records that a payment happened and its reference. The app never handles a PIN or card number.
3. Why
To run the till: show the catalogue, take a payment, print or send a receipt, keep stock correct, and give the shop its own sales records, customer list and reports. Sales data also appears on the shop’s storefront on urbanmarket.co.ke — stock counts and products, never customer details.
4. Where it is stored
On the device, so the till keeps working when the internet drops, and on Urban Market’s servers, reached over HTTPS only. Sales made offline are held on the device and sent when the connection returns. Servers are hosted in Europe; data is transferred there from Kenya to provide the service.
5. Who it is shared with
Nobody outside what the shop asked for. Specifically:
- A courier gets a delivery address and phone number when a shop books a delivery.
- Receipts go to the address or number the customer gives.
- Our hosting provider stores the data on our behalf, under contract.
We do not sell personal data, and we do not share it for advertising.
6. How long it is kept
For as long as the shop trades with Urban Market, and for seven years after a sale where Kenyan tax law requires records to be kept. A customer’s details are removed from a shop’s records on request — by asking the shop, or us — leaving the sales figures in the shop’s accounts without them. Delete your account sets out how to ask and what is kept.
7. Your rights
Under Kenya’s Data Protection Act, 2019 you may ask for a copy of your data, ask us to correct it, or ask us to delete it. Customers of a shop should ask that shop first, since the shop decides what it holds; if you would rather come to us, write to tumabodadev@gmail.com and we will act within 30 days. You may also complain to the Office of the Data Protection Commissioner, at www.odpc.go.ke.
To delete a shop account, a member of staff or an offline licence, see Delete your account.
8. Children
The app is a business tool and is not intended for anyone under 18.
9. Changes
If this policy changes we will update the date at the top and, for anything significant, tell shop owners in the app.