Privacy Policy — Tieghtsuite

01 · Who we are

Tieghtsuite provides one dashboard for running a Kenyan business — invoicing, M-Pesa & Pesapal payments, HR, payroll, and accounting. We are the data controller for the personal data we collect about you when you use the Service.

For the purposes of the Kenya Data Protection Act, 2019, "personal data" means any information relating to an identified or identifiable natural person.

02 · What we collect

We collect only what the Service needs to run, and no more (data minimisation under section 25(e) of the Act):

Account data — your name, business name, phone/WhatsApp number, email address, and the plan you choose.
Business data you enter — client details, invoices and estimates, M-Pesa transaction records, staff records, attendance, and payroll information.
Subscription payment data — M-Pesa transaction details relating to your Tieghtsuite subscription. We do not see, store, or have access to your M-Pesa PIN.
Usage data — technical logs (device type, browser, pages visited, errors) used to keep the Service working and improving.
Communications — messages you send us on WhatsApp or email, and records of support conversations.

03 · How we use your data

We process personal data only for the following purposes, each backed by a lawful basis under section 30 of the Act:

To provide the Service — creating and running your account, invoices, reconciliation, payroll, and reports. Lawful basis: performance of a contract with you.
To reconcile M-Pesa payments — matching Till and Paybill payments to invoices through Safaricom's official API. Lawful basis: performance of a contract; legitimate interests.
To bill your subscription — processing M-Pesa Till payments for your plan. Lawful basis: contract; legal obligation.
To support you — responding on WhatsApp, email, or phone. Lawful basis: contract; legitimate interests.
To comply with the law — keeping records required by tax and anti-fraud legislation, such as KRA invoice requirements. Lawful basis: legal obligation.
To keep the Service secure — monitoring for misuse, fraud, and unauthorised access. Lawful basis: legitimate interests.
To send service messages — invoice-sent and payment-received alerts, renewal notices. We will not send marketing unless you opt in. Lawful basis: contract; consent for marketing.

04 · Consent, and withdrawing it

Where we process your data on the basis of consent (such as marketing messages), you can withdraw that consent at any time by emailing us — withdrawal does not affect processing that was already done lawfully (section 32 of the Act). Where processing is needed to provide the Service you asked for, consent is not required and cannot be withheld as a condition of the Service (section 32(4)).

05 · Who we share with

We do not sell your personal data. We share it only with the processors needed to run the Service, each bound by a written data-processing contract as required by section 42 of the Act, and only for the purposes described here:

Safaricom (M-Pesa) — payment collection and reconciliation via Safaricom's official API.
Pesapal — card and international payments.
Hosting & infrastructure providers — secure storage of your data.
WhatsApp / email providers — support and transactional messaging.
Professional advisers — legal and accounting advisers, where necessary and lawful.
Authorities — where we are legally obliged to disclose data, such as to regulators or law enforcement on valid legal process.

When a third party processes your client or staff data on your instructions through the Service, they act as your processor; we remain responsible for the processing we do on your behalf.

06 · How M-Pesa data is handled

When you link a business Till or Paybill, Tieghtsuite reads the transactions for that business number through Safaricom's official API and matches them to your invoices automatically.

We never see your personal M-Pesa messages, your Safaricom PIN, or your personal phone password. We do not retain raw M-Pesa credentials beyond what is required to operate the connection, and you can unlink your Till or Paybill at any time.

07 · How long we keep data

We keep personal data only as long as necessary for the purposes above (section 25(g) of the Act). Business and financial records are retained for as long as needed to provide the Service and to meet legal record-keeping obligations (including tax law). After you close your account, we retain only what the law requires and delete or anonymise the rest within a reasonable period.

08 · Security

We apply technical and organisational measures appropriate to the risk (section 21 of the Act), including:

Encryption of data in transit and at rest.
Role-based access controls so staff see only what their role needs.
Automatic backups of your books.
Audit and change-log tracking on higher plans.
Confidentiality obligations on everyone who touches your data.

09 · Your rights

Under section 26 of the Data Protection Act, 2019, you have the right to:

Be informed of how your data is used — this policy is that information.
Access your personal data — we respond within seven days, free of charge.
Correct false or misleading data.
Delete false or misleading data about you.
Object to processing of all or part of your personal data.
Export your data at any time — your books are yours, no lock-in.

To exercise any of these rights, email hello@tieghtsuite.com or WhatsApp +254 728 679 710. We will verify your identity before releasing data. If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner at www.odpc.go.ke.

10 · International transfers

Your data is processed and stored in secure facilities, and we do not transfer personal data outside Kenya without adequate safeguards or your consent, as required by section 25(h) and section 48 of the Act. Where infrastructure providers process data abroad, we rely on appropriate safeguards and contractual protections.

11 · Children

The Service is for businesses and is not directed at children under 18. We do not knowingly collect personal data from children.

12 · Changes & contact

We may update this policy as the Service and the law evolve. The "last updated" date above will always reflect the latest version, and material changes will be flagged when you sign in.

Questions about this policy or your data? Email hello@tieghtsuite.com, WhatsApp +254 728 679 710, or write to Tieghtsuite Technologies, Kamkis Plaza, 1st Floor, Suite NO:3, Nairobi, Kenya.

Privacy Policy.