Privacy Policy
Kendrix POS is a product of Valley Digital Services, based in Iringa, Tanzania ("Kendrix", "we", "us"). This policy explains what information we collect when you use our website and business management platform, why we collect it, who we share it with, and the choices and rights you have. We aim to handle personal data in line with the Personal Data Protection Act, 2022 of Tanzania and other laws that apply to us.
1. Your data and our role
Kendrix POS is used by businesses ("you", "the business") to run sales, stock, orders, staff, drivers and finances.
- Account information — the business details and user accounts you give us when you sign up and use Kendrix. We decide how this is used, so for this information we are the data controller.
- Business records — what you and your staff enter about your own customers, staff, suppliers and drivers. The business decides what to record and why, so the business is the data controller and we process those records only to provide the service to you. If you are a customer or employee of a business that uses Kendrix, please contact that business about your information; we will help them respond.
2. What we collect
- Business details: business name, email address, phone and WhatsApp numbers, country, city, address, logo, currency, tax rate and similar settings.
- User accounts: names, usernames, roles and permissions of the people who use your account. Passwords are stored only as a one-way hash; we cannot read them.
- Business records: products, stock and stock movements, production, orders and payments, invoices, cashbook entries and expenses, purchases and suppliers, customers (such as names, phone numbers, addresses and balances owed), staff (such as names, positions, attendance, leave and payroll), drivers and delivery trips.
- Support and AI: messages you send to our support team, and questions you ask the AI Advisor.
- Security and technical information: sign-in times, recent activity used to lock inactive sessions, IP addresses used to limit abuse, browser type, and basic page-visit statistics.
3. How we use it
- To provide the service: store your records, show your dashboards and reports, and keep your data separate from every other business.
- To keep accounts secure: sign-in, inactivity locks, limits on repeated attempts, and investigating misuse.
- To send service emails: account verification, password resets and, if you turn them on, scheduled business reports by email or WhatsApp.
- To answer support requests and to fix and improve the service.
- To meet legal obligations.
We do not sell your data, and we do not use it for advertising.
4. The AI Advisor
When you ask the AI Advisor a question, we send your question, the recent conversation, and a short summary of your figures (business name, currency, today's sales totals, low-stock items, unpaid order totals and best-selling products) to an AI provider so it can answer. We do not include customer names, phone numbers or staff details in that summary, but anything you type into a question is sent as written — please avoid typing personal information about customers or staff.
The AI Advisor currently uses Google's Gemini service on its free tier. Under Google's terms for free use, Google may use the content sent to it, and the answers it gives, to improve its products, and people at Google may review it. As a fallback we may use Anthropic's Claude service. If no AI provider is available, the answer comes from a built-in advisor that runs on our own servers and sends nothing to a third party. AI answers can be wrong; treat them as suggestions, not professional advice.
5. Who we share it with
We share information only with service providers that help us run Kendrix, and only what they need:
- Railway — hosts our servers and database.
- Vercel — hosts our website and provides privacy-friendly visit statistics without cookies.
- Resend — sends our emails (verification, password reset, reports).
- Google and Anthropic — answer AI Advisor questions, as described above.
- WhatsApp (Meta) — delivers scheduled reports, only if you choose WhatsApp delivery.
- Zoho — hosts our company email, so messages you send to us are stored there.
We may also disclose information if the law requires it, to protect the rights and safety of our users or the public, or as part of a sale or reorganisation of our business, in which case this policy would continue to apply.
6. Where your data is stored
Our database and servers are hosted in the United States, and some of the providers above process data in other countries. This means your information is transferred outside Tanzania. We use established providers that protect data in transit and at rest, and we limit what each of them receives.
7. Cookies and browser storage
- One essential cookie keeps you signed in securely. It cannot be read by page scripts and is used only for signing in.
- Browser storage on your device holds your current sign-in, display preferences, and copies of some records (such as driver trips and debts) so the app works smoothly. On a shared computer, always sign out.
- Visit statistics are collected by Vercel without cookies and without identifying you.
We do not use advertising or tracking cookies. Signing out clears your sign-in from the browser.
8. How we protect it
- All connections are encrypted (HTTPS).
- Passwords are stored as strong one-way hashes, and sign-in tokens expire quickly.
- Every business's records are kept separate; staff see only the parts of the system their owner allows.
- Inactive sessions are locked and need the password to continue; repeated wrong passwords are blocked.
- Access to production systems is limited to the people who run Kendrix, and we keep backups of the database.
No system is perfectly secure. If we learn of a breach affecting your data, we will tell you and the authorities as the law requires. To report a security concern, email info@kendrixpos.co.tz.
9. How long we keep it
We keep your information for as long as your account is open. You can export your records at any time. If you ask us to close your account, we will delete its data within 90 days, except where the law requires us to keep it longer; copies in backups are deleted as those backups expire.
10. Your rights
Subject to the law, you have the right to:
- know what personal information we hold about you and get a copy of it;
- have inaccurate information corrected;
- have your information deleted;
- object to or restrict certain uses of your information;
- withdraw consent where we rely on it.
To use these rights, email info@kendrixpos.co.tz. We will reply within 30 days. If you are not satisfied, you can complain to the Personal Data Protection Commission of Tanzania.
11. Children
Kendrix is a tool for businesses and is not meant for anyone under 18. We do not knowingly collect information from children.
12. Changes
We may update this policy as Kendrix changes. We will change the date at the top, and for important changes we will tell account owners by email or in the app before they take effect.
13. Contact us
Valley Digital Services (Kendrix POS)
Iringa, Tanzania
Email: info@kendrixpos.co.tz