Read this bit if you read nothing else. PayDesk is a point-of-sale system that shops in Kenya use to sell, to track stock and to keep records. That means we hold two very different kinds of information: details about you, the person who signed up, and details your shop records about its own customers. We treat those two things differently, and section 1 explains why that difference matters.
We do not sell data. We do not run advertising. We have no reason to profile anybody — you pay us a subscription, and that is the whole business model.
Privacy Policy
How personal data moves through PayDesk, and the control you keep over it.
01 Who is responsible for what
There are two roles in data protection law, and PayDesk sits in a different one depending on whose data we are talking about. Getting this straight makes everything below easier to follow.
| Whose data | Our role | What it means in practice |
|---|---|---|
| Yours — the owner, manager or cashier who holds a PayDesk login | We are the data controller | We decided to collect your name, email and phone in order to give you an account. Ask us directly and we answer directly. |
| Your customers' — the people your shop sells to, whose names and phone numbers your staff type in | We are the data processor; the shop is the controller | We only hold that data because your shop put it there, and we only do with it what your shop instructs. If one of your customers asks us to erase them, we will help — but we act on the shop's instruction, and we will tell the shop. |
02 What we collect, and why each piece is there
Every field below exists because something in the product stops working without it. Nothing is gathered speculatively "in case it is useful later".
a. Your account
| Data | Why it exists |
|---|---|
| Full name | Receipts show who served the customer, and the audit trail shows who changed what. |
| Email address | It is your sign-in identity, and where password resets and receipts go. |
| Phone number | Password-reset links are sent by SMS, and it is how support reaches you. |
| Password | Stored only as a one-way BCrypt hash. We cannot read it, and neither can anyone who steals the database. |
| Role and assigned store | Decides what you can see. A cashier must not be able to open payroll. |
b. Your business
Business name, contact phone and email, your stores, subscription status and payment history. This is what an invoice and a renewal reminder are built from.
c. What your shop records about its customers
Whatever your staff enter: name, phone, email, a customer code, a credit limit and the resulting balance, plus the purchase and payment history attached to them. Credit trading does not work without a ledger, and a statement is not a statement without a name on it.
d. Staff and payroll
If you use the payroll module: employee names and phone numbers, salaries, commissions, and statutory deductions (SHA, NSSF, the Housing Levy). Payroll cannot be computed without them, and they are visible only to the roles you allow.
e. Trading records
Sales and their line items, prices, discounts, payment methods, M-Pesa transaction codes and the payer's phone number as returned to us by Safaricom, receipts, purchase orders, suppliers, stock movements, and the serial or IMEI numbers of goods you stock. Note that an IMEI recorded here belongs to a handset on your shelf — it is stock identification, never the phone in your pocket.
f. Technical and security data
- An audit trail — who performed a sensitive action and when. This is what lets an owner see who voided a sale.
- Your IP address, when you use the public support form, purely so that form cannot be used to flood our SMS credit or somebody else's phone.
- Session tokens, so you stay signed in for the life of a shift and no longer.
- Error logs, which record what broke and when. We keep personal details out of them wherever we reasonably can.
03 What we never collect
Worth stating outright, because plenty of apps do collect these and PayDesk does not:
We also never store your full card details, and we never see or store your M-Pesa PIN. When you pay by M-Pesa you authorise it on your own handset, on Safaricom's prompt; the PIN never touches PayDesk.
04 The permissions the mobile app asks for
Four, and here is precisely what each is for.
| Permission | What we do with it |
|---|---|
| Camera | Reads barcodes and IMEIs at the till and when receiving stock. The camera frame is decoded on your device, in memory. No image is saved, and no image is uploaded — only the digits that were decoded. |
| Internet & network state | PayDesk is a live system; the app talks to your shop's data over an encrypted connection, and checks whether it has a connection before trying. |
| Notifications | Alerts you to low stock, a completed M-Pesa payment, an overdue hire-purchase instalment. Turn them off in your phone settings and everything else keeps working. |
| Vibrate | The confirmation buzz when a barcode scans, so you can keep your eyes on the customer. |
05 Why we are allowed to use it
- To perform our contract with you. You asked for a POS; running your till, your stock and your reports is the thing you are paying for.
- To meet a legal obligation. Tax and business records must be retained for a set period, whatever anyone would prefer.
- Our legitimate interests, kept narrow: keeping the service secure, preventing fraud and abuse, and fixing faults.
- With consent, where consent is the right basis — marketing messages, for example, which you can withdraw at any time without affecting your service.
We do not make automated decisions that produce a legal effect on you. Stock Intelligence suggests what to reorder; it is a suggestion for a human to act on, not a judgement about a person.
07 Where it lives, and how long we keep it
Data is held on servers we control, with the database reachable only from the application itself and never from the open internet. We keep things only as long as there is a reason to.
| What | How long |
|---|---|
| Your account, while you are a customer | For as long as the account is open |
| Your account, after you close it | Deleted or anonymised within 30 days of a verified request |
| Sales, invoices and tax records | 7 years, as Kenyan tax law requires. These survive account closure by law, not by preference. |
| Customer contact details your shop entered | Erased on request; the underlying sale stays but is detached from the person |
| Payroll records | As employment and tax law require |
| Security and audit logs | Up to 12 months |
| Support requests sent through /support | 24 months, so we can show what was asked and what we did |
| Backups | Rotated continuously; a deleted record disappears from backups within 30 days |
08 How we protect it
- Encrypted in transit. Every connection to PayDesk is HTTPS. There is no unencrypted route in.
- Passwords are hashed, not stored. BCrypt, one-way. A stolen database yields no passwords.
- The database is not on the internet. It listens only to the application, on the machine itself, behind a firewall.
- Separation by business, enforced server-side. Described in section 6.
- Least privilege by role. A cashier sees their till. A manager sees their store. Only an owner sees the whole business.
- Sessions expire, so a forgotten handset does not stay signed in indefinitely.
- Actions are logged, so a void or a price change can always be traced to a person.
09 Your rights
Under the Data Protection Act, 2019 you may:
- Be told what we hold about you and what we do with it — this page is part of that.
- Ask for a copy of your data, in a form you can actually use.
- Have mistakes corrected. A misspelt name or wrong number should be fixed, not argued about.
- Ask for deletion, subject to records we are legally required to keep (see section 10).
- Object to a particular use, or ask us to pause processing while a dispute is resolved.
- Withdraw consent at any time where consent was the basis.
- Complain to the Office of the Data Protection Commissioner if we get it wrong. We would rather you told us first, but it is your right either way.
Exercising any of these is free, and we answer within 30 days. Use the form at paydesk.co.ke/support — that is the fastest route and it gives you a reference number to quote.
10 Deleting your data — exactly what happens
You can ask us to delete your account and personal data at any time, and you do not need to be able to sign in to do it. Go to paydesk.co.ke/support, choose Delete my account or Delete my personal data, and submit the form. You may also call our IT administration line on 0756 556 556.
How the request is handled
- Straight away — you get an SMS with a reference number, and our administrator is alerted with the details of your request.
- Within 2 working days — we contact you to verify that the request really came from you. This step is not bureaucracy: without it, anybody could erase somebody else's shop.
- Within 30 days — the deletion is completed and we confirm it to you in writing.
What is deleted
What we must keep, and why
We cannot pretend a sale never happened. Kenyan tax law requires trading records to be retained for seven years, so completed sales, invoices and payment records stay — but they are anonymised. The transaction survives; the person is detached from it. A receipt keeps its total and its date; it stops carrying a name.
11 Children
PayDesk is a tool for running a business and is not directed at children. We do not knowingly create accounts for anyone under 18. If you believe a child's personal data has reached us, tell us through /support and we will remove it promptly.
12 When this policy changes
Products change, so policies do too. When we make a change, the "last updated" date at the top of this page moves. If a change materially affects your rights or how we use your data, we will tell you directly — by email, by SMS or in the app — before it takes effect, not after. Continuing to use PayDesk once a change is in force means you accept it; if you do not, section 23 explains how to leave and take your data with you.
Terms of Service
The agreement between your business and PayDesk.
13 The agreement
By creating an account, or by using the PayDesk website or mobile app, you accept these terms on behalf of yourself and the business you represent. If you are agreeing for a company, you confirm you are authorised to do so. If you do not accept them, please do not use the service.
In this Part, "PayDesk", "we" and "us" mean the operator of the PayDesk platform; "you" means the business holding the account and everyone you give a login to.
14 What the service is
PayDesk is a subscription point-of-sale platform: a till, stock control, customer accounts and credit, hire purchase, purchasing and suppliers, expenses, payroll, reporting, and M-Pesa collection. It is delivered over the internet and through our Android app, and it is provided as a service — you are licensed to use it, you are not buying a copy of it.
We improve the product continuously. Features may be added, changed or retired. Where we retire something you rely on, we will give reasonable notice.
15 The free trial
New businesses get 24 hours of full access, free, with no card and no commitment. It is genuinely the whole product, so you can judge it properly. When the trial ends the account moves to pending and selling pauses until a subscription is taken — nothing you entered during the trial is deleted, and it is all there when you subscribe.
16 Subscription and billing
| Plan | Covers | Price |
|---|---|---|
| Monthly | 30 days | KES 599 |
| Quarterly | 90 days | KES 1,790 |
| Half-year | 180 days | KES 3,550 |
- Subscriptions are paid in advance by M-Pesa, and access runs for the period bought.
- We do not auto-debit you. Nothing leaves your account without you approving a prompt on your own handset.
- When a subscription lapses, selling pauses — your data is not deleted. Renew and it is exactly as you left it.
- Prices may change with at least 30 days' notice. A period already paid for is never repriced.
- Payments for a period already used are not refundable. If we get something wrong on our side, talk to us — we will put it right.
17 SMS tokens and Business Float
Two features are prepaid separately from the subscription, because each costs us real money per use:
- SMS tokens pay for messages to your customers. One token per 160 characters; a longer message uses more. Tokens are drawn down as messages send.
- Business Float funds money going out — payroll paid straight to staff phones. Float is your money held for that purpose.
Both are topped up by M-Pesa and both are non-refundable once spent. Unused balances stay on your account while it is open. We will not send a message or make a payout you have not funded, so please keep an eye on the balances before a payroll run.
18 What you are responsible for
- Your logins. Every action taken with a login is treated as yours. Give each member of staff their own — never share one — and remove people when they leave.
- Your customers' data. When your staff record a customer's name and number, your business is the one collecting it. Have a reason, tell the customer, and only message them if they are content to hear from you. This matters most for SMS.
- What you sell. Your goods, prices, taxes and licences are yours. PayDesk records what you tell it.
- Accuracy. Reports are only as good as what is entered. If stock counts are not kept honest, the valuation will not be either.
- Your tax obligations. PayDesk keeps the records; filing remains yours.
19 What we are responsible for
- Keeping the service running and reachable, and aiming for high availability — though no online service is up every second of every year, and we do not promise that.
- Backing up your data and being able to restore it.
- Fixing faults promptly once we know about them, with urgent problems first.
- Giving notice before planned maintenance wherever we can, and scheduling it away from trading hours where possible.
- Never using your business data for anything except running your service, and never selling it.
Some things sit outside our control: your internet connection, your handset, the electricity supply, and the availability of Safaricom's M-Pesa platform. When M-Pesa is down, payments queue — we cannot make Safaricom's systems answer.
20 About money movement
The same applies to payroll: Business Float is your own money, held to fund payouts you instruct, and the transfer itself is executed over M-Pesa. Disputes about a specific M-Pesa transaction are ultimately between the parties to it and Safaricom — but tell us, and we will help you trace the record on our side.
21 Acceptable use
Do not use PayDesk to break the law, to trade in anything you are not licensed to trade in, or to launder money. Do not send unsolicited bulk SMS to people who never agreed to hear from you. Do not attempt to reach another business's data, probe or attack the platform, resell access, or copy the software. Do not upload anything designed to cause harm.
Finding a security flaw and telling us privately is welcome and always will be. Exploiting one is not.
22 Who owns what
Your data is yours. Your products, sales, customers and reports belong to your business, not to us. We hold them to run your service and for no other purpose.
The software is ours. PayDesk, its code, design and name remain our property. Your subscription grants a licence to use it, not ownership of it.
You can export your records — statements, reports, sales — at any time while your account is open, and we would encourage you to do so before you leave rather than after.
23 Suspension, and ending the agreement
You can leave whenever you like
Simply stop renewing, or ask us to close the account. There is no notice period and no exit fee. Export what you need first; then use /support to request deletion, and section 10 applies.
When we may suspend an account
- The subscription has lapsed — selling pauses; the data stays.
- Section 21 is being breached.
- An account is being used in a way that puts other businesses on the platform at risk.
- We are required to by law.
Except where the law or an active attack forces our hand, we will warn you first and give you a chance to put it right. If we ever terminate an account outright, you will have 30 days to export your data before anything is removed.
24 Liability
PayDesk is provided as it is. We work hard to keep it accurate and available, but we do not warrant that it will be uninterrupted or entirely free of faults.
To the extent the law allows, our total liability for any claim connected to the service is limited to the subscription fees you paid us in the three months before the claim arose. We are not liable for lost profits, lost sales or indirect losses.
Nothing here limits liability for fraud, or for anything that cannot lawfully be limited. Your rights as a consumer under Kenyan law are unaffected by this section.
25 Governing law and disputes
These terms are governed by the laws of the Republic of Kenya, and the courts of Kenya have jurisdiction.
Before anyone goes near a court, please talk to us — call 0756 556 556 or write through /support. Almost everything is a misunderstanding that a conversation fixes in a day. If a dispute genuinely cannot be settled that way, we will both attempt mediation in Nairobi in good faith first.
If any part of these terms turns out to be unenforceable, the rest stays in force.
26 How to reach us
| Reason | Where to go |
|---|---|
| Delete my data or my account | paydesk.co.ke/support — the fastest route, and it gives you a reference number |
| IT administration | 0756 556 556 |
| General support | +254 768 681 450 · WhatsApp |
| support@paydesk.co.ke | |
| Privacy questions specifically | privacy@paydesk.co.ke |
| If we let you down | Office of the Data Protection Commissioner, Kenya |
Want your data deleted?
You do not need an account, and you do not need to be able to sign in. Fill in one short form and you will have a reference number by SMS within moments.