Privacy Policy

StockPulse (“we”, “our”, or “us”) operates the StockPulse platform at stockpulse.co.ke. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

1. Information We Collect

1.1 Account Information

When you create an account, we collect your name, email address, phone number, and company details (company name, address, KRA PIN if provided). This information is necessary to provision your tenant account and provide our services.

1.2 Business Data

As you use StockPulse, you store business data including but not limited to: products, inventory records, customer information, supplier details, invoices, receipts, expenses, and financial records. This data belongs to you — we process it solely to provide the service.

1.3 Usage Data

We automatically collect certain information when you access the platform, including your IP address, browser type, device information, pages visited, and timestamps. We use this data to improve our service, diagnose technical issues, and ensure security.

1.4 Payment Information

Subscription payments are processed by Paystack. We do not store your credit card numbers or M-Pesa PINs. Paystack handles all payment data under their own privacy policy and PCI DSS compliance.

2. How We Use Your Information

We use your information to:

• Provide, operate, and maintain the StockPulse platform
• Process your transactions and send related notifications (invoices, receipts, statements)
• Manage your account and subscription
• Respond to your inquiries and provide customer support
• Send service-related communications (e.g., trial expiry reminders, maintenance notices)
• Improve our platform through aggregated, anonymised analytics
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations, including KRA eTIMS requirements where applicable

3. Data Isolation & Multi-Tenancy

StockPulse is a multi-tenant platform. Your business data is logically isolated from other tenants using row-level security at the database level. No other tenant or user can access your data. Our application code enforces tenant-scoped queries, and the database provides an additional layer of protection through PostgreSQL Row-Level Security (RLS) policies.

4. Data Sharing & Third Parties

We do not sell, trade, or rent your personal or business data. We share data only with:

• Infrastructure providers: Supabase (database hosting, authentication, file storage), Vercel (application hosting). These providers process data on our behalf under strict data processing agreements.
• Payment processor: Paystack, for subscription billing only.
• Email service: Resend, for sending transactional emails (invoices, receipts, notifications).
• Tax authorities: If you enable eTIMS integration, invoice data is submitted to the Kenya Revenue Authority (KRA) as required by Kenyan tax law. This is initiated by you and is under your control.

5. Data Storage & Security

Your data is stored on Supabase-managed PostgreSQL databases with encryption at rest (AES-256) and in transit (TLS 1.2+). We implement industry-standard security measures including:

• Encrypted database connections
• Row-level security policies for tenant data isolation
• Secure authentication via Supabase Auth (bcrypt password hashing, JWT tokens)
• Role-based access control (RBAC) within each tenant
• Audit logging of sensitive actions
• Regular security reviews and dependency updates

6. Data Retention

We retain your data for as long as your account is active. If you cancel your subscription, your data remains accessible in read-only mode for 90 days, after which it may be permanently deleted. You may request immediate deletion at any time by contacting us.

Audit logs are retained for a minimum of 7 years to comply with Kenyan financial record-keeping requirements under the Income Tax Act and VAT Act.

7. Your Rights

You have the right to:

• Access your personal and business data at any time through the platform
• Export your data in CSV format from any report or list page
• Correct inaccurate information through your account settings
• Delete your account and all associated data by contacting us
• Object to processing of your data for marketing purposes

To exercise any of these rights, contact us at hi@stockpulse.co.ke.

8. Cookies

StockPulse uses essential cookies only — specifically, authentication session cookies required for you to stay logged in. We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

9. Children's Privacy

StockPulse is a business platform and is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the platform. Your continued use of StockPulse after changes take effect constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy or our data practices, contact us at:

• Email: hi@stockpulse.co.ke
• Phone: +254 707 840 074
• Website: stockpulse.co.ke