Privacy Policy

EaseBook ("we", "us", "our") is a business management platform for small and medium businesses, available as a web application at easebook.co.ke and as an Android application on Google Play. EaseBook helps businesses manage inventory, sales, receipts, customer credit, quotations, service jobs, payroll and financial reports.

This policy explains what data we collect, why we collect it, how we protect it, and the choices you have. It is written with the requirements of the Kenya Data Protection Act, 2019 in mind. For questions, contact us at easebook2025@gmail.com or through our contact page.

a) Account information

When you create an account we collect your name, email address, phone number, business name and a password. Passwords are stored only as salted bcrypt hashes — we never store or see your plain-text password. If you sign in with Google, we receive your name and email address from Google.

b) Business records you enter

EaseBook stores the records your business creates in the app: inventory and stock items, sales and receipts, income and expense transactions, customer and supplier details (names, phone numbers, emails, addresses), credit (pay-later) records, quotations and invoices, service jobs and their expenses, business letters, and employee records for payroll — which may include national ID numbers, statutory deduction details (PAYE, NSSF, SHIF, Housing Levy) and salary information.

c) Payment records

We record the payment method (Cash, M-Pesa or Bank Transfer), amount and reference for sales and payments you record. When M-Pesa payments are initiated through the app, the request is processed by Safaricom's M-Pesa (Daraja) service — we never see, collect or store your M-Pesa PIN, and we do not collect card numbers.

d) Information collected automatically

We collect limited usage analytics (pages visited and features used), device and browser information, and IP addresses (used for security, rate limiting and server logs). We use cookies for authentication — a secure, HTTP-only session cookie keeps you signed in — and for remembering preferences such as light or dark theme.

e) Camera (Android app)

The Android app requests camera access only to scan product barcodes, IMEI and serial numbers. Scanning happens on your device; we do not store photos or video from your camera.

f) Uploaded files

You may optionally upload files such as a business logo or profile photo. These are stored so they can be shown in the app and on your documents (receipts, letterheads, payslips).

• To provide the service — storing and displaying your business records, generating receipts, invoices, payslips and reports.
• To authenticate you and keep your account secure.
• To send service emails — account verification, password resets, and (if enabled) notifications such as low-stock or due-credit alerts, and quotations you choose to email to your clients.
• To process M-Pesa payment requests you initiate.
• To provide optional AI writing assistance for business letters (see section 4).
• To understand product usage in aggregate and improve EaseBook.
• To prevent abuse, enforce rate limits and comply with legal obligations.

We do not sell your personal data, and we do not use your business records for advertising.

• Safaricom M-Pesa (Daraja) — processes M-Pesa payment requests. Your phone number and the amount are shared with Safaricom to complete a payment.
• Google — optional Google Sign-In for authentication.
• Groq — powers the optional AI writing assistant in the Letters feature. When you use it, the letter text you submit is processed by Groq to return suggestions. Do not include sensitive personal data in text you submit to the assistant.
• PostHog — product analytics (page views and feature usage).
• Email delivery — a transactional email provider delivers verification, password-reset and notification emails.

These providers receive only the data needed to perform their function. We may also disclose information if required by law or to protect our rights, users or the public.

EaseBook accounts belong to a business dashboard. The business owner (Admin) controls who can access the dashboard and what each team member (Manager, Accountant, Cashier, Viewer) can see and do. Records you enter are visible to teammates according to the permissions your Admin sets.

For personal data your business enters about its own customers, suppliers and employees, the business is the data controller and EaseBook processes that data on the business's behalf. If you are a customer or employee of a business that uses EaseBook and want your data corrected or removed, please contact that business directly — or contact us and we will assist.

• All traffic between your device and our servers is encrypted with HTTPS/TLS.
• Passwords are hashed with bcrypt and never stored in plain text.
• Sessions use secure, HTTP-only cookies with signed tokens.
• Role-based access control restricts what each team member can see; financial figures are hidden from cashier and viewer roles.
• Access to production systems is restricted, and requests are rate-limited to prevent abuse.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the Office of the Data Protection Commissioner as required by law.

We keep your data for as long as your account is active. When your account is deleted, your sign-in credentials, profile and settings are removed immediately. Business records (such as transactions and receipts) may be retained for the business dashboard they belong to, and certain financial records may be kept where retention is required for tax, audit or other legal obligations. Residual copies in encrypted backups are purged on our normal backup rotation within 90 days.

Under the Kenya Data Protection Act, 2019, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data — most account and business records can be edited directly in the app.
• Delete your account and personal data — see our account deletion page.
• Request deletion of specific data without closing your account — see our data deletion page.
• Object to or restrict certain processing, and request a copy of your data in a portable format.
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya.

To exercise any of these rights, use the pages linked above or contact us at easebook2025@gmail.com. We respond to verified requests within 30 days.

EaseBook is a business tool intended for users aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it.

We may update this policy from time to time. Material changes will be announced in the app or by email, and the effective date at the top of this page will always reflect the latest version.

EaseBook — Nairobi, Kenya
Email: easebook2025@gmail.com
Phone: +254 714 415 987
Or use our contact form.