Privacy Policy

1. Who we are

Retaela ("Retaela", "we", "us", "our") provides software that helps Kenyan businesses comply with Kenya Revenue Authority (KRA) eTIMS / OSCU electronic tax invoicing requirements. This Privacy Policy explains what information we collect through our website and dashboard at www.retaela.co.ke and our hosted application (the "Service"), how we use it, and the choices you have.

2. Information we collect

• Account information, your name, email address, business name, KRA PIN, and password (stored as a salted hash, never in plain text).
• Business & transaction data, invoices, credit notes, items, customers, suppliers and other records you submit so we can relay them to KRA's eTIMS/OSCU systems on your behalf.
• Usage data, log data such as IP address, browser type, pages visited and timestamps, used for security, fraud prevention and improving the Service.
• Sign-in data, if you choose "Continue with Google", we receive your name, email address and profile photo from Google to create or link your account. We never see or store your Google password.
• Communications, messages you send us via support, email or in-app forms.

3. How we use your information

• To operate, maintain and secure the Service, including authenticating you and protecting your account.
• To transmit your invoicing data to KRA's eTIMS/OSCU endpoints and return the signed responses to you, this is the core function of the Service.
• To send you transactional emails (e.g. email verification, password resets, invoice status, API health alerts, billing notices).
• To provide customer support and respond to your enquiries.
• To monitor, debug and improve the reliability and performance of the Service.
• To comply with our legal obligations, including tax, accounting and regulatory requirements in Kenya.

4. How we share your information

We do not sell your personal information. We share data only:

• With the Kenya Revenue Authority, as required to file your invoices and obtain compliant tax receipts, this is the purpose for which you use Retaela.
• With infrastructure and service providers who process data on our behalf under contract (e.g. cloud hosting, database, email delivery, rate-limiting and authentication providers), solely to operate the Service.
• When required by law, regulation, legal process or governmental request.
• With your consent, or at your direction.

5. Data retention

We retain account and transaction data for as long as your account is active and as necessary to meet our legal, accounting and tax-record obligations under Kenyan law (which can require retention of invoicing records for several years). You may request deletion of your account at any time, subject to these legal retention requirements.

6. Security

We use industry-standard safeguards to protect your information, including encryption in transit (HTTPS/TLS), salted password hashing, role-based access control, audit logging, and secret redaction in logs and traces. No method of transmission or storage is 100% secure, but we work continuously to protect your data.

7. Your rights

Subject to applicable law (including Kenya's Data Protection Act, 2019), you may request access to, correction of, or deletion of your personal data, or object to certain processing. To exercise these rights, contact us using the details below.

8. Cookies

We use essential cookies to keep you signed in and to remember your preferences. We do not use third-party advertising trackers.

9. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a new "Last updated" date, and where changes are material we will notify you by email or through the Service.

10. Contact us

Questions about this Privacy Policy or how we handle your data? Email hello@retaela.co.ke or visit www.retaela.co.ke.