SooBooks

Privacy Policy

SooBooks is cloud accounting and business software provided by BioTrack Tech Limited, a company registered in Kenya ("BioTrack", "we", "us"). This policy explains what personal data SooBooks handles, why, who it is shared with, and the rights you have under Kenya's Data Protection Act, 2019.

1. Two kinds of data

• Our customers' account data. When a business signs up, we hold the names, email addresses, phone numbers and login details of its users. For this data, BioTrack is the data controller.
• Data our customers keep in SooBooks. Businesses record their own customers, suppliers, staff, leads, invoices, payments and messages. For this data, the business is the data controller and BioTrack is its data processor: we hold and process it only on that business's instructions. If you are a customer of a business that uses SooBooks, please contact that business first about your data.

2. What we collect

• Account details: name, email, phone number, company name and KRA PIN, role and sign-in records.
• Business records entered by users: customers, suppliers, products, invoices, quotations, receipts, payments, stock and accounting entries.
• Contact and sales records: CRM leads, notes, follow-ups and answers people give on SooBooks response pages (for example a name, organisation or preferred date).
• Messages sent through SooBooks by SMS, WhatsApp or email, with their delivery and read status, and replies people send back.
• Payment records: M-Pesa confirmations (transaction code, amount, phone number and name as provided by Safaricom).
• Technical data: IP address, browser type and activity logs, used for security and to fix problems.
• Website visits: the pages viewed on our website and how a visitor arrived (for example a search engine, an ad or a campaign link), measured with Google Analytics cookies. How a visitor arrived is kept in their own browser and is only sent to us if they sign up.

3. Why we use it

• To provide SooBooks: accounting, invoicing, point of sale, stock, CRM and communications.
• To send messages a business asks SooBooks to send: invoices, reminders, receipts and campaigns.
• To meet legal duties. Once SooBooks's connection to the Kenya Revenue Authority's eTIMS is live and a business switches it on, this will include sending that business's tax invoices to KRA. That connection is not live yet.
• To keep the service secure, prevent fraud, and support users.
• To bill businesses for their SooBooks subscription.
• To help businesses that start a trial: welcome and set-up messages by WhatsApp, SMS or email, and a call from our team.

We do not sell personal data, and we do not use our customers' business records for advertising.

4. Who processes data with us

SooBooks uses these service providers, each only for the purpose shown:

• Meta Platforms (WhatsApp Business Platform): sending and receiving WhatsApp messages a business chooses to send.
• Safaricom (M-Pesa Daraja): receiving payments and payment confirmations.
• BioTrack SMS: sending SMS messages and receiving delivery reports.
• AI provider (Anthropic, or another provider we choose): when a business uses the SooBooks AI assistant, the text of the relevant conversation and that business's own knowledge base are sent to the provider to write a reply. Each business chooses how its replies go out: as drafts that a person at the business reviews before sending (the default), or automatically, at all times or only outside office hours. When replying automatically, the assistant hands the conversation to a person at the business when it cannot help or when the customer asks for one. The provider does not receive the business's accounts, only the conversation and the knowledge base the business has written.
• Google (Analytics): measuring visits to our website. It does not receive the business records kept in SooBooks.
• Kenya Revenue Authority (eTIMS): once this connection is live and a business switches it on, that business's tax invoices are sent to KRA as the law requires. It is not live yet.
• Hosting and email providers: running the service and delivering email. Our servers are located in the European Union.

Where data is processed outside Kenya, we rely on providers with appropriate safeguards, as the Data Protection Act requires.

5. Messages and opting out

Businesses must only message people who have agreed to hear from them. Promotional SMS are sent only between 8am and 8pm, and every promotion offers a way to stop: an opt-out code, or a "Stop messages" link on SooBooks response pages. On WhatsApp you can block the business at any time. Opt-outs are honoured immediately.

6. How long we keep data

Business and tax records are kept for as long as the business uses SooBooks, and at least five years where Kenyan tax law requires records to be kept. When a business closes its account, its data is deleted or anonymised after that period, unless the law requires us to keep it longer. Security logs are kept for a limited time.

7. Security

Data is sent over encrypted connections (HTTPS). Passwords are stored hashed; access keys for connected services (such as WhatsApp, M-Pesa and SMS) are stored encrypted. Access inside each business is controlled by roles, and important changes are recorded in an audit trail.

8. Your rights

Under the Data Protection Act, 2019 you may ask to be informed about how your data is used, to access it, to correct it, to have it deleted, to object to its use (including for direct marketing), and to receive it in a portable form. You may also complain to the Office of the Data Protection Commissioner.

9. Deleting your data

10. Contact

BioTrack Tech Limited, Nairobi, Kenya · eric.soo@biotrack.co.ke

We may update this policy; the date above shows the latest version.