Privacy statement
Last updated: 28 September 2026
This statement explains how information is used in ThriveTill’s account, shop-management and online-store features. Contact info@thrivetill.com or 0724 040 350 with privacy questions or requests.
1. Information in the service
Account information includes names, email addresses, registered phone numbers, password hashes and shop-role assignments. Shop records include business details, branding, products, inventory, orders and recorded payment status. Online orders can include customer names, contact information, delivery addresses and instructions. Session and security records may include IP addresses, browser information and request logs.
Subscription checkout is hosted by Paystack. ThriveTill sends the billing email, invoice amount, currency and invoice/account identifiers to initiate payment. We retain invoice details, transaction references, payment status, payment method, provider fees and payment dates for billing and reconciliation. ThriveTill does not store card numbers, card security codes or M-Pesa PINs. Recording a storefront payment method is not the same as processing an online payment.
2. Why we use information
We use account and session information to sign users in, enforce permissions and protect access. Shop and order information supports sales, inventory, fulfillment and reporting. Contact information lets us respond to enquiries and service requests. Processing may be necessary to provide the requested service, meet legal obligations or pursue legitimate service and security purposes. Where consent is required, it should be obtained before the relevant processing.
3. Shop owners and customer information
Shop owners determine how they use staff and customer data in their business and are responsible for their own privacy notices and lawful collection. ThriveTill processes shop records to provide the software. Authorised shop staff can access information according to their assigned permissions; platform super users can administer shops. Customers should contact the shop first about their order or its fulfillment.
4. Access and service providers
Information may be accessed by authorised people supporting the service, providers needed to operate it, or authorities where disclosure is legally required. Hosting or other providers used in a deployment may process data outside Kenya; any such arrangement must use the safeguards required by applicable law. Contact us for details of the providers and hosting arrangements relevant to your account. Shop content and published storefront policies are publicly visible; private account and order records are not public storefront content.
When an authorised shop user sends an SMS, ThriveVAS receives the recipient phone number, message content, sender ID and a delivery callback URL. ThriveTill retains the message, initiating user, shop, provider reference and delivery status. Public signup also sends a verification code to the supplied mobile number through the platform SMS account. Verification codes are hashed; pending account details are encrypted, with passwords already hashed. Pending secrets are cleared after completion or cancellation, or by hourly cleanup after one hour. Verification-request records, including the number and a hashed IP address used for rate limits, are removed after seven days. Shop users with SMS permission can view their shop’s message history. The platform’s ThriveVAS credentials are encrypted in storage.
5. Cookies and browser storage
ThriveTill uses session and security cookies for sign-in and request protection. Browser storage is used for local preferences such as receipt-printing settings. When enabled, optional Google Analytics and PostHog measure platform page visits and workspace section usage after you allow analytics. We send standard page labels and paths, excluding query strings, shop identifiers, customer details, message bodies and form values. PostHog uses a random browser-tab session identifier without person profiles; Google Analytics uses its analytics identifiers and cookies. Providers receive connection information such as IP addresses. Session replay and automatic form/click capture are not part of this integration. Shop storefronts and invoice/payment pages are excluded. You can reject or withdraw consent through Analytics preferences; withdrawal stops future collection and does not erase events already received. Your choice is stored for up to 180 days. Browser Global Privacy Control and Do Not Track signals disable optional analytics.
6. Security and retention
Passwords are stored as hashes. Shop access is checked on the server, and password changes invalidate other sessions using the previous credentials. Keep your passwords and devices secure. No system can guarantee absolute security. Information should be retained only as needed for the service, legitimate record keeping and applicable legal requirements. Contact us about closure or deletion; business records and backups may require different handling, which should be explained when responding to a request.
7. Your choices and rights
Depending on applicable law, you can ask to access or correct your information, object to processing, and request deletion, restriction or a portable copy where those rights apply. We may need to verify your identity and consider legal record-keeping duties or other people’s rights before acting. Send requests to info@thrivetill.com.
You can also raise concerns with Kenya’s Office of the Data Protection Commissioner. Its guidance explains data-subject rights and the principles governing personal information.
8. Updates
We will revise this statement when the service or its data practices change and update the date above. Material changes should be communicated to affected users as appropriate.