Privacy Policy
Version Tue Aug 04 2026 00:00:00 GMT+0000 (Coordinated Universal Time) · in effect from 4 August 2026
Capvisor Technologies ("Capvisor", "we", "us") provides accounting software for small and medium businesses in Kenya. This policy explains what personal data we collect, why, and what you can do about it.
We are the data controller for the personal data described here, and we process it in accordance with the Data Protection Act, 2019 (Kenya).
Contact: info@capvisortech.com
1. What we collect
Information you give us
- Account details — your name, email address and password. Your password is stored only as a cryptographic hash; nobody at Capvisor can read it.
- Business details — business name, type, country, currency, financial year end, and your KRA PIN or business registration number.
- Your financial records — transactions, amounts, dates, suppliers and customers, categories, notes and corrections.
- Documents you upload — receipts, invoices, bank and M-Pesa statements, and anything else you send us to read.
- Support messages — what you write to us when you ask for help.
Information we generate
- Extracted data — the fields our software reads from your documents.
- Financial statements and reports — derived from your records.
- Analysis — health scores, alerts, written summaries and loan-readiness estimates.
- Audit history — what changed in your records, and when.
Information collected automatically
- Technical logs — request times, error details, IP address and browser type, kept for security and for fixing faults.
- Session cookies — used to keep you signed in. We do not use advertising or tracking cookies.
We do not collect special categories of personal data, and we ask you not to upload them. Please do not send us documents containing health records, biometric data, or anyone's political or religious affiliations.
2. Why we use it, and our lawful basis
| What we do | Why | Lawful basis |
|---|---|---|
| Run your account and keep your books | It is the service you asked for | Performance of a contract |
| Read your documents and extract figures | It is the service you asked for | Performance of a contract |
| Produce statements, reports and analysis | It is the service you asked for | Performance of a contract |
| Take payment for your subscription | To charge you what you agreed | Performance of a contract |
| Send service messages about your account | To tell you things you need to know | Legitimate interest |
| Keep security and audit logs | To protect your records and detect misuse | Legitimate interest |
| Keep records after you leave | Tax and accounting law requires it | Legal obligation |
| Improve how well our software reads documents | To make the product work better | Consent — see section 6 |
3. Who we share it with
We do not sell your data. We do not share it for anyone else's marketing.
We use these processors, each under a contract that limits them to acting on our instructions:
| Processor | What it does | Where |
|---|---|---|
| Supabase | Stores your account, records and uploaded documents | Cloud hosting |
| Anthropic | Reads your documents and writes the explanations | AI processing |
| Google Cloud Vision | Optical character recognition on images | Image processing |
| Paystack | Takes subscription payments | Payment processing |
Important, about AI processing. When you upload a document or ask for an explanation, its contents are sent to Anthropic to be read. Anthropic processes it on our instructions and does not use it to train their models. If this is not acceptable for a particular document, do not upload it — the automatic reading is the core of what Capvisor does and cannot be switched off for individual files.
We will also disclose data where we are legally required to — a court order, a lawful request from the Kenya Revenue Authority, or a regulator acting within its powers. Where we are permitted to tell you, we will.
Transfers outside Kenya. Some of these processors operate outside Kenya. Where personal data leaves the country we rely on contractual safeguards requiring protection equivalent to the Act.
4. How long we keep it
- While your account is open — for as long as you use Capvisor.
- After you close your account — records are deleted within 30 days, except as below.
- Financial and tax records — Kenyan tax law requires certain records to be kept for seven years. Where that applies we retain the minimum necessary and use it for nothing else.
- Security logs — 12 months.
- Payment records — as required by financial regulation.
Section 8 explains how to ask for deletion and what happens to each category.
5. Your rights
Under the Data Protection Act, 2019, you may:
- Be informed of how your data is used — this document.
- Access the personal data we hold about you.
- Correct anything inaccurate.
- Delete your data, subject to the retention rules in section 4.
- Object to processing based on legitimate interest.
- Receive a copy of your data in a portable, machine-readable format.
- Withdraw consent at any time, where we relied on it.
In the app: Settings → Security → Download all my data and Delete my account. The download is a complete, machine-readable archive of your records.
By email: info@capvisortech.com. We respond within 30 days. We may ask you to confirm your identity first — that is to stop somebody else obtaining your records.
If we get it wrong: you may complain to the Office of the Data Protection Commissioner (odpc.go.ke). We would rather you told us first, but you are not obliged to.
6. Improving how Capvisor reads documents
Capvisor gets better at reading Kenyan receipts, invoices and statements by learning from real examples. Where we use your documents for this, we will ask for your explicit consent first, and you may withdraw it at any time without affecting your service.
We have not started this yet. If and when we do, we will ask, and this policy will be updated before it begins.
Corrections you make to what our software read — retyping a wrong amount, changing a category — do improve results for your own account. That is part of the service and needs no separate consent.
7. Security
- Encrypted in transit (TLS) and at rest.
- Passwords hashed, never stored or transmitted in readable form.
- Access to production data is limited to staff who need it, and is logged.
- Every business's records are isolated; one account cannot read another's.
- Changes to your records are recorded with a timestamp.
No system is perfectly secure. If a breach affects your rights and freedoms, we will notify you and the Data Protection Commissioner as the Act requires.
8. Deleting your account
Settings → Security → Delete my account, or email us.
Deleted immediately: your login, business profile, transactions, uploaded documents, statements, reports, categories, corrections and settings.
Retained: financial records that Kenyan tax law obliges us to keep, for seven years, used for nothing but that legal obligation; and payment records as financial regulation requires.
Cannot be undone. Download your data first — the app offers this on the same screen.
9. Children
Capvisor is for businesses and is not directed at anyone under 18. We do not knowingly collect children's data. If you believe we have, tell us and we will delete it.
10. Changes to this policy
We will post any change here and update the version at the top. If a change materially affects your rights, we will tell you and ask you to accept it before you continue using Capvisor.
Version 2026-08-04 — first published.
A note on this draft. This policy was written to describe accurately what Capvisor's software actually does with your data, and to meet the Data Protection Act, 2019. It has not yet been reviewed by an advocate. Capvisor should have it checked before relying on it commercially. It is published now rather than left as a placeholder, because describing our data handling truthfully is better than describing it not at all.