Privacy Policy

1. Who we are

Finixyz (“Finixyz”, “we”, “us”) provides a customer relationship management (CRM) service for businesses that sell across Africa. Our office is in Westlands, Nairobi, Kenya.

This policy covers the Finixyz website, the Finixyz app and any related support we give you.

2. Our role: controller and processor

Data protection law treats us differently depending on whose data it is:

• Account data — details about you and your colleagues as users of Finixyz (name, work email, phone, role, sign-in activity). For this, we are the data controller.
• Customer data — the leads, contacts, conversations, quotes, invoices and payments your company records in Finixyz. For this, your company is the data controller and we are its data processor. We act only on your company's instructions, set out in our Terms of Service.

If you're a customer of a business that uses Finixyz and want to know what it holds about you, please contact that business directly. We'll help them respond.

3. What we collect

When you sign up or use Finixyz

• Your name, work email, mobile number, job role and password (stored only as a secure hash).
• Your company's name, country, industry, team size, tax details and billing information.
• Sign-in and security records: when you signed in, from which device and browser, and one-time codes we send you.
• Location, only when you choose to check in at a customer visit.

Customer data you add

Whatever your team records: contact details, messages from WhatsApp, SMS, email and calls, notes, deals, quotes, invoices, payment references and survey answers.

When you visit our website

Our website doesn't use advertising or tracking cookies. It stores a few things in your own browser so the site works better for you, such as your light or dark theme and an unfinished sign-up form so you don't lose it. That information stays on your device.

When you contact us

The details you give in a contact form, demo booking, email, call or WhatsApp message.

4. How we use it

We don't sell personal data. We don't use customer data to train AI models for anyone else or to advertise to anyone.

5. Finixyz AI

When you ask Finixyz AI a question, it reads only the records your role is allowed to see and uses them to answer you. Your questions and answers stay inside your workspace and are not used to train models shared with other companies.

6. Where your data is stored

Finixyz runs on cloud servers provided by a specialist hosting company, in professional data centres outside Kenya. This means your data is transferred out of the country where you use Finixyz.

We make these transfers only as data protection law allows, including sections 48 to 50 of Kenya's Data Protection Act, 2019. Our hosting provider processes data only on our instructions, under a written agreement that requires it to protect the data to at least the standard the law requires. We'll tell you which provider and data centre location we use on request.

Wherever it's stored, each company's data is kept logically separate from every other company's, and the data protection law of the country where your company operates still applies to how we handle it.

7. Who we share it with

We share personal data only as needed to run Finixyz:

• Service providers who host our systems, send SMS and email, and process payments. They may use the data only to provide their service to us.
• Integrations you switch on, such as WhatsApp, M-Pesa or your tax authority's e-invoicing system. Data goes to them because your company asked it to.
• Authorities, when the law requires it. Where we're allowed to, we'll tell your company first.
• A buyer, if Finixyz is ever sold or merged. This policy would continue to apply.

We'll give you our current list of service providers on request.

8. How we protect it

• Data is encrypted while it travels between your device and our servers.
• Our servers sit in secured data centres with restricted physical access, and only a small number of our staff can reach them.
• Sign-in can require a one-time code sent to your phone, and admins can make this compulsory for everyone.
• Each role sees only what it needs. Admins can review an audit log of sign-ins, exports and important changes.
• Our staff access customer data only to give support you've asked for, or to keep the service safe.

If a breach affects your data, we'll tell your company without undue delay, and notify the Data Commissioner where the law requires.

9. How long we keep it

• Customer data is kept for as long as your company has an account. Admins can set how long old records are kept in Settings › Security & data.
• If your company cancels, we keep its data for 30 days so you can come back or export it, then delete it.
• Billing records are kept for as long as tax law requires, usually 5 to 7 years.
• Website enquiries are kept for up to 2 years after our last contact with you.

10. Your rights

Under data protection law you have the right to:

• be told how your data is used, which is what this policy is for;
• see the personal data we hold about you;
• have wrong or incomplete data corrected;
• have your data deleted, or its use restricted, where there's no good reason to keep it;
• object to us using your data, including for marketing;
• get your data in a format you can take elsewhere;
• withdraw consent you've given, at any time.

To use any of these, email . We'll reply within the time the law allows. If you're unhappy with our answer, you can complain to the Office of the Data Protection Commissioner in Kenya, or the data protection authority in your country.

11. Children

Finixyz is a business tool and is not meant for anyone under 18. We don't knowingly collect data about children as users.

12. Changes to this policy

If we make important changes, we'll tell admins by email or in the app before they take effect. The date at the top shows when this policy last changed.

13. Contact us

Questions about privacy, or a request about your data? We're happy to help.