Privacy Policy

Draft — needs review before publishing Every [BRACKETED] item below must be filled in, and this should be reviewed by a Tanzanian lawyer before you take payment from customers. It is a working draft, not legal advice.

1. Who we are

Storebook is an inventory and sales system for phone shops, operated by [REGISTERED COMPANY NAME] of [ADDRESS], Dar es Salaam, Tanzania.

You can reach us on WhatsApp at +255 678 202 026 or by email at support@storebook.co.tz.

We are registered with the Personal Data Protection Commission (PDPC) under registration number [PDPC REG NO.].

2. Two kinds of data, and who is responsible for each

This distinction matters, so we put it first.

Your data, as a shop

When you sign up, we hold information about you and your staff — your name, phone number, shop name and so on. For this information, we decide how it is used, and we are responsible for it.

Your customers' data

When your shop records a sale, you enter your customer's name, phone number and sometimes their email. That information belongs to your shop. You decide what to collect and why. We only store and process it so that your shop can produce receipts and records.

In the language of the Personal Data Protection Act, your shop is the data controller for your customers' information, and we act as a data processor on your instructions. Practically, this means you are responsible for telling your customers what you do with their details, and we are responsible for keeping that information safe and not using it for our own purposes.

3. What we collect

What	Details
Account information	Your name, phone number, email address, shop name, shop code, your role and permissions.
Stock records	Phone models, IMEI numbers, colours, storage, batch numbers, buying and selling prices, supplier invoice totals.
Sales records	Sale price, payment method, warranty period, date, and which staff member received or sold each phone.
Customer details entered by your shop	Customer name, phone number, and email address where your shop chooses to record them.
Payment information	The mobile money reference or confirmation you send us so we can extend your subscription. We do not see or store your mobile money PIN, and we do not take payments automatically.
Technical information	Basic log data such as browser type, device type, and the times you sign in, used to keep the service working and secure.

We do not collect location data, we do not use advertising trackers, and we do not build profiles of your customers.

4. Why we hold it

To run the service you signed up for — receiving stock, selling phones, producing receipts and reports.
To send receipts to your customers by WhatsApp or email, on your instruction.
To sync your shop's data between the people who work there.
To confirm your subscription payments and extend your access.
To answer your questions and fix problems when you contact us.
To keep the service secure and investigate misuse.
To meet legal obligations where the law requires it.

We do not sell personal data. We do not share it for advertising. We do not use your shop's records to market to your customers.

We use a small number of service providers to run Storebook:

Provider	What they do
[HOSTING PROVIDER]	Hosts the application and stores your shop's data.
[DATABASE / BACKEND]	Stores records and syncs them between your staff.
[EMAIL PROVIDER]	Delivers receipt emails you choose to send.
[AI / OCR PROVIDER, if used]	Reads box labels when you use the photo fallback instead of the scanner.

We may also disclose information where we are required to by law, a court order, or a lawful request from a Tanzanian authority.

Be accurate here List the real providers you use. If the photo fallback sends images to a third party, that must be named — a shopkeeper photographing a box label is sending that image somewhere, and they are entitled to know where.

6. Where it is stored

Storebook is hosted on servers located in [COUNTRY / REGION], which is outside Tanzania.

The Personal Data Protection Act restricts transferring personal data outside Tanzania. We rely on [BASIS — e.g. your consent, contractual necessity, or a Commission approval] for this transfer, and we require our providers to protect the data to the standard the Act expects.

Discuss this section with a lawyer Cross-border transfer is the part of the Act most likely to apply to you, because Netlify and most cloud providers store data outside Tanzania. Do not guess at the basis — get it confirmed and write the real answer here.

7. How long we keep it

While your shop's account is active, we keep your records so the service works.
If you stop paying, nothing is deleted. Your data stays available for export, and selling and receiving pause until payment resumes.
If you ask us to delete your shop, we delete your records within [NUMBER] days, except anything we must keep by law.
Backups may hold copies for up to [NUMBER] days after deletion before they are overwritten.

8. Your rights

Under the Personal Data Protection Act you can:

Ask what personal data we hold about you and get a copy.
Ask us to correct anything that is wrong.
Ask us to delete your data, where we are not required to keep it.
Object to how we use it, or ask us to restrict it.
Export your shop's records at any time — the app does this yourself in Excel or JSON, without asking us.
Complain to the Personal Data Protection Commission if you think we have handled your data wrongly.

To exercise any of these, contact us on the details in section 13. We will respond within [NUMBER] days.

If you are a customer of a shop that uses Storebook and you want your details removed, please ask that shop directly — the records belong to them, and they can delete them. If you cannot reach them, contact us and we will help.

9. Security

Data is encrypted in transit between your phone and our servers.
Access is controlled by shop code and per-person permissions, so staff only see what you allow.
Every action is attributed to the person who performed it.
Only [WHO] on our side can access shop data, and only to fix problems or when you ask for help.

No system is completely secure. If a breach affects your data, we will tell you and notify the Commission as the law requires.

10. If you run a shop using Storebook

You are responsible for the customer details your shop records. In practice that means:

Only collect what you actually need — a name and phone number is usually enough for a receipt and a warranty.
Tell your customers you are keeping their details, and why.
Do not use Storebook records to send marketing messages your customers did not agree to.
Give your staff only the permissions they need.
If a customer asks you to delete their details, delete them.

Your own obligations under the Personal Data Protection Act, including whether your shop must register with the Commission, are yours to meet. We can point you to the Commission but we cannot do it for you.

11. Children

Storebook is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children. If a child's details end up in a shop's customer records, that is the shop's responsibility to handle lawfully.

12. Changes to this policy

If we change how we handle personal data, we will update this page and change the date at the top. If the change is significant, we will tell you in the app or by message before it takes effect.

13. Contact

[REGISTERED COMPANY NAME]
[ADDRESS], Dar es Salaam, Tanzania
WhatsApp +255 678 202 026 · support@storebook.co.tz

You may also contact the Personal Data Protection Commission directly at pdpc.go.tz.