Privacy policy

Last updated 4 November 2026

This policy explains what personal data NEXUS FLOW collects, why, and the choices you have. We handle personal data in line with the Kenya Data Protection Act, 2019, and similar laws that apply to you.

1. Data we collect

• Account data: your name, email address, a hashed password (we never store the password itself), and your business name and settings.
• Business records you enter: clients (names, phone numbers, emails, addresses), invoices, payments and expenses.
• Billing data: the plan you buy, amounts, dates and payment references. Card and M-Pesa details are entered on Paystack's checkout and are not stored by us.
• Account activity: a log of actions in your account (for example sign-ins, invoices created, settings changed) with the time, your IP address and a basic device description. It is shown to you on the Activity log page and kept for about 13 months.
• Support and messages: the tickets you send to our support team, and notifications we send you in the app.
• Technical data: basic server logs such as IP address, browser type and the pages requested, kept for security and troubleshooting.

2. How we use it

• To provide the service: sign you in, store your records, generate invoices and summaries.
• To send emails you need: email verification, password resets, payment receipts, and invoices you choose to send to your clients.
• To process subscription payments and prevent fraud and abuse.
• To answer your support requests and, if you have not opted out in Settings, send you product news and announcements.
• To keep the service secure and fix problems.

We do not sell personal data, and we do not use it for advertising.

2a. Your clients' data

When you add your clients to NEXUS FLOW, you decide what to store and why. You are responsible for having a lawful reason to hold their details. We process that data only on your behalf to provide the service. Invoice links you share are private and can be opened only by someone who has the link.

3. Cookies

We use one essential cookie to keep you signed in. It is secure and cannot be read by page scripts. We do not use advertising cookies or third-party trackers.

To see how many people visit our public pages (home, sign-in, terms and privacy) we count visits ourselves, without cookies. We never store your IP address or browser details: a one-way scrambled code made from them is used only to avoid counting the same visitor twice in a day, and it is deleted after two days. We keep only totals, such as visits per page and where visitors came from. We honour Do Not Track and Global Privacy Control, and we do not count visits to your signed-in pages or to invoices shared with your clients.

4. Who we share data with

We use trusted providers to run the service. They process data only to provide their service to us:

• MongoDB Atlas, for database hosting.
• Render, for application hosting.
• Paystack, for payment processing.
• Brevo, for sending email.

Some of these providers may process data outside Kenya. We may also disclose data when the law requires it or to protect the service and its users.

5. How long we keep it

We keep your data while your account is open. You can delete your account yourself at any time from Settings, which permanently removes your business data straight away, except records we must keep by law, such as payment records for our own accounting.

6. Security

Passwords are hashed, sign-in uses secure cookies, traffic is encrypted, and every business can access only its own records. No system is perfectly secure, so please use a strong, unique password.

7. Your rights

You can ask to see the personal data we hold about you, correct it, delete it, or object to how we use it. You can edit most of it in the app, and download a copy of all your data from Settings. For anything else, or if you want to raise a concern, contact us at the contact details on our website. You also have the right to complain to the Office of the Data Protection Commissioner in Kenya.

8. Children

The service is for businesses and is not directed at children under 18.

9. Changes

If we change this policy in a significant way we will tell you in the app or by email. The date at the top shows when it was last updated. See also our terms of service.