Privacy Policy
Last updated: 11 October 2026 · CoreStack, Republic of Kenya
1. Introduction
CoreStack ("we", "our", or "us"), a company incorporated under the laws of the Republic of Kenya, is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, disclose, and safeguard your personal data when you use our services, available at corestack.co.ke and any CoreStack-hosted subdomain (e.g. yourbusiness.corestack.co.ke).
This Policy is prepared in compliance with the Data Protection Act 2019 (Kenya) ("DPA"), the regulations thereunder, and the guidance issued by the Office of the Data Protection Commissioner (ODPC). It applies to all individuals whose personal data we process, including customers, prospective customers, website visitors, and Authorised Users.
2. Data Controller and Data Processor
Under the DPA:
- CoreStack as Data Controller: When we collect personal data directly from you (e.g., account registration, contact forms, billing), we act as the data controller and determine the purposes and means of processing.
- CoreStack as Data Processor: When you use our services to store and process personal data of your customers, employees, or contacts, we act as a data processor on your behalf. You remain the data controller for such data.
We have registered with the Office of the Data Protection Commissioner (ODPC) in compliance with Section 18 of the DPA.
3. Personal Data We Collect
3.1 Data You Provide Directly
- Account information: Full name, email address, phone number, company name, job title, and business registration details.
- Billing information: M-Pesa phone number, bank account details, or card details (processed by third-party payment processors; we do not store full card numbers).
- KYC information: Business registration certificates, KRA PIN, and identification documents where required for compliance.
- Support correspondence: Emails, chat logs, and call recordings related to customer support.
- User-generated content: Data you enter into the Services, including business records, invoices, and customer information.
3.2 Data Collected Automatically
- Device and browser data: IP address, browser type, operating system, device identifiers, and screen resolution.
- Usage data: Pages visited, features used, timestamps, click patterns, and session duration.
- Cookies and similar technologies: We use cookies, local storage, and similar tracking technologies as described in Section 8.
- Log data: Server logs including access times, error logs, and API request metadata.
3.3 Data from Third Parties
- Payment verification data from M-Pesa and other payment providers.
- Tax compliance data from KRA systems (eTIMS, iTax).
- Google account information (email, display name, profile picture URL) when you choose to sign in with Google — see Section 4.
- Publicly available business registration information.
4. Google User Data (Google Sign-In)
CoreStack offers "Continue with Google" as an optional sign-in method for business owners and their staff. When you choose this option:
4.1 What we access
- Your Google account email address — to match you to an existing CoreStack account.
- Your display name and profile picture URL — to display your identity in the interface.
- A stable Google account identifier — so we recognize you on future sign-ins.
We request only the OAuth 2.0 openid, email and profile scopes. We do not access Gmail, Google Drive, Google Calendar, Google Contacts, or any other Google service.
4.2 How we use Google user data
- To authenticate you and grant access to your CoreStack workspace.
- To display your name and avatar in the CoreStack interface.
- To associate your Google identity with your existing CoreStack account.
4.3 What we never do with Google user data
- We never sell Google user data.
- We never use Google user data for advertising, profiling, or targeted marketing.
- We never share Google user data with third parties except our hosting/infrastructure service providers acting strictly on our behalf, and only as necessary.
- We never use Google user data to train machine-learning models.
- We never transfer Google user data except (a) as needed to provide or improve the Service, (b) to comply with applicable law, or (c) as part of a merger/acquisition with prior notice.
4.4 Google API Services Limited Use disclosure
CoreStack's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4.5 Revoking Google access
You can revoke CoreStack's access to your Google account at any time at myaccount.google.com/permissions. Revoking access will prevent Google sign-in; you may still use a password if one is set.
4.6 Limited Use commitments
Our use of Google user data is limited to the following:
- Use: We use Google user data only to authenticate you and display your identity within the CoreStack interface. We do not use it for advertising, profiling, or any purpose not disclosed in this policy.
- Storage: Google user data (email, display name, profile picture URL, and Google account identifier) is stored in our databases for the lifetime of your CoreStack account. It is deleted within 30 days of account closure, subject to legal retention obligations.
- Sharing: We share Google user data only with our infrastructure and email delivery providers (hosting, transactional email) acting strictly on our behalf under written data processing agreements. We do not sell, rent, or transfer Google user data to any third party for their own purposes.
- Human access: Our staff do not read Google user data except when necessary for security investigation or legal compliance.
- Prohibited uses: We never use Google user data for serving advertisements (including retargeting or interest-based ads), determining credit-worthiness, or lending purposes. We never sell Google user data to advertising platforms, data brokers, or information resellers.
- AI/ML: We do not use Google user data to train machine-learning models.
CoreStack's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
5. Legal Basis for Processing
In accordance with Section 30 of the DPA, we process personal data on the following legal bases:
- Performance of a contract (Section 30(a)): Processing necessary to provide the Services you have subscribed to, including account management, billing, and technical support.
- Consent (Section 30(b)): Where you have given explicit consent, such as for marketing communications and non-essential cookies. You may withdraw consent at any time.
- Legitimate interests (Section 30(e)): Processing necessary for our legitimate business interests, including service improvement, fraud prevention, and security, provided such interests are not overridden by your rights and freedoms.
- Legal obligation (Section 30(c)): Processing required to comply with Applicable Law, including tax reporting and anti-money laundering requirements.
6. How We Use Your Personal Data
We use your personal data to:
- Provide, operate, and maintain the Services
- Process transactions and send related information
- Respond to your comments, questions, and support requests
- Send you technical notices, updates, and security alerts
- Communicate about products, services, and events (with your consent)
- Monitor and analyse usage trends to improve the Services
- Detect, prevent, and address fraud, security, or technical issues
- Comply with legal and regulatory requirements
We do not use your data for advertising. We do not sell your data or your customers' data.
7. Data Sharing and Disclosure
We do not sell your personal data. We may share your data in the following circumstances:
- Service providers: With third-party vendors who perform services on our behalf (payment processing, hosting, analytics, customer support, email/SMS delivery).
- Legal requirements: When required by law, regulation, or legal process, or to protect the rights, property, or safety of CoreStack, our users, or the public.
- Business transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction.
8. Cookies and Tracking Technologies
We use cookies and similar tracking technologies to collect and use personal data. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of the Services.
- Essential cookies: Required for the operation of the Services (authentication, security, load balancing).
- Analytics cookies: Help us understand how users interact with the Services.
- Marketing cookies: Used to deliver relevant advertisements (only with your consent).
9. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. When data is no longer needed, we securely delete or anonymise it.
Account data is retained for the duration of your subscription and for a period of up to seven (7) years after termination to comply with tax and legal obligations under Kenyan law. Google user data (email, name, avatar URL, Google ID) is deleted with the rest of your account data on closure.
10. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption in transit (TLS), access controls, regular security assessments, and staff training.
However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your personal data, we cannot guarantee its absolute security.
11. Your Rights Under the DPA
Under the Data Protection Act 2019, you have the following rights:
- Right to be informed: Know what personal data we collect and how we use it.
- Right to access: Request a copy of the personal data we hold about you.
- Right to rectification: Request correction of inaccurate or incomplete personal data.
- Right to erasure: Request deletion of your personal data in certain circumstances.
- Right to object: Object to the processing of your personal data for certain purposes.
- Right to data portability: Request transfer of your data to another controller.
- Right not to be subject to automated decision-making: Where decisions are made solely by automated means.
To exercise any of these rights, contact us at [email protected]. We will respond within thirty (30) days.
12. Data Breach Notification
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner (ODPC) within seventy-two (72) hours of becoming aware of the breach, and we will notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights.
13. International Data Transfers
CoreStack's servers are located in the European Union. If you are located outside the EU, your data may be transferred to and processed in the EU. We rely on Standard Contractual Clauses and equivalent safeguards where applicable, in accordance with Section 48 of the DPA.
14. Children's Privacy
Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us, and we will take steps to delete it.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least fourteen (14) days before they take effect. We encourage you to review this page periodically.
16. Contact Us
For questions about this Privacy Policy or to exercise your data protection rights, contact us at:
You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC):