Last updated 2 October 2026

Privacy Policy

Inventora is operated by Rapido Technologies (“we”, “us”). We provide point-of-sale, inventory and business management software to shops in Kenya through this website and the Inventora app at app.inventora.co.ke. This policy explains what personal data we handle, why, who we share it with and the rights you have under the Kenya Data Protection Act, 2019. It should be read together with our Terms of Service.

1. Our role

For account holders, their staff and visitors to this website, we decide how data is used and act as the data controller.

When a shop records its own customers, suppliers or sales in Inventora, the shop is the data controller and we act as its data processor: we store and process that data only to provide the service to the shop, on its instructions. Customers of a shop who want to exercise their rights should contact that shop first; we will help the shop respond.

2. What we collect

Account details — name, email address, phone number, business name, location, KRA PIN and business details you give us when you sign up.
Staff details — names, phone numbers, roles, PINs (stored hashed), attendance, shifts, leave and payroll information that a business adds for its employees.
Business records — products, stock, sales, receipts, invoices, expenses and the customer and supplier names or phone numbers a shop chooses to record.
Payment information — M-Pesa phone numbers, transaction references and amounts for subscription payments and for payments a shop takes through Inventora. We do not store card numbers or M-Pesa PINs.
Support records — messages you send us and notes from support calls, so we can resolve your issue and improve our support.
Technical data — IP address, approximate location derived from it, device and browser type, and error reports from the app.
Website enquiries — the name, phone number, email address and message you submit through our contact form.
Website analytics — pages visited and how you arrived on this site, collected with cookies (see section 7).

3. Why we use it

To create and run your account and provide the service you signed up for (contract).
To process subscription payments and the payments your shop takes (contract).
To submit tax invoices to KRA eTIMS when you enable it, and to keep financial records the law requires (legal obligation).
To send service messages such as receipts, verification codes, billing reminders and security alerts by email or SMS (contract and legitimate interest).
To answer enquiries, provide support and call you back when you ask us to (legitimate interest, or steps you asked for before entering a contract).
To keep the service secure, detect fraud and abuse, and fix errors (legitimate interest).
To understand how the website is used and improve it (consent, through your cookie choices).

We do not sell personal data and we do not use it for advertising on other websites.

4. Who we share it with

We share personal data only with service providers that help us run Inventora, and only what each one needs:

Payments — KopoKopo (M-Pesa) and DPO Pay, to collect and confirm payments.
Messaging — Bulksasa for SMS, and Google (Gmail) and EmailJS for email.
Hosting and storage — our cloud servers, MongoDB Atlas (database) and Cloudinary (product and business images).
Monitoring and analytics — Sentry (error reports) and Google Analytics (website usage).
Kenya Revenue Authority — invoice data submitted to eTIMS on your behalf when you enable it.

We may also disclose data where the law requires it, for example to comply with a court order or a lawful request from a public authority.

5. Transfers outside Kenya

Some of the providers above store or process data outside Kenya. When that happens we rely on providers that apply appropriate security safeguards, as required by sections 48 to 50 of the Data Protection Act.

6. How long we keep it

Account and business records — for as long as your account is active.
After you close your account — we delete or anonymise your data within 90 days, except financial and tax records, which Kenyan law requires us to keep for at least 5 years.
Website enquiries — up to 24 months after our last contact with you.
Support messages and call notes — up to 12 months.

7. Cookies

The Inventora app uses essential cookies to keep you signed in. This website uses Google Analytics cookies to measure visits. You can block or delete cookies in your browser settings; the website will still work without analytics cookies.

8. How we protect it

Data is encrypted in transit (HTTPS). Passwords and PINs are stored as one-way hashes, and third-party integration keys are encrypted at rest. Access inside each business is limited by role-based permissions, and access to our systems is limited to staff who need it. No system is perfectly secure; if a breach affects your personal data, we will notify you and the Office of the Data Protection Commissioner as the law requires.

9. Your rights

Under the Data Protection Act you have the right to:

be told how your personal data is used;
access the personal data we hold about you;
have inaccurate or misleading data corrected;
have data deleted where we no longer have a lawful reason to keep it;
object to processing, including for direct marketing;
withdraw consent at any time, where we rely on consent;
receive your data in a portable format.

To use any of these rights, contact us using the details below. We will respond within the time the law allows. If you are not satisfied with our response, you can complain to the Office of the Data Protection Commissioner at www.odpc.go.ke.

10. Children

Inventora is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18.

11. Changes to this policy

We may update this policy as the service changes. We will change the date at the top of the page, and for significant changes we will notify account holders by email or in the app.

12. Contact us

For privacy questions or requests, message us on WhatsApp or call +254746569025 or +254724797790.