Privacy Policy

Ghalalytics ("we", "our", "us") operates the warehouse management platform available at ghalalytics.com. We are registered in Kenya. Questions about this policy can be sent to privacy@ghalalytics.com.

We collect the following categories of personal data:

• Account data: name, email address, company name, and job title provided at registration or during onboarding.
• Usage data: pages visited, features used, and actions taken within the application (collected via analytics).
• Inventory and business data: products, suppliers, stock movements, purchase orders, and other records you create within the platform. This data is owned by you.
• Device data: IP address, browser type, operating system, and device identifiers (collected automatically by our servers).
• Billing data: payment card type, last four digits, and billing address. Full card numbers are processed by our payment processor (Stripe) and are never stored by us.

We use your data to:

• Provide, maintain and improve the Ghalalytics platform.
• Authenticate users and enforce role-based access controls.
• Send transactional emails (password resets, receipts, system alerts).
• Send product updates and marketing communications (you may opt out at any time).
• Analyse usage patterns to improve the product.
• Comply with legal obligations (tax reporting, fraud prevention).

Where applicable, we process personal data under the following lawful bases: performance of a contract (to provide the service), legitimate interests (to improve the product and prevent fraud), legal obligation, and consent (for marketing communications).

We do not sell your personal data. We share data only with:

• Infrastructure providers: Vercel (hosting), Neon (database), Cloudflare (CDN) — all process data under strict data processing agreements.
• Payment processor: Stripe Inc. for billing.
• Analytics: Vercel Analytics (privacy-preserving, no cookies).
• Email delivery: Resend Inc. for transactional email.
• Legal authorities: when required by law or to protect our rights.

Account and business data is retained for the duration of your subscription plus 90 days after cancellation (to allow account recovery). After that, all data is permanently deleted. You may request immediate deletion at any time.

Depending on your location, you may have the right to:

• Access a copy of the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data.
• Object to or restrict processing.
• Request data portability (in machine-readable format).
• Withdraw consent for marketing at any time.

To exercise any of these rights, email privacy@ghalalytics.com.

We use only strictly necessary cookies for session management and authentication. We do not use third-party advertising cookies. Our analytics are cookieless and privacy-preserving.

We encrypt all data in transit (TLS 1.3) and at rest (AES-256). We use row-level security in our database and conduct regular security reviews. Despite these measures, no system is perfectly secure and we cannot guarantee absolute security.

We may update this policy from time to time. Material changes will be notified by email and an in-app banner at least 14 days before they take effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy.