Privacy notice

In short

We cannot read your receipts. Each receipt is encrypted with a key that belongs to you. We store the sealed copy.
Matching uses fingerprints. When a till sends a phone number, an email address or a KRA PIN with a receipt, we compare one-way fingerprints, not the details themselves. The details you give on your profile are kept in your account, as section 3 explains. Card numbers are never stored in full.
You are in control. Share one receipt, export everything, or delete anything at any time.
Never sold. No advertising, no profiling, no sale of data.

1. Who we are

Shahidi Box is a product of Receipters Technologies Limited (“Receipters”, “we”, “us”). Receipters Technologies Limited decides why and how personal data is used in Shahidi Box, which makes us the data controller under the Kenya Data Protection Act, 2019 (“the Act”). You can reach us at receipters@receipters.com.

2. What this notice covers

This notice covers two things:

This website, the early-access list and your account and profile (signing up, signing in and the details you give), which are live now.
The Shahidi Box service, which is not open yet. This part describes how the service is designed to work, and it is the standard we are building to. Before launch we will review this notice again and tell early-access members about any change.

3. What we hold

Information	Why we hold it	Who can read it
Early-access list. Your name, your email address (or, for some early entries, your phone number), and whether you are a person, a business, an enterprise or a POS vendor.	To tell you when Shahidi Box opens for you.	A small number of Receipters staff running the launch. We need to read it to reach you.
Your account. The same details, plus when you created the account and when you last signed in.	To run your account, send you sign-in codes, and tell you when your box opens.	A small number of Receipters staff running the launch. Stored in an encrypted database.
Your profile. Your phone number, your address (county, town and street), your KRA PIN, your National ID number and your date of birth. For a business, an enterprise or a POS vendor, also the business name and registration number. A password and a four-digit PIN, kept only as scrambled values.	To run your account, to confirm that the account holder is 18 or over, and, from launch, to match receipts to you and to send service notices. Your phone number is not verified yet.	The details: a small number of Receipters staff running the launch, stored in an encrypted database. The password and PIN: nobody. They are scrambled together with a separate secret key, and cannot be turned back into the original.
Sign-in codes and sessions. A one-time code is kept for 10 minutes, and only as a scrambled fingerprint. A sign-in session is kept as a fingerprint of its token, for up to 30 days or until you sign out. For each place you are signed in we also keep the browser and system, the first two parts of the IP address and, where your network says it, the town and country, so that you can see where you are signed in and sign a device out. The same period applies. Short-lived counters, kept for about two hours, limit how often codes can be requested and passwords and PINs can be tried. A count of wrong passwords and PINs for your account is kept for the day, so that a PIN cannot be guessed. They use a fingerprint of your email address and of your network address.	To check that it is you, and to stop abuse.	Nobody. A fingerprint cannot be turned back into the code or the token.
Website logs. Your IP address, browser type and the time of each request, kept by our hosting provider.	To keep the website running and secure.	Our hosting provider and the staff who run the website.
Your receipts (from launch). Everything printed on the receipt: items, amounts, seller, branch, cashier, payment method, KRA signature and QR code.	To keep them for you.	Only you and anyone you choose to share a receipt with. Stored sealed.
Your tags and notes (from launch).	To help you find your receipts.	Only you. Stored sealed.
Matching fingerprints (from launch). A one-way fingerprint of your phone number, email address or KRA PIN.	To match an incoming receipt to the right box without reading it.	Not readable. A fingerprint cannot be turned back into the original.
Delivery records (from launch). That a receipt arrived, when, its size, and any error.	To deliver receipts reliably and fix faults.	Receipters engineers, with access logged. This record contains no receipt contents.

What we do not collect: no advertising identifiers, no location tracking, no access to your contacts, no analytics or tracking cookies on this website, and none of the documents you lock in Important docs, which stay on your device.

4. How your receipts are protected

Sealed on arrival. When a till sends a receipt, it is encrypted with a key that belongs to you before it is stored.
Masked identifiers. Details used only for matching are turned into one-way fingerprints. Where a receipt shows a card or a phone number, it is masked.
In transit and at rest. Every connection uses TLS. Stored data is encrypted on disk as well.
Tamper evidence. Every receipt has a fingerprint, so a later change to the original shows.
Limited access. Receipters staff cannot read receipt contents. Access to systems is limited and logged.

The Security page explains this in more detail, including what happens if you lose your keys.

5. Why we use information, and our legal basis

Purpose	Legal basis under the Act
Creating your account, keeping the early-access list and contacting you about launch	Your consent, which you give by submitting the sign-up form. You can withdraw it at any time.
Keeping the profile details you give: phone number, address, KRA PIN, National ID number and date of birth	Your consent, which you give by completing the profile, and performance of what you ask for when you create an account.
Sending sign-in codes and keeping your account secure	Performance of what you ask for when you create an account, and our legitimate interest in protecting accounts from abuse.
Running your box, delivering and keeping your receipts (from launch)	Performance of our agreement with you under the Service Terms.
Keeping the service secure and preventing abuse	Our legitimate interest in protecting the service and its users.
Meeting a legal duty, for example answering a lawful order	Legal obligation.

We do not use your information for advertising, profiling or automated decisions that affect you. We do not sell it, rent it or trade it.

People you choose. You can share a single receipt with a link that expires, and take the link back at any time. Sharing one receipt never shares the rest.
The shop that issued the receipt. The shop already has its own copy. Shahidi Box does not send them anything from your box.
Service providers. We use Amazon Web Services to host the website and the service, and Resend (a United States email delivery service) to send sign-in codes and other messages by email. Your email address, and the message we send you, pass through it to reach you. They process data for us under contract and cannot use it for their own purposes. Receipt contents are sealed before they reach them.
The authorities. If a court or authority lawfully orders us to hand over data, we can only provide what we hold: sealed receipts we cannot open, and the limited records listed in section 3. We will check that the order is valid, give only what the law requires, and tell you unless the law forbids it.

7. Where data is stored

The website, the early-access list and accounts are hosted on Amazon Web Services in the United States (North Virginia). Sign-in emails are sent through Resend, also in the United States. Sending personal data outside Kenya is allowed by the Act with appropriate safeguards, and we rely on contracts with our provider and on encryption. Before the service opens, we will confirm where service data is stored and publish it here.

8. How long we keep information

Early-access list, account and profile details: until you are invited and open a box, or until you ask us to remove you. If you never join, we delete the record within 24 months of launch.
Sign-in codes: 10 minutes, or until used. Sign-in sessions: up to 30 days, or until you sign out. Request counters: about two hours.
Receipts that nobody claims: held sealed for 90 days, then deleted.
Your receipts, tags and notes: until you delete them, or until you close your box.
After you delete a receipt or close your box: removed from our systems within 30 days, including backups.
Website logs: a short period set by our hosting provider, then deleted.

9. Your rights

Under the Act you have the right to:

be told how your personal data is used (this notice);
see the personal data we hold about you;
object to our use of it, or ask us to restrict it;
have wrong data corrected;
have your data deleted;
receive your data in a common, machine-readable format and take it elsewhere; and
withdraw your consent at any time, without affecting what we did before.

Most of these you can do yourself. From launch, you can export all your receipts and delete any receipt or your whole box in the app. For the early-access list, or anything else, write to receipters@receipters.com with the subject “Data request”. We may ask you to confirm who you are first. We answer within the time the Data Protection (General) Regulations, 2021 set: 7 days to give you access to your data, and 14 days to correct or delete it.

10. If something goes wrong

If a data breach puts your information at risk, we will notify the Office of the Data Protection Commissioner within 72 hours, and tell the people affected without unreasonable delay, saying what happened and what to do. Because receipts are sealed, a breach of our storage would not by itself reveal their contents.

11. Children

Shahidi Box is for people aged 18 and over. We do not knowingly collect information from children. If you think a child has given us information, write to us and we will delete it.

12. Cookies

This website sets only essential cookies: one that remembers you have seen the cookie message and, when you sign in, one that keeps you signed in. It also keeps small items in your browser’s storage: a note saying that you have signed in, so that the menu can show “Your box”; the email address you last signed in with, so that the PIN window on that device knows who you are and needs only your PIN (“Not you?” removes it); your choice to hide your details on screen; and, until your box is live, your notes. If you add documents to Important docs, they are kept in your browser, locked, and are never sent to us. The cookie notice lists them. It sets no advertising cookies and uses no third-party trackers or analytics. Our fonts and images come from our own pages. The cookie notice lists every cookie. You can accept, reject non-essential cookies or change your settings at any time from the “Cookie settings” link in the footer. If we ever add a cookie that is not essential, it stays off unless you accept it.

13. Changes to this notice

When we make a material change, we will update the date at the top and tell early-access members by email or message before it takes effect.

14. Contact and complaints

Questions or requests: receipters@receipters.com.

If you are not happy with how we handled your information, you have the right to complain to the Office of the Data Protection Commissioner of Kenya: www.odpc.go.ke. We would like the chance to put it right first.