Privacy Policy

Mkulima Seedlings management app · Effective 1 October 2026

This app is the internal management system of Mkulima Seedlings Limited ("we", "us"), a seedling nursery in Nakuru, Kenya. It is used by our staff to record sales, bookings, sowing, stock, customers, staff and accounts. This policy explains what information the app holds, why, and how it is protected.

Who can use the app

The app is for Mkulima Seedlings staff only. Accounts are created by the company; the public cannot sign up. Managers sign in with a password. The Sowing Team area opens without a password and can only see sowing-related information (sowing records, stock, seedling catalogue, bookings and propagation) — never customers, sales, money or staff records.

Information the app stores

• Customers: name, phone number, email (if given), location, crops grown, purchase history, amounts owed and follow-up notes.
• Sales and bookings: items, quantities, prices, payments, payment method, receipt numbers and M-Pesa receipt codes.
• Staff: name, phone number, role, salary, attendance, staff loans and payroll.
• Nursery records: sowing, stock, catalogue prices, propagation jobs, suppliers, purchases, income and expenses.
• Activity log: which staff role made a change and when (audit trail).

The app does not collect location from your phone, contacts, photos, advertising IDs or any data for advertising. It contains no ads and no analytics or tracking tools.

Why we use it

Only to run the business: serving customers, issuing receipts and statements, planning sowing and pick-ups, managing stock, paying staff and keeping accounts. We do not sell or rent this information to anyone.

Where it is kept

• Records are stored in a secure online database provided by Supabase (servers in Frankfurt, Germany, European Union), so that all staff devices share the same data.
• The app itself is served by Render.
• When a customer pays by M-Pesa through the app, their phone number and the amount are sent to Safaricom to request the payment, and Safaricom returns the M-Pesa receipt code. We keep the phone number, amount, status and receipt code of each request.
• Each signed-in device also keeps a copy so the app works without internet. When a different role signs in on the same device, the previous copy is cleared once its changes have been uploaded.

These providers (and Safaricom for M-Pesa payments) process data only to run the app and the payments. We may also disclose information if Kenyan law requires it.

How it is protected

• All connections are encrypted (HTTPS).
• Passwords are checked by the server and stored only in hashed form.
• The server enforces what each role may see and change.
• Regular backups are kept by the company.

How long we keep it

We keep records for as long as needed to run the business and to meet our legal, tax and accounting obligations under Kenyan law, then delete them.

Your rights

Under Kenya's Data Protection Act, 2019, customers and staff may ask to see the information we hold about them, have it corrected, or have it deleted where we are not required to keep it. To make a request, contact us using the details below.

Children

The app is a business tool for adult staff and is not directed at children.

Changes

If we change this policy we will update this page and the date at the top.

← Back to the app