Who we are and what this covers
This Privacy Policy explains how TillSync (“we”, “us”, or “our”) handles personal data in the TillSync Android app (com.tillsync.app), web dashboard, public website, and support communications. Our privacy contact is hello@tillsync.co.ke.
TillSync helps businesses in Kenya share incoming M-Pesa Till payment information with authorised staff and record who served each sale. It does not process payments, hold funds, or independently verify settlement.
For account administration, service security, support, and our own product operations, TillSync determines how personal data is used. A business using TillSync determines why its customer and staff records are processed; we process those business records to provide the service. The business remains responsible for its own notices, lawful basis, access decisions, and independent use of those records.
Information we collect
- Account and sign-in details: your email address, account identifier, authentication provider, and sign-in information processed by Firebase Authentication. Google sign-in can also supply your Google account name and profile information.
- Profile details: the display name you or your business owner provides, your optional phone number, and an optional profile photo you choose and save. Selected photos are resized before upload.
- Business and team records: business name and type, account-to-business links, roles, membership status, permissions, device labels, and settings.
- Payment and SMS data: recognised M-Pesa receipt messages, transaction codes, amounts, receipt and synchronisation times, payer names, phone-number information as supplied in the message, and the Till identifier. The original receipt can contain an account balance and other financial information.
- Sales claims: which account claimed or was assigned a payment, the associated display name, and when the claim was made.
- Till-phone health: device identifiers used within your business, app version, SMS-permission status, connection and synchronisation times, pending-message counts, battery level, and charging status.
- Notification data: push-registration tokens, installation identifiers, platform, notification preferences, and delivery or interaction information.
- Usage and technical data: app interactions, screen names, sign-in method, role or business-type categories, app and operating-system versions, device characteristics, installation or advertising identifiers when available, and network information such as IP addresses. Analytics providers can derive approximate geographic information from an IP address.
- Support and website requests: information you send us by email, the request and our replies, and standard web-hosting or security information such as requested URLs, timestamps, browser information, and IP addresses.
Some information comes directly from you; other information comes from the business owner, incoming M-Pesa messages, your device, or the sign-in and infrastructure services described below. Please do not send M-Pesa PINs, passwords, one-time codes, or complete financial statements to support.
SMS access and background operation
On a Till phone with SMS permission, TillSync receives new incoming messages from the M-Pesa sender, identifies supported payment receipts, and uploads the recognised receipt information and original receipt text to your business’s cloud records. This can happen while the app is in the background or the screen is locked.
The Android app requests permission to receive incoming SMS, not permission to read your existing SMS inbox. Messages from other senders are excluded from payment processing. M-Pesa messages can be temporarily queued on the device; messages that are not recognised as supported payment receipts are discarded during processing rather than uploaded as payments.
The original receipt text is stored separately from the shorter payment record because it can include your account balance. A payment’s amount, code, payer information, and time are shared with authorised members of that business. The original receipt is available to the owner and to members the owner specifically permits.
The app uses a background service, a running notification, and device-start support to keep the Till phone working. Network failures can leave messages queued locally until they are processed or sent. Restricting battery activity can delay delivery.
You can revoke SMS permission in Android Settings to stop new SMS access. Removing permission or uninstalling the app does not delete records already synchronised to the cloud. See account and data deletion to request their removal.
We do not sell SMS data, use receipt text for advertising, or upload your unrelated personal conversations as payment records. Use a dedicated business Till phone where possible, and enable SMS access only on a phone you are authorised to connect.
Why we use information
- Create and authenticate accounts, maintain business memberships, and enforce permissions.
- Deliver the payment feed, search, sales claims, totals, reports, and exports you request.
- Synchronise Till-phone receipts, retry queued payments, and show whether a device needs attention.
- Send payment notifications and relevant account or service communications.
- Answer support requests, correct data, handle privacy requests, and investigate faults or misuse.
- Understand how the app is used, maintain reliability, and improve features using product-usage information.
- Meet legal obligations, protect accounts and the service, and establish or defend legal claims where necessary.
We rely on the lawful basis appropriate to the activity, including providing the service under our agreement with you, your consent where required, legitimate interests that do not override your rights, and legal obligations. A business must have its own lawful basis for processing its staff and customers’ information. Granting a phone permission does not by itself establish that lawful basis for everyone named in a receipt.
If consent is the basis for an optional activity, you can withdraw it by contacting us. Withdrawal does not affect processing that was lawful before withdrawal. Core functions may be unavailable if the information or permission they require is not provided.
Payment notifications
A payment alert can show an amount, M-Pesa transaction code, and a shortened payer name. The notification does not contain the original SMS, the customer’s phone number, or the account balance. Notification content is processed by the push provider and may appear on a device’s lock screen.
Use Android’s notification settings to turn notifications off or control lock-screen previews. Business permissions also affect which payment alerts a member receives. Disabling notifications does not delete payment records or prevent an authorised user from opening the feed.
Analytics and browser storage
The Android app uses Firebase Analytics to measure interactions such as screen visits, sign-in methods, onboarding choices, and feature use. The SDK can also collect device or installation identifiers, advertising identifiers when available, device and app information, notification interactions, and approximate geographic information. These identifiers are not necessarily anonymous.
Our custom analytics events do not include payment amounts, M-Pesa codes, payer names, phone numbers, passwords, or raw SMS text. We do not use payment-message content to create advertising profiles or serve targeted advertising.
The public marketing website does not include a Firebase Analytics integration. Hosting providers still process standard request information to serve and protect it. The website and web dashboard may use browser storage for appearance or display preferences; the dashboard also stores authentication state. Clearing browser storage can reset preferences or sign you out, but it does not delete cloud records.
Contact hello@tillsync.co.ke to ask about analytics processing, withdraw applicable consent, or request deletion of identifiable analytics data. We include relevant provider-side requests where data can be linked to your account or installation. Statistics that have been irreversibly anonymised and can no longer identify anyone may be retained.
Retention and deletion periods
We keep identifiable information only while it is needed for the purposes described in this policy or a specific legal requirement. An attendant’s normal 24-hour access window is an access limit, not automatic deletion of older business records.
- Active account and business records: kept while needed to provide the account and business service, subject to valid requests for correction or deletion. The business must not use the service as an indefinite archive without a continuing lawful purpose.
- Deletion requests: we respond within 14 calendar days of receiving the request and aim to complete verified deletion from our active systems within 30 calendar days of verification, or sooner where applicable law requires. If an exception applies, we explain it rather than silently extending retention.
- Backups under our control: residual deleted data is removed or overwritten within 90 days after active-system deletion. It is restricted from ordinary use; if a backup is restored, the deletion must be reapplied.
- Firebase provider-side records: Google documents a separate period of up to 180 days for removal of Firebase Authentication data and Firebase installation data from its live and backup systems after the relevant deletion request. This is separate from our 90-day backup limit. We initiate applicable provider deletion as part of handling your request.
- On-device data: queued M-Pesa messages remain until processed, removed, or the app’s local data is cleared. Device caches and downloaded reports can remain on devices you control. Clearing TillSync’s app storage or uninstalling removes its local app data, but not independently saved exports or the phone’s SMS inbox.
- Limited exceptions: a specific legal obligation, fraud or security investigation, or legal claim may require restricted retention of particular records. We explain the categories, reason, and applicable period in our response and delete the retained data when that basis ends.
Support correspondence and technical records are also subject to purpose limits and valid deletion requests. Our provider-side requests cover data still attributable to you where the service offers the relevant deletion mechanism. See Firebase’s published retention information for its service-specific processing.
Your rights and choices
Subject to applicable law, you may ask to be informed about processing; access your personal data; correct inaccurate information; object to or restrict processing; withdraw consent; receive a portable copy where applicable; or have data erased where the right applies. You may also complain to the relevant data-protection authority.
Send requests to hello@tillsync.co.ke or use the deletion page. Identify the account or business involved and the action you want. We may request proportionate verification so someone else cannot access or erase your records. Do not send passwords, PINs, or unnecessary identity documents.
If your request concerns a business’s independently controlled customer or employment records, we may coordinate with that business or direct you to the relevant owner. This does not remove our responsibility to address information for which we are responsible, or make the owner’s permission a blanket condition for closing your personal account.
In Kenya, you can contact the Office of the Data Protection Commissioner. Contacting us first can help resolve an issue, but is not a condition of your right to complain.
Deleting an account or specific data
You can request permanent account deletion and associated personal-data deletion at our public deletion page, even after uninstalling the app. You can also request deletion of specific personal data without automatically closing the whole account.
Deleting an account includes its sign-in identity, profile information, membership links, saved contact and photo information, and registered push tokens, with associated identifiers in other records deleted or irreversibly anonymised unless a disclosed lawful exception requires retention. Deactivation, removing a staff member from a team, and signing out are not substitutes for account deletion.
A staff member’s deletion does not automatically close the entire business or remove other people’s independent records. An owner’s request also requires us to address business records, Till devices, and other members’ access. We explain the consequences and resolve ownership safely without making an unnecessary business-transfer step a barrier to the person’s privacy rights.
We cannot erase a business’s already downloaded exports, records held independently by a recipient, messages in your SMS inbox, or M-Pesa’s own transaction records. Deleting TillSync data does not cancel or reverse an M-Pesa payment.
Security and international processing
We use authenticated access, business-scoped permissions, separate access controls for original receipt text, and encrypted connections to our cloud services. The service is not end-to-end encrypted: authorised service systems process records to provide the feed and other features. No service can guarantee absolute security.
Protect the Till phone and your account, keep devices updated, review team permissions, and avoid sharing sign-in credentials. If you believe an account or receipt has been exposed, contact hello@tillsync.co.ke promptly. We assess security incidents and make notifications required by applicable law.
Cloud, analytics, authentication, and email providers may process data outside Kenya, including in countries where their infrastructure or subprocessors operate. Where cross-border restrictions apply, we are responsible for using the legally required safeguards and agreements. Contact us for information about the providers and safeguards relevant to your data.
Children’s information
TillSync accounts are intended for business owners and authorised staff aged 18 or over. The service is not directed to children and should not be used to create an account for a child. Payment records can include information about customers, so businesses must also consider any special protections that apply to their customers.
If you believe a child has provided account information or that we are processing a child’s data unlawfully, contact hello@tillsync.co.ke. We will investigate and take the action required by applicable law.
Changes and contact
We update this policy when the service or our practices change and show the revised date above. For material changes, we provide additional notice where required. If a new use requires consent, publishing an updated policy alone does not provide that consent.
For privacy, security, access, correction, or deletion questions, contact TillSync at hello@tillsync.co.ke. You can also visit Contact support, review our security overview, or read the Terms of Service.