Privacy notice

SmartBuuks (“we”, “us”) provides accounting, invoicing, payroll and HR software for small businesses in Africa. For your SmartBuuks account and our website, we decide how your information is used - the law calls us the “data controller”.

For the records you keep in SmartBuuks about other people - your customers, vendors and employees - your business is in charge, and we process that information on your instructions (as a “data processor”). If one of your customers or employees asks us about their data, we’ll pass the request to you.

Our data protection lead can be reached at privacy@smartbuuks.app.

• Your account: your name, email, mobile number, password (stored scrambled, never readable), and sign-in and security details.
• Your business: business name, country, address, tax numbers, logo and settings.
• Your books: invoices, estimates, bills, receipts, transactions, categories, reports and notes you add.
• Your team: if you use Payroll, employee names, contact and payment details, pay, tax and pension numbers, and leave records.
• Connections: when you connect MoMo or a bank, the transactions and balances the provider shares with us. We never see your MoMo PIN or bank password.
• Payments for SmartBuuks: your plan and billing history. Card and wallet details are handled by our payment partners, not stored by us.
• Support: messages you send us by WhatsApp, email or in the app.
• How you use SmartBuuks: device and browser type, pages visited, errors and performance - so we can fix problems and make it faster on slow connections.

Copilot uses AI models accessed through OpenRouter (our AI sub-processor) to read receipts, suggest categories and answer your questions. We send only what is needed for each task, and we remove or mask details like phone numbers where we can.

Under our data-processing agreement, OpenRouter and the model providers it routes to may not use your data to train their models. Tax and payroll figures are worked out by our own rules, not by the AI. Copilot never moves money or files anything with the tax office.

We never sell your information. We share it only with:

• People you invite - your accountant, admin or payroll manager, with the access you choose.
• Your customers and staff - when you send them an invoice, statement or payslip.
• Service providers who help us run SmartBuuks, under written agreements that limit how they use it: cloud hosting; email (Resend); SMS (Africa’s Talking); WhatsApp messages (through Meta’s WhatsApp Business Platform and our messaging provider); payments and payouts (licensed providers such as Paystack, Flutterwave and MTN MoMo); bank data (open-banking providers such as Mono); AI (OpenRouter); error monitoring (Sentry); and product analytics (PostHog).
• Authorities - only when the law requires it, for example a valid court order. Where we’re allowed to, we’ll tell you first.
• A new owner - if SmartBuuks is ever sold or merged, under the same promises in this notice.

We don’t send your books to the tax office. You or your accountant decide what to file.

We aim to store your data in an African cloud region and keep backups in the same region. Some providers - for example, our AI and email providers - may process data in other countries. When that happens, we use the safeguards your country’s law requires, such as written contracts with data protection terms.

Where a law requires certain data to stay in the country (for example, in Rwanda), we will follow it before offering SmartBuuks there.

• Your books and payroll records: while your account is open, and afterwards for as long as tax and company law in your country requires (often 5 to 7 years).
• Your account details: until you close your account, then for a short period to handle questions, disputes or fraud.
• Support messages and usage data: no longer than we need them, usually up to 2 years.
• Before we delete your business, you can export everything.

Data is encrypted in transit and at rest. Each business’s records are kept apart from others. Team members only see what their role allows, every change is recorded in a history of changes, and sensitive actions can require a second check. If a breach puts your information at risk, we’ll tell you and the regulator as the law requires - in Nigeria and Kenya, the regulator within 72 hours.

Depending on where you live, you can ask us to:

• show you the information we hold about you, and give you a copy;
• correct anything that’s wrong;
• delete your information, where we don’t need to keep it by law;
• stop or limit some uses, including direct marketing;
• give your data to you, or to another service, in a common format;
• withdraw consent you gave us, at any time.

Email privacy@smartbuuks.app or contact support. We’ll reply within the time your law sets - usually within a month - and may ask you to confirm who you are first. Many of these things you can also do yourself in Business Settings.

We follow the data protection law of each country where we offer SmartBuuks. If you’re unhappy with how we’ve handled your information, please tell us first so we can put it right. You can also complain to your regulator.

SmartBuuks is for businesses. Account holders must be 18 or over. If you record details of a young employee, you’re responsible for having the right permission.

If we make an important change, we’ll tell you in the app or by email before it takes effect. The date at the top shows when this notice last changed.

Privacy questions: privacy@smartbuuks.app. Anything else: help@smartbuuks.app.