Privacy Policy

About DukaBook

DukaBook is a mobile application developed by Rezotech Ventures, based in Kenya. It helps duka (shop) owners track M-Pesa payments and reconcile them against sales records.

We can be reached at billy.dev254@gmail.com or through our website at dukabook.rezotech.co.ke.

What information DukaBook uses

We collect only what is necessary to provide the service:

• Shop name — the name of your business, entered during registration.
• Phone number — used to identify your account and send verification codes.
• M-Pesa till number — optional, used to filter your payment records.
• Transaction records — payments and sales you log are stored to power your reports and gap analysis.
• Device SMS messages — read locally on your phone to detect M-Pesa payments. See section below.

How we handle your M-Pesa messages

When you grant SMS permission, DukaBook reads messages from the MPESA sender in your inbox to automatically detect payments to your till number.

• SMS messages are read and parsed entirely on your device.
• The raw text of your SMS messages is never uploaded to our servers.
• Only the parsed payment details (amount, sender name, date) are sent to our server to create a transaction record.
• You can choose to skip SMS access and enter payments manually — the app works either way.
• You can revoke SMS permission at any time in Android Settings → Apps → DukaBook → Permissions.

Services we use

DukaBook integrates with the following third-party providers:

• Infobip — used to send OTP verification codes and daily summary SMS messages to your registered phone number. Infobip Privacy Policy.
• Google Play Billing / RevenueCat — used to process the optional Pro subscription payment. We do not store your payment card details. RevenueCat Privacy Policy.

We do not use advertising networks, analytics trackers, or sell your data to any third party.

How your data is stored

• Your account data is stored on servers hosted in cPanel-managed infrastructure.
• Passwords and PINs are hashed using bcrypt before storage — we cannot read them.
• All communication between the app and our server uses HTTPS.
• We retain your transaction records for as long as your account is active. Free plan records are kept for 30 days; Pro plan records for 90 days.

Control over your data

You have the right to:

• Access the transaction records stored in your account at any time through the app.
• Request deletion of your account and all associated data by contacting us.
• Revoke SMS permission from Android system settings without losing access to your account.

To request account deletion, send an email to billy.dev254@gmail.com with the subject line "Delete my DukaBook account" and include your registered phone number.

Age requirement

DukaBook is intended for business owners and is not directed at children under 13 years of age. We do not knowingly collect personal information from children. If you believe a child has created an account, please contact us and we will delete it.

Updates to this policy

We may update this Privacy Policy as the app evolves. When we make significant changes, we will update the "Last updated" date at the top of this page. Continued use of DukaBook after changes are posted constitutes acceptance of the updated policy.

Get in touch

Questions about this policy or your data? Reach us directly: