This page explains how Cloud Hub Limited handles personal data in SQWIRO, on sqwiro.com and in the SQWIRO mobile app, under the Data Protection Act, 2019 of Kenya.
Who is responsible
Cloud Hub Limited ("Cloud Hub", "we") runs SQWIRO. We are a company registered in Kenya, company number CPR/2015/199522, with our postal address at P.O. Box 2255 – 00200, Nairobi, Kenya.
Cloud Hub is the data controller for the personal data of people who visit sqwiro.com, create a SQWIRO account or use the SQWIRO app. We decide why and how that data is used.
SQWIRO is used by businesses and organisations. When a business or organisation stores its own customers', staff's, members' or students' data in SQWIRO, including the mail in its mailboxes, that business or organisation is the data controller and we are its data processor. We act on its instructions. If your data is held by a business or organisation that uses SQWIRO, ask that organisation first about how it uses your data. You can also write to us.
What we collect
When you create or use an account (web or app)
- Your name, phone number, email address and password.
- Your phone number is verified with a one-time code sent by SMS or WhatsApp.
- If you sign in with Google or Apple, we receive the name, email address, profile picture and identifier that Google or Apple gives us.
- Your company or organisation name, if you give it.
When you register with a business that needs to know who you are
- Your National ID number.
- Photos of the front and back of your ID card, where the business you are registering with asks for them.
- A profile photo, if you add one.
- If a business or organisation you deal with uses a fingerprint scanner in its SQWIRO app, your fingerprints, your date of birth, and the record they are kept on. Businesses use this for staff, casual workers, farmers and members. The fingerprints are kept in that business's workspace and on your SQWIRO identity record.
Files and recordings you choose to add
- Photos, documents, voice recordings and videos you upload or record in the app. The app asks your permission to use your camera, photo library and microphone, only when you use a feature that needs them. You can refuse or withdraw permission in your phone settings.
Your location, if you use farm registration features
- When you register a farmer or a farm block in the farm management features, the app asks for permission to use your phone's location while the app is open. It takes one reading at that moment: latitude, longitude and how accurate the reading is. We record it as the location of that farmer's farm or farm block.
- It is saved with that farmer's or farm block's record in the workspace of the business or organisation that runs the farm programme. It is not added to your own profile. The record also shows which user created it.
- We do not follow your location over time, and the app never reads your location in the background.
Your phone contacts, if you choose a recipient from them
- In wallet and send-money screens, when you tap "Choose from contacts" to pick who to pay, the app asks for permission to read your contacts. It reads the names and phone numbers on your phone to show you a list, so you can search it and pick one.
- The list stays on your phone. We do not upload, store or share your contacts.
- The number you pick fills the recipient field. It is then used for that payment and kept in the payment record as the recipient's number.
Passkeys
- If you add a passkey, your phone unlocks it with your fingerprint, your face or your PIN. That fingerprint or face data stays on your phone and is never sent to us.
About your phone and the app
- A device identifier that your phone's operating system provides, the device name, device type, operating system and app version.
- A random identifier we create when you install the app, and the push notification token that Apple or Google and our push provider give your phone, so we can send you notifications you have allowed.
- The times and IP addresses of your sign-ins and sign-outs, to keep your account secure and to show you your own account history.
- Technical error reports when the app fails: the error, app version, device type, the screen you were on, your user identifier and the random install identifier. We remove email addresses and sign-in tokens from these reports. They go to our own servers.
Payments
- For M-Pesa payments: your phone number, the recipient's phone number, the amount and the M-Pesa transaction reference.
- For card payments: the payment is made through Paystack. We receive the transaction reference, amount and status. We do not receive or store your card number.
- Invoices, payments and credits on your account.
What you create and send
- The records, messages, mail and documents you create in SQWIRO, and messages you send to our support team.
- If you use the AI features, what you type and the answers you receive.
On sqwiro.com
- sqwiro.com uses only the cookies and browser storage needed to run the site and keep you signed in. We do not use advertising or tracking cookies.
What we do not do
- We do not show advertising in SQWIRO.
- We do not sell personal data.
- We do not use advertising or analytics tracking tools in the app, and we do not follow you across other companies' apps or websites.
- We do not track where you are. Your location is read only once, when you register a farmer or farm block, and never in the background.
- We do not upload, store or share your phone contacts. They are read on your phone only to help you pick a recipient.
- We scan mail for spam and viruses by automated means. We do not read your mail for advertising.
Why we use it
- To provide SQWIRO to you, including your account, sign-in, the services of the businesses you use through SQWIRO, notifications, payments and support. This includes using your location to record where a farm is, and your contacts to help you choose who to pay. This is necessary to perform our contract with you.
- To keep SQWIRO secure and prevent fraud and misuse, including sign-in checks and error reports.
- To bill and to meet legal duties, such as tax and accounting records.
- With your consent, for anything optional, such as push notifications and AI features. You can withdraw consent at any time.
Who we share it with
We share personal data only with service providers that help us run SQWIRO, under written agreements, and with authorities where the law requires. They act on our instructions and may not use your data for their own purposes.
| Provider | What it does for us |
|---|---|
| netcup (Germany) | Hosts our servers and databases |
| Cloudflare | Protects and delivers our websites and apps, and stores uploaded files and backups |
| Safaricom (M-Pesa) | Processes M-Pesa payments |
| Paystack | Processes card payments |
| SMS and messaging providers, including Meta (WhatsApp) | Send one-time codes and service messages |
| Apple, Google and Expo | Deliver push notifications |
| Amazon Web Services (SES) | Sends system emails |
| AI model providers | Produce the answers when you use the AI features |
| Google and Apple | Sign-in, if you choose to sign in with them |
When you use SQWIRO through a business or organisation, that business or organisation can see the data in its own workspace.
Where data is kept
Our main servers and databases are in Germany (European Union). Some providers listed above, such as Cloudflare, Amazon Web Services, the AI model providers and the push services, process data in other countries, including the United States.
When personal data leaves Kenya, we do it only with the safeguards the Data Protection Act requires, such as written agreements with our providers. We transfer sensitive personal data out of Kenya only where the Act allows it.
Our hospital system, SQWIRO HMIS, is not yet available. It is being built to keep patient data on servers in Kenya, as the Data Protection (General) Regulations, 2021 and the Digital Health Act, 2023 require. We will publish how it handles health data before it is offered.
How long we keep it
| Data | How long |
|---|---|
| Account details | While your account is active, and for 12 months after you close it. Then we delete or anonymise them. |
| National ID number and ID card photos | While your account is active, and for up to 12 months after you close it or ask us to delete them. Then we delete them. |
| Files and recordings you upload | Until you delete them or close your account, and for up to 12 months afterwards. |
| Sign-in history and device records | For 12 months after the event, or until you close your account if sooner. |
| Error reports | Up to 90 days. |
| Invoices, payments (including the recipient's number) and tax records | For the period that tax and company law require. We apply 7 years. |
| Support messages | While we help you, and for 12 months afterwards. |
| Data you store in SQWIRO as a business or organisation, including farm locations | As you instruct us under our contract. When the contract ends, we return your data and then delete it. |
We keep data longer if the law requires it or if we need it to defend a legal claim. Deleted data may remain in backups until they expire on a rolling schedule. We do not use backup copies for any other purpose.
Security
We protect personal data with technical and organisational measures. Connections to SQWIRO are encrypted (HTTPS). Each business's data is kept in its own database. Our staff reach production systems only when needed to run or support the service. If a personal data breach puts your rights at risk, we will tell you and the Office of the Data Protection Commissioner as the law requires.
No system is perfectly secure. If you think your account has been misused, contact us at once.
Your rights
You may ask us to:
- show you the personal data we hold about you;
- correct it;
- delete it;
- stop using it, or restrict how we use it;
- give you a copy in a portable format.
You may also object to how we use your data, and withdraw consent you gave us.
Write to info@sqwiro.com with the subject "Data protection". We may ask you to prove who you are before we act. It is free. We reply within the times the Regulations set: 7 days to show you your data, 14 days to correct or delete it, and 30 days to give you a portable copy.
To delete your account and the personal data linked to it, write to info@sqwiro.com with the subject "Delete my account" from the email address or using the phone number on the account. We may keep what the law requires us to keep, as described above.
Children
SQWIRO is not designed for children. If a school or another organisation adds a child to its SQWIRO workspace, that organisation is responsible for having the authority of the child's parent or guardian, and for how the data is used. If you think a child has given us personal data without that authority, write to us and we will delete it.
Complaints
If we do not resolve your concern, you may complain to the Office of the Data Protection Commissioner (ODPC) of Kenya at odpc.go.ke.
Data Protection Officer
Our Data Protection Officer is Benard Kimondo Gaitho, Director.
Write to info@sqwiro.com with the subject "Data protection", or to Cloud Hub Limited, P.O. Box 2255 – 00200, Nairobi, Kenya. Telephone: +254 703 111 888.
Changes to this page
We will change this page when our practices change. The date at the top shows when it was last updated. If a change affects how we use your personal data in a way you would not expect, we will tell you before it takes effect.
