Privacy Notice

Steadline is accounting, inventory and CRM software for Kenyan businesses, built and operated in Nairobi by Mutual Labs, founded by Peter Ndiku. For the personal data you enter into the service, your business is the data controller and we are the data processor. For your account and billing relationship with us, we are the controller.

Questions or requests: email peter1000mutua@gmail.com or WhatsApp +254 704 964 737.

• Account details: your name, business name, email address, phone number and password.
• Business records you enter: customers, suppliers, products, orders, purchases, payments, expenses and ledger entries.
• Service data: sign-in times, device and browser type, and actions taken, kept as an audit trail.
• Payment data for subscriptions. Card and M-Pesa details are handled by the payment providers; we do not store full card numbers.

• To provide the service and keep your books (performance of our contract).
• To verify your email, secure your account and prevent fraud (contract and legitimate interest).
• To meet tax, accounting and other legal duties, including the statutory retention of financial records (legal obligation).
• To send service and, with your consent, product messages. You can withdraw consent at any time.

We do not sell personal data. We share it only with processors that help us run the service, including cloud hosting, email delivery, and M-Pesa and card payment providers, and with authorities where the law requires it. Processors act on our instructions under written terms.

Your active business records are kept for as long as your account is open. When an account is closed, personal identifiers can be erased on request, but financial and tax records are retained for the statutory period (currently seven years) in an anonymised form, because the law requires it.

Each business is isolated from every other one, secrets are encrypted, access follows staff roles, passwords are hashed, and the database is backed up daily. No system is perfectly secure, but we apply these controls and review them.

Under the Data Protection Act, 2019 you may ask for a copy of your personal data, ask us to correct it, ask us to erase it, or object to certain processing. Admins can export a data subject file or request erasure from the customer and supplier pages. We respond within the time the law allows. If you are not satisfied, you may complain to the Office of the Data Protection Commissioner.

The service uses browser storage for your sign-in session and small preferences. These are required for the product to work and are not used for third-party advertising.

We may update this notice as the service changes. Material changes will be posted here with a new date.