Zamvi Technologies

Privacy Policy

Last updated: 9 October 2026

This Privacy Policy explains how Zamvi Technologies ("Zamvi", "we", "us" or "our") handles personal information when you use Rekodi, our WhatsApp-based business recordkeeping and customer catalogue service (the "Service"). Rekodi is a product of Zamvi Technologies. This policy applies to business owners using Rekodi and to people who interact with a Rekodi business through WhatsApp.

1. Our role and business customer data

When a business uses Rekodi to keep records about its customers, transactions, debts, orders, or payments, that business decides why those records are kept and is generally responsible for having a lawful basis to provide them to us. The business acts as the controller of those customer records; Zamvi processes them to provide the Service and follows the business's instructions, subject to our legal obligations. Zamvi separately handles account, service operation, security, and billing information for its own purposes.

2. Information we handle

• Business account and onboarding information: phone number, business name, business category, optional till/payment details, account status, and a protected PIN hash used by some business flows.
• Records a business enters: sales, expenses, descriptions, customer names and optional phone numbers, balances, M-Pesa transaction information, and product names, prices, stock, descriptions, and photos.
• Shopping and orders: WhatsApp phone numbers, business connections, catalogue browsing and cart/order details, order status, and customer payment claims.
• Messages and media: messages sent to the Rekodi WhatsApp number, image captions and image references, and photos that businesses choose to upload. Inbound messages may be processed to carry out the requested action and to send a reply.
• Consent and reminder records: opt-in choices, withdrawal or denial records, the source and time of a choice, and reminder delivery attempts. A customer can reply STOP to withdraw consent to Rekodi debt reminders.
• Credit and export information: business sales and expense summaries, activity measures, outstanding balances, and records of export requests. Credit exports are gated by the business's explicit credit-sharing consent and are logged.
• Billing and technical information: subscription tier, payment references and status, webhook/message identifiers, timestamps, and operational error or security logs. Rekodi does not ask merchants for an email address; a synthetic email value may be used only to initialize a Paystack transaction where Paystack requires one.

3. How we use information

We use information to:

• create and operate business accounts and provide WhatsApp support;
• record and retrieve ledger entries, balances, M-Pesa transactions, products, carts, and orders;
• send requested replies, product images, account notifications, digests, and consented debt reminders;
• calculate business summaries and, where explicitly authorized, generate a credit-readiness export;
• process and verify subscription payments and administer trials and paid access;
• protect the Service, prevent abuse, troubleshoot failures, and maintain audit records; and
• meet legal, regulatory, accounting, and legitimate recordkeeping obligations.

4. AI-assisted message interpretation

When the ordinary command parser cannot interpret a short business message, Rekodi may send that message to Anthropic's Claude AI service to classify its intent or extract proposed transaction details. The AI does not directly write to the ledger: Rekodi validates its response and applies the same command and business rules used for other inputs. Do not send passwords, PINs, payment credentials, or information that is not needed for your request.

5. Who receives information

We share only what is needed to operate the Service, as directed by a business, or as required by law. Service providers may include:

• Nexus WhatsApp Gateway and Meta/WhatsApp: to deliver and receive WhatsApp messages, templates, and media.
• Cloud database, application hosting, and job delivery providers: to store records, run the application, and reliably process queued tasks.
• Anthropic: for the limited AI-assisted message interpretation described above.
• Paystack: to initialize and verify payments when a business chooses to purchase a subscription.
• Safaricom Daraja: where a business has enabled Rekodi's M-Pesa payment reconciliation features.

A business may also disclose its own records to a person or organization it chooses. Rekodi's credit export requires recorded consent, and export activity is audited. We do not sell personal information or use it to build advertising profiles.

6. Cross-border processing

Our infrastructure and providers may process or store information outside Kenya. Where this occurs, we take steps appropriate to the applicable data-protection requirements and the nature of the information. Provider locations and safeguards can change as the Service evolves.

7. Retention and security

We keep information for as long as needed to provide the Service, preserve business records, administer consent and billing, resolve disputes, maintain security, and meet legal obligations. Retention periods depend on the type of record and the business's use of Rekodi. When information is no longer needed, we will delete it or remove identifying details where reasonably practicable, subject to backups and lawful retention requirements.

We use safeguards such as access controls, protected credentials, signed webhooks, encrypted transport, and audit logs. No online service or transmission is completely secure; businesses should protect their WhatsApp accounts and PINs and only submit information they are authorized to share.

8. Your choices and rights

Depending on applicable law, you may have the right to request access to, correction of, deletion of, or restriction of processing of your personal information, to object to certain processing, or to withdraw consent. Withdrawal does not undo processing that was lawful before withdrawal. Customers can reply STOP to end Rekodi debt reminders; this does not affect messages they initiate or other messages necessary to respond to their requests.

If you are a customer whose information was entered by a business, contact that business first about its records. You may also contact us using the support details below. We may need to verify your identity and may retain information where the law permits or requires it.

9. Children

Rekodi is a business service and is not designed for children. Do not knowingly submit children's personal information unless you have authority and a lawful basis to do so.

10. Changes and contact

We may update this policy as the Service or applicable law changes. The latest version will be published on this page with its updated date. For privacy questions or requests, contact Zamvi Technologies using the current support details below.