Privacy Policy

FundiFlow is a product of Advent Nurutech, a technology company registered in Kenya. We build smart, affordable software tools for small and medium-sized businesses in the tailoring and fashion industry.

Contact: adventnurutech@gmail.com  |  0142 225 233  |  adventnurutech.xyz

We collect information in the following ways:

a) Information you provide to us:

• Account registration details: name, email address, phone number, business name, location
• Customer records you create: customer names, contact details, body measurements, photos and order notes
• Employee records: staff names, roles, contact details, pay rates and schedules
• Financial data: income records, expenses, withdrawals, savings goals and investments you enter
• Order and production data: garment details, fabric selections, fitting notes and delivery records
• Inventory records: materials, stock levels, purchase orders and supplier information
• Profile information: profile photo, biography and preferences

b) Information collected automatically:

• Device information: device type, operating system, browser type
• Usage data: pages visited, features used, session duration and interaction logs
• IP address and approximate location (city/country level)
• Cookies and local storage data (see our Cookie Policy)
• Error logs and crash reports to help us fix bugs

c) Information from third parties:

• If you sign in via Google, we receive your Google account email, name and profile photo
• Payment confirmation data from M-Pesa (we do not store your M-Pesa PIN or full account details)

We use your information to:

• Provide, operate and improve the FundiFlow platform
• Create and manage your business account and workspace
• Process customer orders, track inventory and generate reports within your account
• Send SMS and WhatsApp notifications to your customers on your behalf
• Generate AI-powered business insights based on your business data
• Send you essential service communications (account alerts, security notices, payment confirmations)
• Respond to your support requests and enquiries
• Detect and prevent fraud, abuse or security threats
• Comply with legal obligations under Kenyan law
• Improve platform performance through anonymised analytics

We do not use your business or customer data for advertising purposes.Your customers' data belongs to you and is only used to deliver the services you have explicitly configured.

Your data is yours. As a FundiFlow subscriber, you own all the business data you create — customer records, orders, financial records and inventory. Advent Nurutech acts as a data processor on your behalf.

Under Kenyan data protection law and as a matter of principle, you have the right to:

• Access — request a copy of all personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Deletion — request deletion of your account and associated data
• Portability — export your business data in a standard format
• Objection — object to certain uses of your data
• Restriction — request that we limit how we process your data

To exercise any of these rights, contact us at adventnurutech@gmail.com. We will respond within 14 business days.

We do not sell your personal data. We only share data in the following limited circumstances:

• Service providers:We use Supabase (database), Cloudinary (image storage), Africa's Talking (SMS), and Google (authentication). These providers process data only as instructed by us and are bound by data processing agreements.
• Within your workspace: Data you create is shared with the team members in your workspace according to the role-based access controls you configure.
• Legal requirements: We may disclose data if required by Kenyan law, court order or government authority.
• Business transfer: If Advent Nurutech is acquired or merged, your data may be transferred to the new entity under the same privacy protections.

We implement the following security measures to protect your data:

• All data is encrypted in transit using TLS/HTTPS
• Data at rest is encrypted using AES-256 encryption
• Database access uses row-level security — your data is isolated from other businesses
• Passwords are hashed using industry-standard bcrypt
• Access to production systems is restricted to authorised personnel only
• Regular security reviews and penetration testing

Despite our best efforts, no system is 100% secure. If you discover a security vulnerability, please report it immediately to adventnurutech@gmail.com.

We retain your data for as long as your account is active. When you close your account:

• We will delete your data within 30 days of account closure upon request
• Anonymised, aggregated analytics data may be retained indefinitely
• Financial transaction logs may be retained for up to 7 years to comply with Kenyan tax and financial regulations
• Backup copies may persist for up to 90 days before being permanently deleted

We use cookies and browser local storage to keep you logged in and remember your preferences. See our full Cookie Policy for details.

FundiFlow is designed for business use by adults aged 18 and over. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal information, contact us at adventnurutech@gmail.com and we will delete it promptly.

Your data is primarily stored and processed in servers located within Africa (Supabase regional infrastructure). Some data may be processed by our service providers in other regions. When this occurs, we ensure appropriate safeguards are in place.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and display a notice within the FundiFlow platform at least 14 days before the changes take effect. Your continued use of FundiFlow after the effective date constitutes acceptance of the updated policy.

If you have any questions, concerns or requests regarding this Privacy Policy or your personal data, please contact us: