Privacy policy
This privacy policy explains how Libre Technology Ltd (“we”, “us”, “our”) collects, uses, stores and shares personal data when you use the Libre Books mobile application and related websites. It is written to align with the Kenya Data Protection Act, 2019 (KDPA).
By creating an account or using Libre Books, you acknowledge the practices described here. This page is plain-language information; it is not legal advice.
1. Who we are
Libre Books is a mobile accounting app for Kenyan trading businesses (invoicing, expenses, inventory, payroll, bank reconciliation and an eTIMS compliance queue). eTIMS compliance in development.
Data controller: Libre Technology Ltd, Nairobi, Kenya. Registration No. PVT-2719YKA2.
Contact: support@librebooks.app · hello@librebooks.app
2. Data we collect
We collect data you provide and data generated when you use the app.
Account and profile
- Name, email address and (where you provide it) phone number
- Authentication credentials managed through our auth provider
- Organisation / business name and membership role
- Preferences such as language, currency, notifications and theme
Business and financial records you enter
- Customers, suppliers, products/items and inventory movements
- Invoices, bills, credit notes, expenses, payments and journal entries
- Payroll-related information you enter for staff (for example PAYE, NSSF and SHIF calculations and related records)
- Bank reconciliation data you connect or enter
- Records related to the eTIMS compliance queue (eTIMS compliance in development)
KRA PIN and related tax identifiers
When you choose to enter them, we store KRA PIN values to support Kenyan tax and billing features. Today that includes:
- Organisation KRA PIN in organisation settings (filings, compliance screens and eTIMS-related flows - eTIMS compliance in development)
- Contact (customer/supplier) KRA PIN for B2B eTIMS invoice submissions
- Employee KRA PIN on statutory payroll profiles used for PAYE and related calculations/exports
- Optional KRA PIN on a billing payment-method profile
We do not collect national ID numbers, biometric data, full payment card numbers or M-Pesa PINs for storage in Libre Books. Card payments for subscriptions are handled by Paystack.
Technical and usage data
- Device type, operating system and app version
- IP address and approximate region (as provided by our hosting and security layers)
- Product analytics events (screens and feature use) when analytics sharing is enabled
- Crash and diagnostic information needed to keep the service reliable
- Audit and security events (for example sign-in and account actions)
Paid subscriptions are processed by our payment provider (see below). We do not knowingly collect personal data from children under 18.
3. How we use data
- To provide and secure your account and organisation books (contractual necessity)
- To run accounting features you request, including payroll calculations and the eTIMS compliance queue (contractual necessity; eTIMS compliance in development)
- To process subscriptions and billing (contractual necessity)
- To send service, security and support messages (legitimate interest / contractual necessity)
- To improve the product using analytics you can control in Settings (legitimate interest / consent where required)
- To support tax and compliance features you use (including KRA PIN where you have entered it) (contractual necessity / legal obligation)
We do not sell your personal data. We do not use your books for third-party advertising.
4. Where data is hosted and who helps us
We use specialist processors under contract. Today these include:
- Supabase - authentication, database and related backend hosting for app data
- Paystack - subscription and payment processing
- PostHog - product analytics (subject to your analytics sharing preference in the app)
- Resend - transactional email (for example invites and account notices)
These providers may process data in jurisdictions outside Kenya. We use them only as needed to run Libre Books and expect appropriate safeguards under applicable law and our agreements with them.
5. Retention
We keep personal account data while your account is active. What happens on account deletion depends on your organisations:
- Your login and personal profile are anonymised and your auth account is removed as part of the deletion process.
- Organisations you solely own (no other active members): we scrub selected personal identifiers (including KRA PINs on contacts, employees and organisation settings), clear the eTIMS queue for that organisation, then hard-delete the organisation and its cascaded business records (including invoices, books and related rows). Those records are not kept in Libre Books after that deletion completes.
- Organisations with other active members: deletion is blocked until you transfer ownership if you are still the owner. After you leave, the organisation’s books (including any KRA PINs and invoices still stored for that team) remain for the remaining members.
- Aggregated product analytics that cannot reasonably identify you may be kept to improve the product.
See also Delete your account.
6. Security
We use industry-standard controls including encryption in transit (TLS), access controls, and row-level security so organisation data is only available to authorised members. No system is perfectly secure; you must keep your login details confidential and enable available security options (such as multi-factor authentication where offered).
7. Your rights (Kenya Data Protection Act 2019)
Subject to legal limits, you may request:
- Access to personal data we hold about you
- Correction of inaccurate or incomplete data
- Erasure (deletion), subject to tax and other legal retention duties
- Restriction of, or objection to, certain processing
- Data portability where applicable
- Withdrawal of consent where processing is based on consent (for example analytics sharing in Settings)
Email support@librebooks.app from your registered address to exercise these rights. We aim to respond within the timelines required under the KDPA. You may also complain to the Office of the Data Protection Commissioner at www.odpc.go.ke.
8. Cookies and this website
The Libre Books marketing website does not currently use tracking scripts or analytics cookies. The mobile app does not rely on browser cookies; it may use device-level identifiers for analytics and diagnostics as described above.
9. Changes
We may update this policy as the product or the law changes. Material updates will be notified in the app or by email where appropriate. The effective date above will change when a new version is published.
10. Contact
Libre Technology Ltd, Nairobi, Kenya · PVT-2719YKA2
support@librebooks.app · hello@librebooks.app