Privacy Policy

This Privacy Policy explains what information Tiifu collects, how we use it, and the choices you have. Tiifu handles sensitive business and tax information, so we’ve designed our systems to collect only what’s needed and to protect it accordingly.

• Account information: your name, email address, and password.
• Business information: business name, KRA PIN, business type, sector, and estimated turnover.
• Financial & tax data: transaction records, eTIMS invoices, and filing drafts you create or upload, including any KRA notices you upload for explanation.
• Payment information: subscription and billing status. Card and M-Pesa payment details are handled directly by our payment processor, Pretium — we do not store your payment credentials.
• Usage data: how you interact with Tiifu, for reliability and product improvement.

We use your information to:

• Detect the tax obligations that apply to your business and compute your compliance risk score.
• Draft filings, generate eTIMS invoices, and match transactions against them.
• Send you deadline reminders and account notifications.
• Process subscription payments and manage your plan.
• Maintain the security and integrity of the service, including the audit log.

We do not sell your information. We share it only with:

• Supabase, our database, authentication, and storage provider — they process data on our behalf and don’t use it for their own purposes.
• Pretium, our payment processor, which receives only what’s strictly necessary to process an M-Pesa payment.
• KRA, only when you explicitly submit a filing through Tiifu.
• Authorities, if required by law.

• Every table containing financial or personal data is scoped with row-level security to the authenticated business owner — no business can read another business’s data.
• Your KRA PIN and any bank details are treated as sensitive fields: never logged, and never sent to a third party beyond what Pretium strictly requires to process a payment.
• The audit log is append-only, enforced at the database level, so filing and account history can’t be altered retroactively — including by us.
• Data is encrypted in transit and at rest.

We retain your information for as long as your account is active, and afterward only as long as needed to meet our legal and tax record-keeping obligations. You can request deletion of your account at any time; some records may be retained longer where required by Kenyan law.

You can access, correct, or request deletion of your personal information at any time by contacting us. You can also export your filing history and documents directly from the Documents & Audit Pack screen.

We use essential cookies and local storage to keep you signed in and to remember preferences like your theme (light/dark). We don’t use third-party advertising trackers.

Tiifu is intended for business use and is not directed at children. We don’t knowingly collect information from anyone under 18.

We’ll notify you of material changes to this policy before they take effect. The “Last updated” date above reflects the most recent revision.

Questions about this policy or your data? Reach us at privacy@tiifu.co.ke.