Privacy Policy

We collect information in three ways: information you give us directly, information collected automatically, and information received from payment providers.

Information you give us. Name, email address, phone number, company name, and any message content when you contact us, request a quote, sign up for a trial, or create an account.

Payment information. When you pay through M-Pesa or Pesapal, we receive a transaction reference, the phone number or account used, the amount, and a confirmation code. We do not store M-Pesa PINs, card numbers, or banking passwords. Card details entered on Pesapal's hosted payment page are handled by Pesapal directly and never pass through our servers.

Information collected automatically. IP address, browser type, device information, and pages visited, collected through standard server logs and, where enabled, analytics tools.

We use personal data to: deliver the service or product you requested, process and confirm payments, respond to enquiries and support requests, send transactional emails such as receipts and invoices, improve our website and services, and comply with legal and tax obligations.

We do not sell personal data to third parties.

We share data only where necessary to provide our services:

• Safaricom (M-Pesa) and Pesapal, to process payments.
• InvoiceNinja, our billing and invoicing system, to generate and send invoices.
• Our email delivery provider, to send transactional and account emails.
• Hosting and infrastructure providers, to run and secure our servers.
• Government or regulatory authorities, where required by law.

Each of these parties is only given the data needed to perform their function and is expected to protect it accordingly.

We keep personal and transaction data for as long as needed to provide our services, meet accounting and tax record requirements under Kenyan law, and resolve any disputes. When data is no longer needed for these purposes, we delete or anonymize it.

Under Kenya's Data Protection Act, 2019, and, where applicable, the EU General Data Protection Regulation, you have the right to:

• Ask what personal data we hold about you.
• Ask us to correct inaccurate data.
• Ask us to delete your data, subject to legal retention obligations.
• Object to or restrict certain uses of your data.
• Withdraw consent for marketing communications at any time.

To exercise any of these rights, contact us using the details at the bottom of this page.

We use a limited set of cookies needed to keep you logged in, remember your preferences, and understand how the site is used. You can control cookies through your browser settings; some parts of the site, such as the client dashboard, require essential cookies to function.

We work with clients and customers in many countries. Where personal data is transferred outside Kenya, such as to hosting providers or payment processors located elsewhere, we take reasonable steps to ensure it continues to receive an appropriate level of protection.

Our services are intended for businesses and individuals over the age of 18. We do not knowingly collect personal data from children.

We may update this policy from time to time. Material changes will be reflected by updating the date at the top of this page.

Questions about this policy or your data can be sent to sales@nebulasynth.com, or by phone on +254 723 805 105. NebulaSynth LTD is based in Mombasa, Kenya.