1. Who is responsible
Regio is operated by Edgar Jerry, an individual. Support and privacy contact: edgarjerry0@gmail.com.
We act as controller for account administration, service security, our billing records and direct support. For personal data uploaded about a business’s employees, customers or suppliers, that business will generally be the controller and Regio its processor. Actual activities determine the roles; accountants must hold appropriate client authority.
This notice addresses Kenya’s Data Protection Act, 2019. It does not certify completion of operational or registration assessments.
2. Information we handle
- Account: name, email, password hash, verification status, memberships and permissions. Optional Google sign-in provides authentication identity information.
- Business records: business details, KRA PINs, relevant identifiers, invoices, returns, payroll and employee information for features you use.
- Transactions: uploaded M-Pesa statements, parsed records, reconciliation results, payment references and payment phone numbers where needed.
- Support and security: your requests, IP addresses, browser/device details, authentication events, audit records and diagnostic error/performance information.
Sources include you, authorised business users and accountants, and authentication or payment providers for selected features. Do not upload unrelated information. We do not need your M-Pesa PIN or one-time codes.
3. Purposes and lawful grounds
- Contract: providing account access, requested record processing and support. For customer-controlled records, we follow lawful instructions; the customer must establish its lawful basis.
- Legitimate interests: proportionate fraud prevention, access security and fault investigation, balanced against affected people’s rights.
- Legal obligations: required evidence retention, lawful authority requests and data protection duties.
- Consent: optional activities requiring consent must be presented separately. Withdrawal affects future processing, not earlier lawful activity.
Without essential account information we may be unable to provide access. Optional features need their corresponding records. Verification and deadline reminders are service communications, distinct from promotional messages.
Supported KRA-facing features depend on authorisation and integration status; not every obligation supports automatic filing. Production KRA filing and eTIMS submission are not currently available.
4. Sharing and international processing
We do not sell personal data. Relevant records are shared with business users and accountants you authorise, necessary service providers and authorities where legally required.
Our service inventory includes Vercel (hosting), Supabase/PostgreSQL (database), Upstash (Redis and background delivery), Resend (transactional email) and Sentry (diagnostics). Cloudflare Turnstile may process abuse signals on authentication forms when enabled. Google handles authentication if selected. M-Pesa payments involve the payment provider; KRA receives records only for an available, authorised feature or lawful requirement.
Roles depend on the activity. Actual processing locations, onward providers, contractual protections and cross-border safeguards still need account-specific confirmation. We do not claim all processing stays in Kenya or that transfer assessment is complete. Ask for current details before supplying records requiring particular locations or safeguards.
See the Data Processing Agreement for business-customer terms and acceptance requirements.
5. Cookies and similar technologies
Essential authentication/session cookies and security tokens maintain sign-in and protect authentication requests. A short-lived plan-selection cookie may carry a chosen plan through signup; it is not payment approval. Browser storage may remember interface preferences such as sidebar state.
If you start basic setup before verifying your email, an optional business-type answer can be saved on this browser, scoped to the email you entered. It is ignored after 24 hours and removed when next accessed after expiry; you can clear it from the setup screen. This draft does not contain passwords, KRA PINs or business records and does not grant account access.
Turnstile, when enabled, processes security signals to help prevent abuse. Sentry, when configured, receives error and performance diagnostics with an application redaction filter. Replay sampling settings alone do not mean a session-replay integration is installed.
We have not identified advertising or marketing analytics trackers in the current application. Any future optional tracking requires an updated notice and applicable consent controls before activation. Blocking essential cookies may prevent sign-in. Providers explain their own processing in the Cloudflare, Sentry and Google privacy notices.
6. Retention and closure
Raw statement content is cleared after successful parsing; leftover raw content is eligible for cleanup after 30 days. This cleanup does not delete parsed transaction records, tax records, payroll records, or audit records, and does not guarantee that cleanup has run on a particular day.
Other records have no comprehensive age-based automatic deletion policy at present. Account information, parsed business records and general audit records are included in that limitation. Purpose-specific authentication tokens expire separately. Provider backup retention still needs confirmation.
Account closure and deletion requests are reviewed against record-keeping duties, other people’s rights, unresolved payments and legal holds. Subscription cancellation does not delete records. We cannot promise universal immediate erasure or deletion from every backup. Ask what remains and why; these limitations do not remove statutory rights.
Keep original records and copies before access ends. A category-specific retention schedule and provider backup procedure still need to be established; publishing this notice does not implement those controls.
7. Security
Measures include authentication, role and business access controls, encryption for sensitive stored fields, and logging of relevant activity. Absolute security cannot be guaranteed. Use a unique password, protect your email and report suspected unauthorised access. We assess incidents and make notifications required by applicable law.
8. Your rights and complaints
Subject to applicable conditions, you may request information about data use, access, correction, erasure, restriction, objection or portability, and withdraw consent. Relevant safeguards also apply to solely automated decisions with legal or similarly significant effects. Review calculated results before relying on them.
Privacy contact: use the email below and identify your request. We may seek proportionate identity verification. We will respond within statutory time limits, explain lawful restrictions or extensions, and route customer-controlled record requests to the appropriate controller.
You can complain directly to Kenya’s Office of the Data Protection Commissioner without completing our support process first. Read its explanation of data subject rights.
9. Children and changes
Regio is intended for adults managing business records. Do not create accounts for children or upload children’s data without an appropriate lawful basis and safeguards. Contact us about any inappropriate collection.
Revisions carry an updated date; material changes will be communicated through the service or account email. A revised notice does not itself authorise incompatible new data uses.
Contact
Regio is operated by Edgar Jerry, an individual. Support and privacy contact: edgarjerry0@gmail.com.
Do not send passwords, one-time codes or full identity documents in an initial email. We may ask for proportionate verification before discussing an account or acting on a data request.