Last updated: 3 June 2026
Privacy Policy
This policy explains what data we collect, why we collect it, and how we protect it. We respect your privacy and comply with Rwanda’s Law N° 058/2021 on the protection of personal data.
1. Who we are
Kisimenti is an all-in-one online business management platform that helps businesses build websites, manage inventory, track sales, and run their operations. For the purposes of data protection, Kisimenti is the data controller.
Contact: [email protected]
2. What data we collect and why
When you join the waitlist
| Data | Why we collect it | Legal basis |
|---|---|---|
| Full name and email | To contact you about your application | Your consent |
| Business type, team size, daily sales range | To understand your needs and prepare your dashboard | Our legitimate interest in delivering a relevant service |
| Device preference, feature interests | To tailor your setup | Our legitimate interest |
| How you heard about us | To understand which channels work | Our legitimate interest |
When you use the platform
| Data | Why we collect it | Legal basis |
|---|---|---|
| Business data (products, orders, customers) | To provide the service you signed up for | Necessary to perform our contract with you |
| Login credentials | To secure your account | Necessary to perform our contract |
| Page views, device type, browser | To improve the platform and fix issues | Our legitimate interest |
3. How we process your data
We use the following systems to run Kisimenti:
- Supabase (self-hosted) — our database and authentication system, hosted on our own servers.
- Cloudflare — protects and speeds up our website (CDN and DNS).
- SMTP relay — delivers transactional emails (confirmations, updates).
Kisimenti does not process payments on behalf of businesses. Merchants set up their own payment integrations (such as MTN MoMo, Airtel Money, or card processors) through the dashboard. We do not collect, hold, or have access to your customers’ payment details or funds.
4. Where your data is stored
Your data is processed on servers located outside Rwanda. We want to be transparent about why: Rwanda does not yet have large-scale commercial data centre infrastructure that meets the uptime, redundancy, and security standards required to run a platform like Kisimenti reliably. The cloud providers and hosting services we need (for databases, backups, email delivery, and content distribution) operate their facilities in Europe and other regions.
This is a practical reality for nearly all software companies operating in Rwanda today. We take the following steps to protect your data when it is processed abroad:
- We only use providers with strong security practices and data protection policies.
- Access to your data is restricted to authorised Kisimenti team members.
- All data is encrypted in transit (TLS) and at rest.
- By joining the waitlist or using the platform, you consent to this cross-border processing as described here.
5. How long we keep your data
- Active accounts: We keep your data for as long as your account is active.
- Waitlist data: Retained for up to 24 months. If you are not approved or do not activate an account within that period, we delete your data.
- After deletion: Once you request deletion or your retention period ends, your data is permanently removed within 30 days, unless we are legally required to keep it longer.
6. Your rights
Under Rwanda’s Law N° 058/2021, you have the right to:
- Access — ask us what data we hold about you.
- Correction — ask us to fix any data that is wrong.
- Deletion — ask us to delete your data.
- Restriction — ask us to stop processing your data in certain cases.
- Portability — receive a copy of your data in a common format.
- Objection — object to processing based on our legitimate interest.
To exercise any of these rights, email [email protected]. We will respond within 30 days.
7. Cookies
We only use essential cookies needed to keep you logged in and remember your preferences. We do not use third-party advertising or tracking cookies.
8. Children
Kisimenti is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children.
9. Changes to this policy
If we make significant changes to this policy, we will update the date at the top and notify you by email.
10. Contact
For any privacy questions or data requests, email [email protected].