This policy covers Sawia's website, app, account messages and support. It explains what we collect, why we use it, who we share it with and the choices available to you.
1. Who we are
Sawia is operated by Glossynet Ltd, a company registered in Kenya. For the personal data described in this policy, Glossynet Ltd is the data controller unless another notice says otherwise.
This policy applies to sawia.app, the Sawia application and messages you exchange with us. It does not govern a bank, mobile money provider, fund manager or other third party, even where you use information from that institution in Sawia.
2. Information we collect
Details you provide
This includes your name, email address, profile photo, preferences, workspace memberships and roles. It also includes information you send through forms, messages or support requests.
Financial information you choose to add
Account and provider details, balances, transactions, income, spending, assets, investments, returns, fees, taxes, goals, debts, plans, forecasts, exchange-rate references and related notes. Kenyan law may treat property and financial details as sensitive personal data, so we apply additional care to them.
Files and imported information
This includes files you choose to use with Sawia and the records you save from them. We may also receive information from a service you ask Sawia to connect to in the future.
Usage, device and security information
Session identifiers, browser and device information, IP address, security events and diagnostic logs help us operate and protect Sawia. Unless you switch site analytics off, we also collect aggregate information about visits, pages, actions and campaign sources.
Information about other people
Shared workspaces and financial records may include another person's name or account reference. Only add information you are entitled to use, and avoid unnecessary personal details.
We do not ask for your bank PIN, mobile-money PIN or one-time verification code. Do not put these secrets in Sawia or send them to support.
3. How and why we use information
Create your account and workspaces, store the records you add, calculate views and forecasts, support imports and exports, and respond to your requests.
Confirm identity, prevent abuse, investigate problems, maintain backups and keep accounts and the service secure.
Understand how the website and product are working, fix problems and decide what to improve.
Send account, security and service messages, and send optional product news only where you have asked for it.
Respond to valid legal process, exercise or defend legal rights and meet Kenyan regulatory duties.
Depending on the activity, we rely on performance of our agreement with you, your specific consent, compliance with law, or a legitimate interest that is not overridden by your rights. Where sensitive property or financial information requires consent, Sawia will ask for express consent and allow it to be withdrawn, subject to lawful retention requirements.
We do not sell or rent personal data. We do not use personal financial information to target third-party advertising or make solely automated decisions that produce legal or similarly significant effects about you.
4. Files and imports
When you import a supported statement, Sawia lets you review the result before saving records to your workspace. The current import tools do not keep the original statement or its PDF password.
If an import or connected service needs to upload or retain a source file, we will explain that before it is processed.
6. Storage, international transfers and retention
Sawia data may be processed in Kenya or in another country where an approved service provider operates. Before personal data is transferred outside Kenya, Glossynet Ltd will use an applicable lawful transfer basis and appropriate safeguards. Sensitive personal data will not be transferred outside Kenya without the consent and safeguards required by law.
Account and workspace records are generally kept while your account is active and as needed to provide Sawia. Support records, security logs and backups are retained for limited operational periods. Some information may be kept longer where required by law, needed to resolve a dispute or necessary to protect the service. When information is no longer needed, we delete, anonymise or securely isolate it according to our retention schedule.
7. Security
We use organisational and technical safeguards designed for the sensitivity of Sawia records. These include access controls, secure sign-in, protected connections, file checks, backups and recovery procedures. Keep your sign-in details private and contact us promptly if you suspect unauthorised use.
If a personal-data breach creates a real risk of harm, Glossynet Ltd will notify the Office of the Data Protection Commissioner and affected people as required by Kenyan law.
9. Your rights
Subject to Kenyan law, you may ask us to:
- explain how your personal data is being used;
- give you access to a copy of your personal data;
- correct false, incomplete or misleading data;
- object to or restrict particular processing;
- erase personal data where there is no lawful reason to keep it;
- provide portable data in a structured, commonly used format; and
- withdraw consent without affecting processing already lawfully completed.
Sawia already provides a workspace export for many financial records. For another request, email support@sawia.app. We may verify your identity and authority before acting. We will respond within the period required by law and explain any lawful limitation.
You may also lodge a complaint with Kenya's Office of the Data Protection Commissioner. We would appreciate the opportunity to address your concern first.
10. Children
Sawia is intended for adults aged 18 and over. We do not knowingly create accounts for children. Contact us if you believe a child's personal data has been provided to Sawia without appropriate authority.
11. Changes to this policy
We may update this policy as Sawia develops or the law changes. The effective date will be revised, and material changes will be brought to users' attention before they take effect where required. Earlier versions will be retained for accountability.