Privacy policy

Who we are

TillPad is a product of Nexally Technologies, a company in Zimbabwe. Nexally Technologies is the data controller for your personal information, as defined in the Cyber and Data Protection Act [Chapter 12:07].

Contact us about privacy at support@nexallytechnologies.co.zw or on WhatsApp at +263 716 697 712. Put "Privacy" in your message so it reaches the right person.

The short version

• Your sales, stock, customers and money records belong to you. We store them so you can back up and restore your shop. We do not sell them, rent them or use them for advertising.
• The app has no ads, no advertising trackers and no analytics SDKs.
• The app only asks for Bluetooth, and only to connect to your receipt printer. It does not use your location, contacts, camera or microphone.
• You can download your records or delete your account at any time.

Information you give us

When you create an account or update your settings:

• Account details: your name, mobile number, optional email address and password. We store passwords only as a secure one-way hash, so nobody at Nexally Technologies can read them.
• Shop details: shop name, type of shop, address, tax number and receipt footer, if you enter them. These are printed on your receipts and invoices.
• Business records: products, prices, stock movements, sales, receipts, quotes, invoices, returns, suppliers, purchase orders, expenses, debts, cash book entries and customers.
• Payment details: the invoice, amount, payment method, the mobile number you paid from, the transaction ID, and the proof of payment screenshot or PDF you upload.
• Messages: what you send to support on the website, by email or on WhatsApp.

Information about other people that you record

TillPad lets you save the names and phone numbers of your customers and suppliers, and what they owe or are owed. For this information you are the controller and we process it on your behalf, only to provide TillPad to you.

You are responsible for having a lawful reason to record these people, for keeping their details accurate, and for answering their requests. We never contact your customers or suppliers, and we never sell or share their details.

Information collected automatically

• Device information: the name and type of each phone signed in to your shop, the app version, and when it last synced. This lets you see and sign out phones, and enforces the 2-phone limit.
• Licence checks: the app keeps a signed licence on the phone and checks it offline. It contacts our server only to sync, sign in, refresh the licence or check your account.
• Server logs: IP address, time, page or address requested, and error details. We use these to keep the service secure and fix problems, and delete routine logs within 90 days.
• Cookies: the website only uses cookies needed to keep you signed in and to protect forms against misuse. We do not use advertising or analytics cookies.

How we use your information

We use your information only to:

• Create and run your account, sign you in and keep your phones in sync (to perform our contract with you).
• Back up your records and restore them on a new phone (contract).
• Check and activate payments, issue invoices and keep accounting records (contract and legal obligation).
• Send messages about your account: renewal reminders, payment confirmations, password resets and important changes to the service (contract). We do not send marketing unless you ask us to.
• Answer your support requests (contract and legitimate interest).
• Protect TillPad and our users: preventing fraud, abuse and unauthorised access (legitimate interest and legal obligation).
• Improve TillPad, using only totals and error reports, not the content of your business records (legitimate interest).

Who we share it with

We share personal information only with:

• Service providers who run parts of TillPad for us: our server hosting provider, our email delivery provider and, if you pay automatically by mobile money, our payment partner ContiPay and the mobile money operator you choose (EcoCash, InnBucks or Omari). They may only use it to provide their service to us.
• WhatsApp (Meta), when you choose to contact us on WhatsApp. Their own privacy policy applies to those messages.
• Authorities, when the law requires it, or to protect the rights, property or safety of Nexally Technologies, our users or the public.
• A buyer or successor, if Nexally Technologies or TillPad is sold or merged. This policy will continue to protect your information.

We never sell your personal information or your business records.

Where your information is stored

Your records are stored on your phone and on our servers. Our servers or providers may be outside Zimbabwe. When information is transferred outside Zimbabwe, we use providers that protect it to a standard at least as high as Zimbabwean law requires.

How we protect it

• All traffic between the app, the website and our servers is encrypted (HTTPS/TLS).
• Passwords are hashed. Phone sign-ins use tokens that you can revoke from your account.
• Each shop can only reach its own records. Proofs of payment are kept in private storage that is never publicly reachable.
• Staff access is limited to the people who need it, uses a separate sign-in and is logged.
• Optional PIN lock on the app, and you choose which phones can use your shop.

No system is perfectly secure. If a breach affects your personal information, we will tell you and the Data Protection Authority as the law requires.

How long we keep it

• Account and business records: for as long as your account exists. If your subscription ends, we keep your records so you can renew without losing anything.
• Inactive accounts: if an account has had no active subscription and no sign-in for 24 months, we may delete it after warning you 30 days in advance.
• Backup copies: daily copies of each shop are kept for 30 days and then deleted.
• Payment records: invoice numbers, amounts and dates are kept for 6 years because tax law requires us to keep our own accounting records. Personal details are removed from them when you delete your account.
• Support messages: up to 2 years after the conversation ends.

Your rights and choices

Under the Cyber and Data Protection Act you can:

• Access your information and get a copy. Sign in at tillpad.co.zw and use "Download my data" in Settings.
• Correct it. Edit your details in the app or in your account settings.
• Delete your account and records. Use "Delete account" in the app (Settings) or on the website. See tillpad.co.zw/delete-account.
• Object to or restrict some uses, or withdraw consent you gave.
• Complain to the Data Protection Authority (POTRAZ) if you think we have handled your information wrongly. We would like the chance to fix it first, so please contact us.

We answer requests within 30 days and may ask you to confirm your identity first, for example by a message from the number on the account.

Children

TillPad is a business tool for people aged 18 and over. We do not knowingly collect information from children. If you believe a child has created an account, contact us and we will delete it.

Changes to this policy

We will update this policy when TillPad or the law changes. The date at the top shows the latest version. If a change matters, we will tell you in the app, by email or SMS, or on the website before it takes effect.

Contact

Questions or requests: Nexally Technologies, by email at support@nexallytechnologies.co.zw or on WhatsApp at +263 716 697 712.