Privacy Policy

We collect what running your credit and your tabs needs, and nothing for advertising. We do not sell your data.

1. Who we are

TabFlow is operated by Bonaogeto Limited, a company registered in Kenya, and built with Angaze. Bonaogeto Limited decides what TabFlow collects and why, so it is responsible for your data under the Data Protection Act, 2019.

For anything about your data, write to hello@tabflowhq.com, or change it yourself in Settings.

2. What we collect

• Your account: name, email, phone, photo and member code, from you when you sign up or edit Settings, or from Google if you sign in with Google.
• Your counter photo: the photo a counter checks when you pay by name, whether you took it with the camera or chose it from your photos, when, how it was checked, and how often a counter was not sure it was you. We check it shows one real face, first on your phone and then on TabFlow’s own servers. We never build a face print or match faces automatically; a person at the counter compares the photo with you.
• How you sign in: your password and card PIN, stored only as scrambled one-way hashes that nobody can read, and when you signed in.
• Your credit: your balance at each counter, top-ups, spends, transfers, refunds and receipts.
• Payments: Paystack payment references and the last digits of a saved card; M-Pesa confirmation codes and amounts.
• Orders and tabs: what you ordered, when, at which counter, and bills and who paid them.
• Your employer or event: your company, team budget or event guest pass, from your employer or the organiser when they add you.
• Messages: the emails and SMS we send you, and support messages you write.
• Security records: wrong PIN and password tries, emailed codes (kept only as fingerprints), and when each session started.
• Approve with Face ID or fingerprint: the check happens on your phone. TabFlow gets only a yes from your phone, never your face or fingerprint, and keeps the phone's name and when it was last used.
• Device and visits: pages visited, browser type and rough performance timings, from our own visit log and Vercel Speed Insights.

3. Why we use it

Each use rests on one of the grounds in the Data Protection Act, 2019.

• Holding and moving your credit, taking payments, issuing receipts: the contract you accept when you sign up.
• Keeping your account safe (PINs, emailed codes, lockouts, ending old sessions): our legitimate interest, and the contract.
• Keeping financial records and answering tax or legal requests: legal obligation.
• Telling you about charges, top-ups and low balances by email or SMS: the contract. You can switch the optional ones off in Settings.
• Understanding which pages are slow or unused, to fix them: our legitimate interest.
• Anything else, such as offers from a venue: only with your consent, which you can withdraw at any time.

We do not use your data to decide anything about you automatically.

4. Who we share it with

We share only what each party needs to do its part.

• The counter or venue you spend at: your name, what you ordered, what you paid and your balance there, to serve you and settle up.
• The Yard and MLO Café & Kitchen, when you pay their tab with TabFlow: the amount, tip, receipt number and which tab it was for, to mark your tab paid and keep their books. Not your email, phone or other balances.
• Your employer or event organiser: what was spent from the budget they fund, and by whom.
• Who sees your counter photo: you, staff at the counters you use, your employer’s TabFlow admin, and TabFlow. Nobody else.
• Anthropic (Claude), only when we have it switched on: a new counter photo, for one extra check that it is a real person and not a drawing, screen or printout. Not your name or anything else, and Anthropic does not use it for training. The main face check runs on TabFlow’s own servers.
• Paystack and Safaricom (M-Pesa): what a payment needs, to take it.
• Resend (email) and Africa’s Talking (SMS): your email or phone and the message, to send it.
• Supabase and Vercel (hosting) and Pusher (live updates): what TabFlow stores and sends, to run it.
• Google, if you sign in with Google: only that you signed in.
• Authorities: what the law requires, when it requires it.

Each provider may use your data only to do this work for us.

5. Where it is kept and how we protect it

Your data is stored with Supabase in Mumbai, India, and served through Vercel, so it leaves Kenya. We use these providers because they protect data to the standard the Act requires. Write to us for the safeguards in place.

• Everything travels encrypted, and browsers are told never to use an unencrypted connection.
• Passwords and PINs are stored only as one-way hashes. Nobody at TabFlow can read them.
• Money never moves on a signed-in phone alone: paying a tab, settling a bill, approving a counter or asking for a refund needs your phone's Face ID or fingerprint, your PIN, your password or a code emailed to you.
• Changing your counter photo needs the same, we email you when it changes with a one-tap “Not you?”, and for 24 hours the counter also asks for your PIN or a code. Removing it deletes it straight away.
• Wrong tries lock the account for an hour. Changing your password signs out every other device, and Settings has “Sign out everywhere”.
• Staff see only what their role needs, and money actions are recorded with who did them.

If a breach puts your data at risk, we will tell you and the Data Protection Commissioner as the Act requires.

6. How long we keep it

• Emailed codes: 10 minutes, and once used they stop working.
• Password reset links: 1 hour.
• Wrong PIN and password tries, and limits on sending codes: 1 day.
• Your account and profile: while you use TabFlow. Ask us and we delete it.
• Credit, payments, receipts and bills: as long as Kenyan tax law requires business records to be kept. If you ask us to delete your account, they are kept without your name.

7. Your rights

You can ask us, at any time and for free:

• to be told what data we hold about you, and for a copy;
• to correct anything wrong (most of it you can fix yourself in Settings);
• to delete your data, except money records the law makes us keep, which lose your name;
• to stop an optional use, such as marketing messages;
• to move your data to another service in a common format;
• to object to any use based on our legitimate interest.

Write to hello@tabflowhq.com. We answer within 14 days, and may ask you to prove it is you, so nobody else can get your data. If you are not happy with our answer, you can complain to the Office of the Data Protection Commissioner.

8. Cookies, children and changes

Cookies. We use only the cookies TabFlow needs to work: one that keeps you signed in, and a short-lived one that ties an emailed code to the phone that asked for it. No advertising or tracking cookies.

Children. TabFlow is for adults. We do not knowingly hold data about anyone under 18.

Changes. If we change this policy in a way that matters, we will tell you by email before it takes effect. The date at the top is the latest version.