Privacy notice

Who we are

Chonjo is run by Chonjo. You can reach us by email junanaphil@gmail.com.

For a shop’s own account — the owner’s email, the plan, payments — we decide how the data is used, so we are its data controller. For the shop’s business records and its customers’ messages, the shop decides what it keeps and why, and we handle them on the shop’s behalf, as its data processor.

What we keep

About shop owners and staff

• The owner’s email address, and the name and WhatsApp number of the owner and each member of staff.
• The shop’s details: its name and what the owner types into the dashboard — prices, opening hours, location, payment details.
• Payments for plans: the M-Pesa number used, the amount, and Safaricom’s receipt number.
• A record of changes — what was done, when and by whom — in the shop’s activity log.

About a shop’s customers

• Messages sent to the shop’s WhatsApp number, the assistant’s replies, and the sender’s WhatsApp number (or, when WhatsApp hides it, a private id instead).
• What the shop records about them: their name and number, what they bought, what they owe and repay, and requests such as orders.

What we do not keep

• Passwords: there are none. Sign-in is by a one-time code sent to your email, or with Google.
• Your IP address: it is used for a few minutes to stop someone requesting codes over and over, and is not stored.
• Voice notes, photos and documents: the assistant does not open them.

Why we use it

• To answer the shop’s customers on its behalf, and pass orders and requests to the owner or staff.
• To keep the shop’s sales, deni and stock records, and send the reports and reminders the shop asks for.
• To sign people in, take payment for plans, and keep the service secure.

We do not sell personal data, show advertising, or use it for any other purpose.

Who else handles it

A few companies do part of the work for us. Each receives only what it needs:

• Groq — our AI provider. A customer’s message and the shop details the assistant needs are sent to Groq to write each reply. Groq states that it does not use what it is sent to train AI models.
• Google (Gemini) — our backup AI provider, used only when Groq cannot answer. On the service we use, Google may use what it is sent to improve its products.
• WhatsApp (Meta) — carries the messages between customers and the shop’s number.
• Neon — our database, and Amazon Web Services — where the service runs.
• Safaricom — M-Pesa payments for plans.
• Google — sign-in with Google, and the email that carries sign-in codes.

These providers are outside Kenya — in the European Union and the United States. Data travels to them encrypted, and each is bound by its own terms and data protection commitments.

How long we keep it

• Sign-in codes: deleted within a day.
• Our working copy of each incoming message: deleted seven days after it has been answered. The conversation itself stays with the shop’s records.
• A shop’s records and conversations: for as long as the shop has an account. When a shop is closed, all of its data is deleted together.
• Payment records: for as long as Kenyan tax law requires us to keep accounts.

How it is protected

• Each shop’s records are separated from every other shop’s inside the database itself, so one shop can never read another’s.
• The WhatsApp connection’s keys are stored encrypted.
• Staff can only do what their role allows, and every change is recorded.
• Everything travels over encrypted connections.

Your rights

Under Kenya’s Data Protection Act, 2019, you can ask to see the data held about you, to have it corrected, or to have it deleted, and you can object to how it is used.

• Shop owners can download the shop’s records from the dashboard at any time. To close the shop and delete everything, contact us.
• Customers of a shop: the shop holds your records, so ask the shop first. If you cannot, contact us and we will help.

You can reach us by email junanaphil@gmail.com. If you are not satisfied with our answer, you can complain to the Office of the Data Protection Commissioner (odpc.go.ke).

Children

Chonjo is for businesses. Shop accounts are not for anyone under 18.

Changes to this notice

If we change how we handle data, we will update this page and its date, and tell shop owners by email about any change that matters to them.