Privacy Policy
Version 1.0 · Effective 27 June 2026
How CartFlow collects, uses, and protects personal data.
Who we are
CartFlow("we", "us", "the Platform") provides collaborative shopping, checkout links, payments, wallet, and seller tools. Operated by BIZCLINIC AFRICA LLC. Privacy enquiries: support@bizclinic.africa · WhatsApp +254113132508.
Controller and processor roles
- CartFlow acts as data controller for platform account data, security logs, platform billing, and platform communications.
- Sellers and tenants act as data controllers for buyer records, orders, checkout activity, and store-specific communications.
- CartFlow acts as data processor when handling buyer or order data on behalf of sellers through checkout, carts, payments, and related features.
Data we collect
- Account data: name, email, phone, password hash, role, tenant membership.
- Commerce data: shared carts, orders, checkout links, products, delivery details, payment status.
- Payment data: M-Pesa phone numbers, transaction references, wallet entries, settlement records. We do not store full payment card numbers.
- Technical data: IP address, device/browser type, session cookies, audit logs, security events.
- Research data (optional): anonymized analytics and research-export consent records where you opt in via Settings.
Purposes and lawful bases
| Purpose | Lawful basis |
|---|---|
| Provide carts, checkout, and payment services | Contract |
| Account security and fraud prevention | Legitimate interests / Legal obligation |
| Platform billing and seller subscriptions | Contract |
| Research analytics (where consented) | Consent |
| Compliance, tax, and audit records | Legal obligation |
Cookies and sessions
We use necessary cookies for authentication (cf_auth), security, and cart functionality. See our Cookie Policy for details.
Integrations and subprocessors
When you use payments, marketing sync, or optional ClariFi sync, data may be shared with providers listed in our Subprocessor Register. Sellers are responsible for informing buyers where required.
International transfers
Data may be processed in Kenya and other jurisdictions where our hosting and subprocessors operate. We apply appropriate safeguards including contractual protections where required.
Retention
We retain data according to operational needs and legal requirements. Payment, tax, and fraud-prevention records may be retained longer where required by law.
Security
We implement encryption for sensitive credentials, access controls, tenant isolation, audit logging, and secure session management. No system is perfectly secure; report concerns to support@bizclinic.africa.
Your rights
Depending on your location, you may have rights to access, correct, delete, restrict, object to processing, withdraw consent, and request portability. Kenya residents may lodge complaints with the Office of the Data Protection Commissioner (ODPC). EU/UK residents have rights under GDPR/UK GDPR.
Submit requests via email to support@bizclinic.africa.
Children
CartFlow is not intended for users under 18 without appropriate guardian involvement.
Breach notification
We will notify affected users and regulators where required by applicable law.
Changes
We may update this policy. Material changes will be communicated with a new version number. Continued use after notice constitutes acceptance where permitted by law.