Privacy Policy

Who we are

CartFlow ("we", "us", "the Platform") provides collaborative shopping, checkout links, payments, contribution/reconciliation ledgers, and seller tools. Licenced to and operated by Sanskrit Limited and Supported by BizClinic Africa LLC. Privacy enquiries: support@bizclinic.africa · WhatsApp +254113132508.

Controller and processor roles

• CartFlow acts as data controller for platform account data, security logs, platform billing, and platform communications.
• Sellers and tenants act as data controllers for buyer records, orders, checkout activity, and store-specific communications.
• CartFlow acts as data processor when handling buyer or order data on behalf of sellers through checkout, carts, payments, and related features.

Data we collect

• Account data: name, email, phone, password hash, role, tenant membership.
• Commerce data: shared carts, orders, checkout links, products, delivery details, payment status.
• Payment data: M-Pesa phone numbers, transaction references, reconciliation ledger entries, settlement records. We do not store full payment card numbers, CVVs, mobile-money PINs, or OTPs.
• Seller verification (KYC/KYB): legal and trading names, entity type, registration and tax identifiers where applicable, address, authorised representative details, beneficial ownership information where relevant, product categories, fulfilment arrangements, settlement beneficiary checks, and identity or corporate documents uploaded through a private vault. Each field has a documented purpose and lawful basis (contract and/or legitimate interests for marketplace due diligence). Documents are not published on public pages.
• Technical data: IP address, device/browser type, session cookies, audit logs, security events.
• Research data (optional): anonymized analytics and research-export consent records where you opt in via Settings.

Purposes and lawful bases

Cookies and sessions

We use necessary cookies for authentication (cf_auth), security, and cart functionality. See our Cookie Policy for details.

Integrations and subprocessors

When you use payments, marketing sync, or optional ClariFi sync, data may be shared with providers listed in our Subprocessor Register. Sellers are responsible for informing buyers where required.

International transfers

Data may be processed in Kenya and other jurisdictions where our hosting and subprocessors operate. We apply appropriate safeguards including contractual protections where required.

Retention

We retain data according to operational needs and legal requirements. Payment, tax, and fraud-prevention records may be retained longer where required by law.

Security

We implement encryption for sensitive credentials, access controls, tenant isolation, audit logging, and secure session management. No system is perfectly secure; report concerns to support@bizclinic.africa.

Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, object to processing, withdraw consent, and request portability. Kenya residents may lodge complaints with the Office of the Data Protection Commissioner (ODPC). EU/UK residents have rights under GDPR/UK GDPR.

Submit requests via email to support@bizclinic.africa.

ODPC registration: Sanskrit Limited's own ODPC registration status is an operator confirmation item and is not assumed from any related group company. We will update this notice when that status is confirmed. TrustPass scoring may affect programme access; if it materially gates access, a DPIA assessment should be completed by the operator. Research and marketing permissions remain optional and separate.

Children

CartFlow is not intended for users under 18 without appropriate guardian involvement.

Breach notification

We will notify affected users and regulators where required by applicable law.

Changes

We may update this policy. Material changes will be communicated with a new version number. Continued use after notice constitutes acceptance where permitted by law.