Privacy Policy

MauzoPilot is point-of-sale software. Most business data is created and kept on your own device. This policy explains what this website and the MauzoPilot account service collect, and what leaves your device.

The marketing website is static. It does not use analytics, tracking scripts, advertising, or cookies, and it does not load third-party scripts. Fonts are served from the site itself.

Like any web host, the hosting provider may keep standard server logs (such as IP address and requested page). We do not control those logs beyond choosing the host.

When you register, the form sends the following to the MauzoPilot API:

• business name and business type,
• your username and email address,
• your password, which the server stores only as a salted hash (never in readable form).

When you sign in on this website, the server establishes a secure, encrypted session cookie (HttpOnly, SameSite=Lax with CSRF protection). Access tokens are never stored in your browser's local storage. Logging out terminates the session immediately on the server and flushes the session cookie.

Your account and business details are stored in the MauzoPilot cloud database. The API is currently hosted on Render.

Products, stock, sales, refunds, expenses, cash entries, suppliers, customer credit records, and reconciliations are stored in a local database in the MauzoPilot app. That data stays on your device unless you sync it or export it.

Database backup files and CSV exports are not encrypted. Keep them somewhere you trust.

When you are signed in and online, the app can send records from your device to your business's cloud account. Access is limited to signed-in members of that business according to their role. Sync is early and still being verified, so rely on your own backups.

The optional assistant answers questions from fixed, read-only queries on your device. If you connect your own local Ollama model, only your typed question and fixed instructions go to the address you configured; your business records and query results stay on the device. We do not log questions or answers.

If you message us on WhatsApp, call, or email, we receive whatever you send, and those services process it under their own terms. The website has no contact form, so nothing you type on a page is sent to us until you choose one of those channels.

We do not sell your data and do not share it for advertising. Data is processed by the infrastructure providers needed to run the service, such as the API host and database.

To ask for a copy, correction, or deletion of your account data, email samgates.dev@gmail.com. There is no self-service account deletion yet, and we have not set a fixed retention period. Financial records in the app are kept to preserve an audit trail, so some corrections are made through refunds or adjustments rather than deletion.

Kenya's Data Protection Act, 2019 may apply to how personal data is handled, including data-controller registration, retention periods, and breach procedures. These points need professional legal review and are not yet addressed in this policy.

Questions? See our contact page or the Terms of Service.