Privacy Policy
Pinecrest Solutions Ltd · Version 2026-10-20 · Effective October 20, 2026
This policy explains how Pinecrest Solutions Ltd ("we", "us") collects and uses personal data about the people who sign up for and use Microbooks, and the rights those people have. It is written to meet the Kenya Data Protection Act, 2019 (the "KDPA"), the EU and UK General Data Protection Regulation ("GDPR") and US state privacy laws, including the California Consumer Privacy Act ("CCPA"), where they apply.
1. Who is responsible for your data
For account, billing, usage and support data, Pinecrest Solutions Ltd, [REGISTERED ADDRESS], is the data controller. We are registered with the Office of the Data Protection Commissioner (ODPC) of Kenya under registration number [ODPC REGISTRATION NUMBER]. You can reach us about privacy at privacy@microbooks.io.
Data inside your books is different. When you or your users record customers, suppliers, employees or other people in the Service, you are the controller of that data and we process it on your behalf under our Data Processing Agreement. If you are one of those people, please contact the business that uses Microbooks. We will help them answer your request.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, hashed password, the terms version you accepted and when | You, at registration |
| Billing data | Plan, subscription status, invoices, billing email. Card details are entered on our payment provider's hosted page. We receive only a token and limited card details such as brand, last four digits and expiry, never the full card number. | You and our payment provider |
| Technical and usage data | IP address, request timestamps, endpoints called, response codes, OAuth client and token identifiers, user agent, transaction and API call counts | Automatically, when you use the Service |
| Support and communications | Messages you send us, and records of privacy requests | You |
| Users you invite | Name and email of people you add to an entity | The account holder who invites them |
We do not intentionally collect sensitive personal data, such as health or biometric data, and you should not put it in the Service.
3. Why we use it, and our legal bases
| Purpose | Legal basis (KDPA s.30 / GDPR art. 6) |
|---|---|
| Creating and running your account, signing you in, providing the Service | Performance of our contract with you |
| Billing, collecting payment, sending trial and renewal reminders | Performance of contract |
| Keeping the Service secure, rate limiting, preventing fraud and abuse | Our legitimate interests in protecting the Service and our customers |
| Measuring usage against plan quotas and improving the Service | Performance of contract and legitimate interests |
| Responding to support and privacy requests | Contract, legal obligation and legitimate interests |
| Keeping financial and tax records, responding to lawful requests | Legal obligation |
| Telling you about important changes to the Service or these policies | Contract and legitimate interests |
We do not sell personal data, share it for cross-context behavioural advertising, or use it, or your books, to train machine-learning models. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Who we share it with
- Subprocessors that host and run the Service, process payments and send email, under contracts that require them to protect the data. They are listed on our Subprocessors page.
- Users of your entities, who can see the books and user lists of entities they belong to.
- Authorities, where the law requires it or to protect our rights, users or the public. We will push back on requests that are not legally valid, and tell you where we are allowed to.
- A buyer or successor if our business is merged or sold, subject to this policy.
5. International transfers
We are based in Kenya and some of our subprocessors operate in other countries. When we transfer personal data out of Kenya, we do so in line with sections 48 to 50 of the KDPA, relying on appropriate safeguards or the adequacy of the destination. For data from the EU or UK, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or on an adequacy decision. You can ask us for a copy of the relevant safeguards.
6. How long we keep it
- While your account is active, we keep your account, billing and usage data.
- After you delete your account, sign-in stops straight away and billing ends. We keep your personal data for [6 months] so that a deletion made in error can be reversed. After that we delete or anonymise it, including names, narrations and references in your books, billing contacts and tokens.
- Financial records, meaning amounts, dates and ledger entries, are kept in anonymised form for [7 years] where tax law requires it.
- Our own invoices to you are kept for as long as Kenyan tax law requires.
- Security logs are kept for [90 days] unless they are needed to investigate an incident.
- Records of privacy requests are kept as evidence of how we handled them.
7. Your rights
Depending on where you live, you have the right to:
- be informed about how your data is used (this policy);
- access your personal data and receive a copy in a portable, machine-readable format;
- correct inaccurate data;
- delete your data, subject to legal retention duties;
- object to, or ask us to restrict, processing based on legitimate interests;
- withdraw consent where we rely on it;
- under the CCPA, know, delete and correct your personal information, and not be discriminated against for exercising these rights. We do not sell or share personal information, so there is no need to opt out.
To exercise any right, email privacy@microbooks.io from the address on your account. You can also delete your account yourself. We may need to verify your identity. We respond within the time the law allows, usually within 30 days. An authorised agent may make a request for you with your written permission.
If you are unhappy with how we handled your data, you can complain to the Office of the Data Protection Commissioner in Kenya, or to your local data protection authority (for example, the ICO in the UK or your EU member state's supervisory authority). We would appreciate the chance to resolve it with you first.
8. Security
We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit, hashed passwords, sealed session cookies, scoped and revocable OAuth tokens, rate limiting, access controls and logging. See our Security page. If a personal data breach is likely to put you at risk, we will tell you and the regulator as the law requires. Under the KDPA, we notify the ODPC within 72 hours of becoming aware of a breach.
9. Cookies
The microbooks.io console uses only cookies that are strictly necessary to run it:
mb_session: an encrypted cookie that keeps you signed in.mb_oauth_flow: protects the sign-in process against forgery. It lasts minutes.mb_plan: remembers the plan you chose during sign-up, for up to one hour.
We do not use advertising or analytics cookies. If that changes, we will update this policy and ask for consent where the law requires it.
10. Children
The Service is not intended for anyone under 18, and we do not knowingly collect children's personal data.
11. Changes to this policy
We will post changes here with a new version date and, for material changes, notify you by email or in the console before they take effect.
12. Contact
Pinecrest Solutions Ltd, [REGISTERED ADDRESS]. Privacy questions and requests: privacy@microbooks.io. [EU REPRESENTATIVE, IF APPOINTED] · [UK REPRESENTATIVE, IF APPOINTED]