Zireva Dduka

Privacy policy

Last updated: 12 October 2026

Zireva Dduka is a tool a business uses to run its shop, Mobile Money and agent-banking counter: sales, stock, transactions, opening and closing counts and reports. It is used only by people the business owner has given a login to. Zireva Dduka is a product of Zireva Ventures SMC ("we"). This page explains what information the app handles and why.

Who is responsible

Each business that uses Zireva Dduka (the shop owner) decides what is recorded and who can see it. The app is provided by Zireva Ventures SMC. You can reach us through the contact email shown on the Zireva Dduka page in the Google Play Store.

What is collected

• Staff accounts: name, username, role, password (stored only as a one-way scrambled code) and, if switched on, a two-step login secret.
• Business records the staff enter: sales and receipts, stock, expenses (with receipt photos), Mobile Money and agent-banking transactions (amount, transaction reference, and the customer's phone number, account number or name where the staff type them), customers who buy on credit, suppliers, and the money counted at opening and closing.
• Location at opening and closing: when the business owner switches on "opening checks", the phone's location is taken once when the day is opened and once when it is closed, only to confirm the person is at the shop. Location is never tracked in the background or at other times.
• Photos: a photo taken at opening (if the owner switches it on) and photos of expense receipts. Photos are taken only when the person taps the camera button.
• Phone checks: if the owner allows only the shop's own phones, a code is saved on that phone to recognise it.
• Activity log: logins and important actions (for example a cancelled sale) with the time, so the owner can review them.

How it is used

Only to run the business: to work out what should be in the drawer and on the floats, profit, stock and staff performance, and to send the owner reports and alerts. The information is not used for advertising, is not sold, and is not shared with anyone outside the business, except as described below.

WhatsApp messages

Daily summaries and alerts are sent to the WhatsApp numbers the owner enters, through the CallMeBot WhatsApp service. These messages contain business figures (for example the day's sales and balances).

Subscription payments and support

When a business pays its Zireva Dduka subscription online, the payment is processed by Flutterwave. We keep the amount, the date and the payment reference, never PINs or card numbers. Many businesses use the same Zireva Dduka service, but each one sees only its own records. Zireva Dduka support can look inside a business only while its Super Admin allows it, and everything support does is shown in that business's activity list. A business can download all its records at any time (More › Download my data).

Notifications

If a person turns on notifications, their phone or browser is given an address by Google (Firebase Cloud Messaging, for the Android app) or by the browser maker (web push). Zireva Dduka keeps that address, linked to the person's account, only to send them their notifications; it is deleted when they log out, remove it on More › Notifications, or uninstall the app. Notifications carry a short text such as "Stock count requested".

Watch and the daily brief

"Watch" (More › Watch) compares a business's own records with each other on the business's own server, for example cancellations or closing shortages, and lists things worth checking for the Super Admin and Shop Admins. Nothing leaves the server for this.

If the Super Admin switches on the daily brief (More › Daily brief, off until then), a short note is written after each closed day. Its sentences are written by an AI service (Groq). Only anonymous figures are sent to it: amounts, counts, product and expense-category names, and labels such as "Employee A" or "Debtor 1". It never receives the real name of any employee or customer, a phone number, the name of the business or shop, notes, reasons, descriptions or photos. The real names are put back on the business's own server, and the text is checked against the records before it is used. The service is used with Zero Data Retention, so it does not keep what it receives. The brief is shown in the app and sent by notification and WhatsApp to the people who chose it. The Super Admin can switch it off at any time, and then nothing is sent to the AI service.

The same rules apply to the other AI helpers, each of which the Super Admin switches on separately (More › AI helpers): Ask Zireva (a question typed by an administrator, with the names of staff, customers, suppliers and shops replaced and phone numbers and e-mail addresses removed, plus the anonymous figures needed to answer it); search words for products (product names only); and the help guide (a how-to question with names replaced, plus text from the public Zireva Dduka guide; if the guide cannot answer, the question can be sent to Zireva Dduka support, and the support team may use the AI to draft a reply to a request from a business that switched this on, again with names and phone numbers removed). Please do not type other people's private details into a question. The AI never changes a record.

Where it is kept and how it is protected

Everything is stored on the business's own server and sent only over an encrypted connection (HTTPS). Entries made without internet are kept on the phone until they are sent, then removed; logging out clears saved screens from the phone. Staff can only see what their role allows, and every page checks the login. The server keeps daily backups for 14 days.

How long it is kept, and deleting it

Business records are kept as long as the business uses Zireva Dduka, because they are its accounts. A staff member who leaves can be disabled by the owner. To ask for information about you to be corrected or deleted, contact the business that gave you your login, or us at the contact email on the Play Store page.

Children

Zireva Dduka is a business tool for adults and is not meant for children.

Changes

If this policy changes, the new version is published on this page with a new date.