Privacy

Updated 5 October 2026

This policy explains what personal data Aser One processes, why, and your rights.

1. Who we are

ASER Technologies publishes, hosts and operates Aser One. It is the data controller for your account data. Your seller depends on your country:

Country	Sold by	Address
Burundi	ASER Technologies	BICOR House, 2nd floor, office 3, Rohero 1, Avenue de la Grèce, Bujumbura, Burundi
Kenya	Aser General Trading	Sabaki, Athi River, Machakos County (Mombasa Road), Kenya
Other countries	Early access, on request	info@aser-tech.com

ASER Technologies publishes and operates Aser One in every country.

The seller in your country receives the payment data for its sales.

2. Your customers' data

For the data you enter about your own customers, staff and suppliers, you are the controller. We process it only on your instructions, to run the service. You must have a legal basis and inform these people.

3. What we collect

• Account: name, business name, email, phone, role, login.
• Your business data: customers, invoices, expenses, stock, accounting, staff.
• Payments: the amount, date and the reference you give us. For M-Pesa or KCB, the confirmation code and phone number. Never your PIN or card number.
• Files, photos and audio you upload or record (see section 4).
• Technical data: logs, IP address, device type and actions taken, for security and improvement.

4. Mobile app permissions

Each permission serves one feature. You can withdraw it in your phone settings; only that feature stops working.

• Camera and photos: receipts, documents and product photos are uploaded to our cloud storage and attached to the record.
• Shared files: files you share into the app from WhatsApp or email are uploaded the same way.
• Location: read only when an employee clocks in or out. The position, its accuracy and a mock-location flag are sent with that clock event. Never in the background.
• Face check: runs entirely on the phone. Only a match score is sent, never a face image or face template.
• Product labels: text is read on the phone with Google ML Kit.
• Microphone: voice commands and notes are sent to our server and transcribed by OpenAI. Some voice typing in the AI chat uses your phone's own speech service.
• Notifications: sent with Google Firebase Cloud Messaging, which uses a device token.
• Google Sign-In (optional): through Firebase Authentication. We receive your name, email and Google account ID.

5. Why we use it

• To run your account, plan and billing (our contract with you).
• To give support and send service messages (contract).
• To keep the service secure, prevent fraud and improve it (our legitimate interest).
• To keep tax and accounting records (legal duty).
• Phone permissions rely on your consent, which you can withdraw.

6. AI

Receipt and document images are sent to OpenAI to read the amount, supplier and category. A person confirms before anything is saved. Voice is transcribed the same way. We do not use your data to train third-party public AI models without your consent.

7. Who we share it with

We do not sell your data. The app has no ads and no ad tracking. We share data only with:

• Providers working for us, under confidentiality: hosting, backups and S3-compatible file storage; Google Firebase (notifications, Google Sign-In); OpenAI (AI features); Twilio (SMS and WhatsApp); our email provider; M-Pesa and KCB (payments).
• The seller in your country (see section 1).
• Services you turn on, such as mobile money or tax platforms (OBR / EBMS).
• Authorities, when the law requires it.

Some providers process data outside your country. We take reasonable steps to protect it.

8. How long we keep it

• While your account is active, then as long as the law requires.
• Burundi: invoices and tax records for the legal period (up to 10 years in some cases, OBR).
• Kenya: tax and accounting records for the period Kenyan tax law requires (at least 5 years).
• After closure, your data stays exportable for at least 30 days. Backups are purged within 90 days.

9. Security

All data is encrypted in transit between the app, our websites and our servers. We use access control and backups. No system is fully secure, so we cannot guarantee absolute security. Keep your login safe.

10. Your rights

You can ask to access, correct, delete, restrict or export your data, or object to some processing. Write to info@aser-tech.com. For data a business holds about you in Aser One, ask that business first; we help it.

Kenya: under the Data Protection Act, 2019, you have the right to be informed, to access your data, to object, and to have false or misleading data corrected or deleted. You may complain to the Office of the Data Protection Commissioner (ODPC).

11. Deleting your account

In the app: Profile → Delete my account sends us your request. Or use our deletion form.

12. Cookies and analytics

Our websites and the Aser One web app use cookies needed to work (session, security) and Google Analytics (GA4) to measure visits. The mobile app does not use Google Analytics. You can limit cookies in your browser.

13. Children and changes

Aser One is for businesses, not for minors. We may update this policy and will tell you about major changes. The date at the top shows the latest version.