Privacy notice

Your phone number. This is your account identity — it is how you sign in and how we send you your finished plan.

An email address, if you give us one. We use it to deliver a sign-in code when SMS does not arrive, and to send your plan and receipt.

The answers you give about your business idea: your town, the capital you have available, your skills, the premises you can use, and any free-text description of what you want to start. Some of this is information about your own finances, so we treat it as sensitive.

Your order and payment records: what you bought, when, how much, and the reference Paystack gives us. We never receive or store your card number, your M-Pesa PIN, or your bank details.

Technical information needed to run the service safely: a hashed form of your IP address for rate limiting, and a session cookie so you stay signed in.

To check you are a real person, using a one-time code sent to your phone or email.

To generate the business plan you asked for, and to keep it available in your account so you can come back to it or create a new version.

To take payment through Paystack and to keep the accounting records we are required to keep.

To send you service messages: your sign-in code, and a notification when your plan is ready. These are not marketing and you cannot opt out of them while you have an account, because without them the service does not work.

To send you marketing messages only if you separately ask us to. This is a different choice from accepting this notice, and you can withdraw it at any time.

To protect the service from abuse — rate limiting, spend caps and fraud checks.

Paystack — payment processing. They receive your payment details directly; we receive only the result and a reference.

Africa's Talking — delivers your SMS sign-in codes and plan-ready messages. They receive your phone number and the message text.

Resend — delivers our email, where you have given us an email address.

DeepSeek — the language model that writes the plan text. It receives your business inputs (town, capital, experience, what you want to start) and the structured data and research findings your plan is built from. It does not receive your phone number, your email address or your payment details.

Tavily — the search provider used for Researched Plans. It receives the search queries built from your business type and county. It does not receive anything that identifies you.

Our hosting and database run on a server we control in Germany, operated by Oracle.

If you accept advertising cookies, we use the Meta Pixel on selected public pages to measure our Facebook and Instagram ads. It sends page visits, public-site activity and campaign labels to Meta, which also receives your IP address, browser and device information and may associate this activity with your Meta account. The Pixel may set Meta's _fbp and _fbc cookies. Server-side advertising reporting is not enabled in this release.

Advertising tracking stays off until you choose Accept advertising cookies. Rejecting does not affect access to BizPlan. Use Advertising cookie settings at the bottom of the site to change your choice. We store that choice in your browser until you change it or clear browser storage. Rejecting stops further events, clears locally accessible Meta cookies and removes stored campaign attribution; it does not erase events already received by Meta.

We do not send your business description, questionnaire answers, phone number, email address, sign-in codes, plan text or personal financial figures to Meta. Tracking is excluded from account, checkout, admin and private plan pages. Meta processes advertising information outside Kenya. While you have accepted, approved campaign labels may be stored for this browser tab. We do not use automatic form-field matching.

Our servers are in Germany. Paystack, Africa's Talking, Resend, DeepSeek and Tavily process data outside Kenya, in the regions each of them operates.

That means information about you leaves Kenya in the ordinary course of using this service.

Your account, your plans and your plan inputs: for as long as your account exists. Delete your account and we remove your phone number, name and email from our records.

Order and payment records: kept after account deletion, because we are required to keep accounting records. They are no longer linked to your name or phone number.

Sign-in codes: a few minutes. They are stored hashed and are deleted after use or expiry.

Research results used to build a Researched Plan: we keep the extracted facts and the source links. We do not keep copies of the web pages themselves.

Sign-in codes are stored hashed, never in readable form, and expire within minutes. Admin passwords are hashed with Argon2.

Your plan PDFs are served only through an authenticated route that checks you own the plan. They are never left in a public folder.

The site is served over HTTPS only, with a content security policy that restricts what can run on the page.

No system is perfectly secure. If we ever have a breach that affects you, we will tell you and the Office of the Data Protection Commissioner, as the law requires.

You can ask us for a copy of what we hold about you.

You can ask us to correct anything that is wrong.

You can delete your account yourself from your account page, which removes your phone number, name and email from our records.

You can object to how we use your information, and you can withdraw marketing consent at any time without affecting your account.

You can complain to us through the contact form, and you can complain to the Office of the Data Protection Commissioner at odpc.go.ke if you are not satisfied with our answer.