This notice explains how SIONA Technologies Limited ("SIONA", "we") handles personal data when you use Weza, our WhatsApp bookkeeping assistant, and the Weza website and workspace at weza.sionaglobal.com.
1. Who we are
Weza is operated by SIONA Technologies Limited, whose registered office is at Baraka, Building 5, Nanyuki, Laikipia County, Kenya (postal address: P.O. Box 5, 10400 Nanyuki, Kenya). For the personal data described here, SIONA is the data controller.
- Weza on WhatsApp: +254 743 971021 (an automated service, not a human support line)
- Privacy and data requests: privacy@sionaglobal.com
- Help from a person: support@sionaglobal.com
2. What we collect
When you message Weza on WhatsApp
- Your WhatsApp phone number and the profile name WhatsApp shares with us.
- The messages you send: text, voice notes and photos of receipts or documents.
- Message and delivery identifiers from WhatsApp, used to reply, prevent duplicate records and show delivery status.
Business records we create from your messages
- Sales and expenses: amount, currency, category, vendor or customer name you mention, date, and a confidence score for the automatic reading.
- Corrections, confirmations and deletions you make, with their history.
- Weekly summaries and estimated tax figures calculated from your records.
Your account and choices
- Business name, owner name and the WhatsApp number linked to the business.
- For pilot participants: the version of the pilot notice you were shown, the date and time you replied YES, and any STOP PILOT or RESUME PILOT instructions.
- Privacy, correction and support requests you make.
When you sign in on the website
- A one-time sign-in code exchange linked to your WhatsApp number, and a session record (start time, expiry, last use).
- One session cookie and short-lived browser storage, described in our Cookie Notice.
Technical records
- Service logs about deliveries, errors and usage counts. These can include your phone number and message identifiers. They are designed not to contain your message text or receipt images.
We ask you not to send national ID numbers, bank or M-Pesa PINs, passwords, health information or children's data. Weza does not need them.
3. Why we use it
- To provide Weza: read your messages, record your sales and expenses, reply with confirmations, and send the summaries you ask for.
- To keep records accurate: flag uncertain readings for your confirmation and let you correct or undo entries.
- To keep the service secure: verify sign-ins, keep each business's records separate, prevent duplicate or abusive messages, and investigate failures.
- To support you: answer questions and handle privacy and correction requests.
- To run the pilot: record your consent and your choice to pause or resume.
We do not sell your data, use it for advertising, or share it with other Weza businesses.
Legal basis. We use your data to perform our agreement with your business (providing Weza); for our legitimate interest in keeping Weza secure and preventing fraud and duplicate records; with your consent for joining the pilot (your YES reply), which you can withdraw at any time; and where the law requires us to keep or disclose information.
4. Automatic reading of your messages
Weza uses artificial intelligence to read your messages, voice notes and receipt photos and turn them into records. The AI can make mistakes. When a reading is uncertain, Weza asks you to confirm it before relying on it. You can always correct or delete an entry. Weza does not make decisions about you that have legal or similarly significant effects; you decide what your records say.
Ask (optional). If you turn on Ask on the Weza website, the question you type and the information needed to answer it are sent to OpenAI. That information is the totals for the dates you choose and up to 24 of your saved records (date, amount, category, the customer or supplier name you recorded, and whether the record is awaiting review), or the contents of the one register you chose; plus your last four questions and Ask's answers in the same conversation, so it can follow up. Your business name, phone number and other businesses' records are not sent. We instruct OpenAI not to store these requests; under its business terms OpenAI may keep request data for up to 30 days to monitor abuse. Your questions and Ask's answers are saved in your account so you can read them again. We also record when you turned Ask on or off and which version of the terms you accepted, so we can show what you agreed to. They are deleted with your other data when you ask us to delete it. The AI can make mistakes; see section 2A of the Beta Participation Terms.
5. Who processes your data for us
We use these service providers to run Weza. They process data on our instructions.
- Meta Platforms (WhatsApp Business Platform): carries messages between you and Weza.
- Cloudflare: hosts the Weza application and website, stores receipt and voice files, and runs message queues.
- Neon: hosts the Weza database. Our database is located in the United States.
- OpenAI: reads text and receipt images and transcribes voice notes to create your records and, for businesses that turn on Ask, writes answers to questions about their saved records.
We may disclose data where Kenyan law requires it, for example to a court or regulator, or to protect the safety and security of users and the service.
6. Transfers outside Kenya
Each provider above processes data outside Kenya, including in the United States. We send data outside Kenya only to these providers and only for the purposes in this notice. Each provider handles it under its terms for business customers, which include data-protection obligations. We keep a record of these transfers.
7. How long we keep it
We keep:
- your business records, receipt and voice files for as long as you use Weza, and for 90 days after the pilot or your account ends unless you continue using Weza;
- your pilot consent record for 3 years after the pilot, so we can show what you agreed to;
- Ask questions and answers, and your Ask acceptance record, for as long as you use Weza, on the same terms as your business records;
- privacy, correction and support requests for 2 years;
- service logs for the short period our hosting provider keeps them;
- encrypted backup copies, stored on devices SIONA controls, for up to 90 days.
Deletion is carried out by a member of our team, not automatically. When these periods end, or when you ask us to delete your data, we delete it.
If you send STOP PILOT, Weza stops recording new entries but keeps your existing records until you ask us to delete them or the retention period ends.
8. Your rights
Under the Data Protection Act, 2019 you have the right to:
- be told how your data is used (this notice);
- access the personal data we hold about you;
- ask us to correct data that is wrong or misleading;
- ask us to delete data that is false, misleading or that we no longer have a reason to keep;
- object to processing, and withdraw consent at any time (withdrawal does not affect processing that already happened);
- ask us to restrict processing in certain cases, and to receive data you gave us in a portable format where the law provides.
To use these rights, see our Data Requests procedure. We verify your identity before acting, and a person on our team completes each request. We will respond as soon as we can, and always within the time the Data Protection (General) Regulations, 2021 allow.
If you are unhappy with how we handled your data, contact us first. You can also complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).
9. Security
We keep each business's records separate, protect receipt files behind short-lived signed links, encrypt connections, and limit staff access. No online service can promise perfect security. To report a suspected security problem, email security@sionaglobal.com. That mailbox is not staffed around the clock, so for anything urgent also email support@sionaglobal.com. If a personal data breach is likely to put you at risk, we will tell you and the Data Commissioner as the law requires.
10. Children
Weza is for people running a business. It is not meant for anyone under 18.
11. Changes
When we change this notice we will update the version and date above. If a change affects pilot participation, Weza will show you the new pilot notice on WhatsApp and ask you to reply YES again before recording more entries.