stoki.
Sign in

Privacy Notice

Last updated: May 2026 · Compliant with the Protection of Personal Information Act, 2013 (POPIA)

1. Who we are

Stoki ("we", "us", "our") is the responsible party for the personal information processed through this app. We provide an operating-system for South African SMME retail — stock, sales, credit book, invoicing, and an AI advisor.

Contact: support@stokiapp.com

2. What information we collect

We only collect personal information needed to deliver the service:

  • Identifiers: email address or South African cell number used to sign in.
  • Business records: store name, products, prices, sales, restocks, expenses, cash-up records.
  • Customer records (entered by you): debtor names, phone numbers, addresses, B2B customer details.
  • Device & usage data: session cookies, browser type, basic activity logs needed for security.
  • Communications: messages you send to support; opt-in marketing communications.

We do not knowingly collect special personal information (race, health, biometrics) and we do not collect information from children under 18.

3. Why we use it & lawful basis

  • To provide the service you signed up for — performance of contract (POPIA s.11(1)(b)).
  • To secure accounts, prevent fraud, and operate the platform — legitimate interest (s.11(1)(f)).
  • To send transactional notifications (low stock, daily summaries) — performance of contract.
  • To send marketing (only if you opt in) — consent (s.11(1)(a)). You may withdraw consent at any time.
  • To comply with legal obligations (tax records, SARS-required invoice retention) — s.11(1)(c).

4. Who we share it with

We do not sell, rent, or trade your information. Your business records are not used for advertising or shared with marketing networks.

To deliver the service we engage a small set of operators (as defined in POPIA) for functions such as hosting, storage, message delivery, and AI processing. These operators are bound by written processing terms, may only process your information for the purposes set out in this notice, may not retain it longer than required, and may not use it to train models or for any independent purpose of their own.

We will disclose information when compelled by valid legal process — for example, a court order or a lawful request from the Information Regulator, SARS, or law-enforcement authorities.

5. Cross-border transfers

Some processing may take place on servers located outside South Africa. Where this happens, the recipient is bound by data-processing terms that provide a level of protection substantially similar to POPIA, in line with s.72 of the Act.

6. How long we keep it

We keep your information for as long as your account is active. After you delete your account we retain your data for up to 30 days to allow recovery of accidental deletions, and then permanently destroy it — except where the law requires longer retention (e.g. tax invoices retained for the SARS-required period).

7. Security

All connections use TLS encryption. Your data is isolated from other accounts at the database level via row-level security. Passwords are hashed; we cannot recover your password and never see it in plain text. We monitor for unauthorised access and will notify you and the Information Regulator without undue delay if a security compromise affects your personal information (POPIA s.22).

8. Your rights under POPIA

You have the following rights, exercisable free of charge by emailing support@stokiapp.com:

  • Access: request a copy of the personal information we hold about you (s.23).
  • Correction: ask us to correct or update inaccurate information (s.24).
  • Deletion: ask us to delete information that is no longer required, or that we are not legally permitted to retain (s.24).
  • Objection: object to the processing of your information at any time on reasonable grounds (s.11(3)).
  • Withdraw consent: withdraw any consent you previously gave, including consent to marketing.
  • Portability: export a full copy of your store data as JSON from Settings → Account.
  • Complain: lodge a complaint with the Information Regulator (details below) if you believe we have not handled your information correctly.

9. Direct marketing

We will only send marketing communications about Stoki if you have explicitly opted in. Every marketing message includes an unsubscribe option. We do not use your customer or debtor records to send marketing on your behalf — your customer data stays your customer data.

10. Cookies & local storage

Stoki uses cookies only for authentication sessions and localStorage for preferences you set in the app (theme, language, sticky filters, advisor chat history kept on your device). We do not use third-party tracking or advertising cookies.

11. Children

Stoki is intended for adult business owners. We do not knowingly process the personal information of children under 18. If you believe a child has provided information to us, contact us and we will delete it.

12. Changes to this notice

We may update this notice as the service evolves. The "Last updated" date at the top will reflect any changes. Material changes will be notified to you via email or an in-app banner before they take effect.

13. Information Officer & contact

Our Information Officer can be reached at support@stokiapp.com. If you are not satisfied with our response, you may lodge a complaint with the Information Regulator:

← Back to sign in