Legal

Privacy Policy

Last updated: 4 October 2026

1. Introduction

AutoeTIMS ("the Service"), operated by Araali Limited ("we", "us", "our"), connects your accounting software (such as QuickBooks or Xero) and the AutoeTIMS point of sale to the Kenya Revenue Authority (KRA) electronic Tax Invoice Management System (eTIMS) via an authorised eTIMS integrator. This policy explains what data we access, how we use it, how we protect it, who we share it with, and your rights.

2. Data We Access

When you connect your accounting software, we access only the data needed to prepare, sign and record eTIMS tax invoices:

  • Invoice and credit note data — numbers, dates, line items, quantities, amounts, tax codes and currency
  • Customer details on invoices — customer names and KRA PINs as they appear on your invoices
  • Item/product names and codes — used to map your items to KRA classification codes
  • Organisation identifiers — your company name, KRA PIN, eTIMS branch details, and the identifier of your connected accounting organisation
  • Your users — the email addresses of people you invite to the client portal, and a record of who approved or changed what (audit trail)
  • Point of sale (only if you use it) — sales, and any buyer name, phone number, email address or KRA PIN that your staff enter; for M-Pesa payments, the payer's phone number and the payment status

We do not access bank account details, payroll data, or accounting data unrelated to invoicing. We never ask for or store your accounting software password.

3. How We Use Your Data

Your data is used only to:

  • Match your items to KRA eTIMS classification codes. This uses a rules-based matcher that runs on our own servers; no AI service is used and item names are not sent to any third party for this
  • Submit invoices and credit notes to KRA for eTIMS signing through our eTIMS integrator, when you approve them (you approve each invoice, or switch on automatic signing)
  • Write eTIMS confirmation details (receipt number, verification code, QR code and PDF) back to your accounting software
  • Send sign-in links to your portal users and, if you use the point of sale, email receipts to buyers who ask for one
  • Show status, exceptions and history in your portal, and diagnose and fix errors

We will never sell your data or use it for any purpose other than providing the Service. We share it only with the service providers listed in section 6, and only as far as each one needs it.

4. Data Protection Measures

  • Encryption in transit — all connections to the Service and to our service providers use HTTPS/TLS
  • Encrypted connection credentials — the OAuth tokens and API keys that connect your accounting software are encrypted in our database with AES-256-GCM
  • Encrypted customer details — your customers' names and KRA PINs on invoices, and point-of-sale buyer names, KRA PINs, phone numbers and email addresses, are encrypted in our database with AES-256-GCM. The key is held outside the database
  • Restricted database — other data (such as invoice amounts and line items) is not individually encrypted; it is stored in a database on our dedicated server, which is not open to the internet and is accessible only to authorised operators
  • Access control — the client portal uses single-use sign-in links that expire after 15 minutes; sessions end after 24 hours of inactivity and after 7 days at most. Sign-in links and sessions are stored only in hashed form. Each user sees only the organisations they belong to. The operator dashboard requires a personal administrator account with a password and a second factor (authenticator app code), with lockout after repeated failed attempts

5. Data Retention

Tax records — invoices, eTIMS receipts, credit notes, point-of-sale sales and the audit trail of who signed or changed what are tax records. Kenya's Tax Procedures Act, 2015 requires them to be kept for at least five years. We keep them for as long as your account is active and for at least five years after the end of the tax period they relate to, and we never delete them automatically.

Deleted automatically — a daily job removes sign-in links one day after they expire, portal sessions once they expire, copies of data received from your accounting software by webhook after 30 days (90 days if they could not be processed), and problem reports, resolved operational alerts and declined onboarding requests after 12 months.

When you leave — we disconnect your accounting software and delete your users and connection credentials within 90 days of the account closing; tax records are deleted once the five-year period has passed. You may ask us to export or delete your data at any time; where we must keep tax records, we tell you which and for how long. Signed eTIMS receipts remain on record with KRA, which we cannot change.

6. Service Providers (Sub-processors)

We use the following service providers:

  • Slade 360 (Savannah Informatics) — KRA-authorised eTIMS integrator; receives the invoice and credit note data needed for signing and submits it to KRA
  • Intuit QuickBooks, Xero, and other accounting systems you connect — we read invoices and items from, and write eTIMS confirmations back to, the account you connect
  • Resend — sends our emails (portal sign-in links and point-of-sale receipts); receives the recipient email address and the email content
  • OVHcloud — hosts our dedicated server and database (France, EU)
  • Hetzner — stores our daily off-site database backups (Germany, EU)
  • Cloudflare — DNS and network edge for our domain; web traffic to the Service passes through Cloudflare's network
  • GlitchTip — error monitoring; receives technical error reports (error message, stack trace, page address and browser type), which can occasionally include an invoice reference
  • Safaricom M-Pesa — only if you take M-Pesa payments in the AutoeTIMS point of sale; receives the payer's phone number and the amount
  • Google — our pages load an icon font from Google Fonts, and our public marketing pages (home page and demo) load a Google Ads tag; both receive standard visit information (such as IP address, browser and page address) from your browser. The Ads tag is not loaded in the client portal, the point of sale or the operator dashboard

7. Your Rights

You have the right to:

  • Access — request a copy of all data we hold about your organisation
  • Rectification — request correction of inaccurate data
  • Deletion — request deletion of your data and disconnection of your accounting software
  • Portability — receive your data in a machine-readable format
  • Disconnect — revoke access to your accounting software at any time through Xero/QuickBooks settings

8. Kenya Data Protection Act

We comply with the Kenya Data Protection Act, 2019, and the regulations made thereunder. Your data is processed on the lawful basis of contract performance (providing the eTIMS signing service you have engaged us to provide).

9. Contact

For privacy-related inquiries, data requests, or complaints, contact us at:

Araali Limited
P.O. Box 15097, 00509 Langata, Nairobi, Kenya
Company No. PVT-DLUL3ZXD
Email: [email protected]

10. Changes to This Policy

We may update this policy from time to time. We will notify connected clients of any material changes via email. Continued use of the Service after changes constitutes acceptance of the updated policy.