How Loon collects, uses, stores and protects your information — across the mobile app and the web console. Written to comply with Kenya's Data Protection Act, 2019 and the EU/UK GDPR.
This Privacy Policy explains how Loon Technologies Ltd ("Loon", "we", "us", "our") handles personal data when you use the Loon mobile application, the Loon website, and the Loon admin/customer console (together, the "Services"). Loon helps small businesses in Kenya record sales, manage their catalogue, track money in and out, bill customers, and see insights.
We are committed to protecting your privacy and processing your personal data lawfully, fairly and transparently. This policy is written to comply with the Kenya Data Protection Act, 2019 and its Regulations (overseen by the Office of the Data Protection Commissioner, the "ODPC") and, where it applies to you, the EU General Data Protection Regulation (GDPR) and the UK GDPR.
This policy covers everyone who uses Loon: business owners and their invited staff who use the mobile app to run a business, and visitors who use our website and web console. Where the two differ, we say so. For most personal data you enter about your own customers, you are the data controller and we act as your processor — see Section 9.
We do not sell your personal data, and we do not share it with third parties for their own marketing.
We use personal data only to deliver and improve the Services:
Under the Kenya Data Protection Act, 2019 and (where it applies) the GDPR, we rely on the following lawful bases:
| What | Why / legal basis |
|---|---|
| Account & business profile | Performance of a contract — to provide the Services you sign up for. |
| Business records you enter | Performance of a contract and, for data about your own customers, your consent / your own lawful basis as the controller. |
| Diagnostics, security, fraud prevention | Legitimate interests — keeping the Services reliable and safe (balanced against your rights). |
| Support communications | Legitimate interests / your consent. |
| Tax & accounting retention | Legal obligation. |
Where we rely on consent, you may withdraw it at any time without affecting processing already carried out.
We share personal data only with service providers ("data processors") who help us run Loon, under contracts that require them to protect it and use it only on our instructions:
If Loon is ever involved in a merger, acquisition, or asset sale, we will notify you before your personal data becomes subject to a different privacy policy.
africa-south1) region.These transfers outside Kenya are made under appropriate safeguards as required by sections 48–49 of the Data Protection Act, 2019 and, where relevant, Chapter V of the GDPR — namely Google's Standard Contractual Clauses and its data-processing commitments. Data is encrypted in transit and at rest. By using Loon you acknowledge the cross-border transfer of your sign-in email as described above.
We keep your data for as long as your account is active. When you delete your account, your business data is removed from Firestore and your credentials are removed from Firebase Authentication, subject to any legal retention obligations (for example tax records, which may need to be retained for a statutory period). Backups are overwritten on a rolling basis.
Subject to the limits in the applicable law, you have the right to:
You can exercise most of these directly in the Services: edit or delete records in the app at any time, and request full account deletion by emailing privacy@loon.co.ke. We will respond within the timeframes set by the applicable law (generally within 30 days), free of charge in most cases.
When you add your own customers', staff, or suppliers' personal data (such as names and phone numbers) to Loon, you are the data controller for that information and Loon acts as your data processor, storing it on your behalf and on your instructions. You are responsible for having a lawful basis to collect and store that data, for informing those individuals as the law requires, and for handling any requests they make to you about their data. If you are a Kenyan business processing personal data at scale, you may have your own obligations under the Data Protection Act, 2019, including ODPC registration.
Access is restricted by per-user security rules: each account can read and write only its own business data. Data is encrypted in transit (TLS) and at rest. We apply the principle of least privilege internally and keep diagnostic data to the minimum needed. No system is perfectly secure, so please use a strong, unique password and keep it confidential. If we ever become aware of a personal-data breach that poses a risk to you, we will notify you and the ODPC as required by law (within 72 hours of becoming aware, where applicable).
The Loon website and console use only strictly necessary cookies — for example, to keep you signed in to the admin console and to remember basic preferences. We do not use advertising or cross-site tracking cookies, and the mobile app contains no advertising or third-party analytics SDKs. You can clear or block cookies in your browser settings, though some features of the console may then stop working.
Loon is a tool for business use and is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
We may update this policy from time to time and will revise the "Last updated" date above. Material changes will be communicated in-app or by email. Continuing to use the Services after a change means you accept the updated policy.
For any privacy question, to exercise your rights, or to reach our Data Protection Officer, email privacy@loon.co.ke or write to Loon Technologies Ltd, Nairobi, Kenya.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner (Kenya) at odpc.go.ke. If you are in the EU/EEA or the UK, you may also complain to your local data protection supervisory authority.
↑ Back to topNo ads, no tracking, no selling your numbers. Leave your email and see for yourself.