Plain language summary: Lipwa is an invoicing tool for freelancers and businesses. We collect only what we need to run the service. We do not sell your data. Your invoice and client data belongs to you. You can delete your account and all data at any time.
1. Who We Are
Lipwa is a web-based invoicing platform operated by Lipwa Online, a registered business in Kenya (Business Name Registration No. BN-VZSE9R9Z). Our platform is accessible at lipwa.online.
For the purposes of data protection law, Lipwa Online is the data controller responsible for your personal information.
Contact: For any privacy-related queries, contact us at hello@lipwa.online.
2. Information We Collect
Information you provide directly
- Account information: Full name, business name, email address, phone number, and password when you create an account.
- Business details: M-Pesa Paybill or Till numbers, KRA PIN, VAT registration number, eTIMS details — provided optionally for use on invoices.
- Client data: Names, email addresses, phone numbers, company names, and addresses of your clients that you enter into the platform.
- Invoice data: Invoice numbers, line items, amounts, dates, payment status, notes, and currency.
- Payment records: Payment amounts, methods, M-Pesa transaction codes, and dates that you record manually.
Information collected automatically
- Authentication data: Login timestamps and session tokens managed via secure HttpOnly cookies.
- Usage data: Basic interaction data for platform stability (no behavioural profiling).
We do not collect or store actual M-Pesa transaction data, banking credentials, card numbers, or any payment instrument details. Payment recording is manual and informational only.
3. How We Use Your Information
We use the information we collect solely to provide and improve the Lipwa service:
- To create and manage your account
- To enable you to create, send, and manage invoices
- To generate invoice PDFs containing your business and client data
- To send invoice emails to your clients on your behalf
- To display your financial summary and reporting data on your dashboard
- To send transactional emails (account confirmation, password reset) from Lipwa
- To maintain the security and integrity of the platform
We do not: sell your data, share it with advertisers, use it for profiling, or use your client data for any purpose other than providing the service to you.
4. Data Storage and Security
All Lipwa data is stored on Supabase, a secure cloud database platform. Your data is protected by:
- Row Level Security (RLS): Database-level policies that ensure each user can only access their own data. No user can access another user's invoices, clients, or profile.
- Encryption in transit: All data is transmitted over HTTPS/TLS encryption.
- Encryption at rest: Data stored in Supabase is encrypted at rest.
- Authentication: Passwords are never stored in plain text. Authentication is managed by Supabase Auth using industry-standard bcrypt hashing.
- Session management: Authenticated sessions use signed tokens stored in secure HttpOnly cookies. These cookies are inaccessible to JavaScript and cannot be read by browser-based scripts or extensions.
While we implement strong security measures, no system is 100% secure. You are responsible for keeping your login credentials confidential.
5. Third-Party Services
Lipwa uses the following third-party services to operate. Each has its own privacy policy:
Supabase
Database, authentication, and backend infrastructure. Data may be stored on servers in the EU or US.
Privacy policy
Resend
Transactional email delivery for account confirmations, password resets, and invoice emails sent on your behalf.
Privacy policy
Paystack
Payment processing for Lipwa subscriptions. Paystack processes card transactions and is subject to CBK regulations. We do not store card data.
Privacy policy
Google Fonts
Typography loaded from Google's CDN. Google may log font request metadata.
Privacy policy
We do not share your personal data with any other third parties except as required by law.
6. Financial Data
Lipwa handles financial information including invoice amounts, payment records, and business identifiers (KRA PIN, VAT numbers). This information is treated with the highest level of care:
- Financial data is never shared with third parties for commercial purposes
- Invoice and payment data is visible only to the account holder
- KRA PIN, VAT numbers, and eTIMS data are stored solely for inclusion on your invoices as you direct
- Lipwa does not process any actual financial transactions on your behalf — all payments between you and your clients occur outside the platform
- M-Pesa Paybill and Till numbers are stored for display purposes on invoices only
Lipwa is an invoicing tool, not a payment processor. You are responsible for your own tax compliance, including VAT, eTIMS registration, and KRA filings. Lipwa does not provide tax advice.
7. Data Retention
We retain your data for as long as your account is active. Specifically:
- Active accounts: All data retained while your account exists
- Account deletion: Upon request, we will delete your account and all associated data within 30 days. You may also delete your account directly via the platform settings.
- Inactive accounts: Accounts with no activity for 24 months may be flagged for deletion with advance notice by email
- Backups: Data may persist in encrypted database backups for up to 90 days after deletion
To request account deletion, email hello@lipwa.online with the subject "Delete My Account", or use the delete account option in your account settings.
8. Your Rights
Under the Kenya Data Protection Act 2019, you have the following rights regarding your personal data:
Access
Request a copy of all data we hold about you
Correction
Update or correct your personal information via Settings at any time
Deletion
Request deletion of your account and all associated data
Portability
Request an export of your invoices and client data
Objection
Object to any processing of your data you believe is unlawful
Restriction
Request that we restrict processing in certain circumstances
To exercise any of these rights, contact us at hello@lipwa.online. We will respond within 30 days.
9. Cookies and Tracking
Lipwa uses a single cookie strictly necessary for the service to function:
- Authentication cookie (
lp_token): A secure, HttpOnly session cookie that keeps you logged in. This cookie is set by our server and is inaccessible to JavaScript — it cannot be read or modified by browser scripts or browser extensions. It expires when your session ends or when you log out.
We do not use advertising cookies, tracking pixels, analytics cookies, Google Analytics, Facebook Pixel, or any third-party behavioural tracking. There is no cookie consent banner because there are no non-essential cookies.
10. Children's Privacy
Lipwa is a professional business tool intended for users aged 18 and over. We do not knowingly collect personal information from children under 18. If you believe a minor has created an account, contact us at hello@lipwa.online and we will delete the account promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make significant changes, we will:
- Update the "Last updated" date at the top of this page
- Send an email notification to your registered email address
- Display a notice on the dashboard for 30 days
Continued use of Lipwa after changes are notified constitutes acceptance of the updated policy.
12. Contact Us
For any privacy questions, data requests, or concerns: