This notice explains how personal data is collected and used through the StreeTill mobile application (the App). Read it with the StreeTill Terms and Conditions of Use (the Terms).
The App is provided by Aone Sebinanyane, Plot 7581, Maratanang, Tlokweng, Botswana (we, us, our). For privacy matters contact asbnlabs@outlook.com.
This notice applies to the person who creates a business account and signs in to the App (the Owner) and to anyone who contacts us for support. Because StreeTill stores no information about a business's customers, no customer is covered by it.
This notice is written to meet the Botswana Data Protection Act, 2024 (Act No. 18 of 2024) (the DPA) and, where it applies, the EU General Data Protection Regulation (the GDPR).
StreeTill is built to collect as little personal data as possible:
We collect the following categories of data:
| Category | Examples | Source |
|---|---|---|
| Account data | The Owner's email address, a password (stored only in hashed form by our authentication provider), and the date and version of the Terms accepted | You, at sign-up |
| Business data | Business name, country, currency, items and prices, sales (items, amounts, tips, sales tax, date and time), costs and notes. These are business records, not personal data about individuals, provided they are used as the Terms require | You, as you use the App |
| AI insights (Premium) | The text of each AI insight written for your business, kept so it can be shown to you again | Generated at your request |
| Subscription data | Free-trial end date, Premium end date and subscription status, linked to your business's account number. Purchases are made through Google Play, which handles your payment details. We never see or store card or payment details | Google Play, through RevenueCat |
| Technical and security data | Sign-in times, IP address, device type, operating system, app version and error logs. For password resets, only a one-way hash of the code sent to you, and a short-lived log of requests that holds only a hash of the email address and of the IP address, used to stop repeated guessing | Generated automatically |
| Support data | Your email address and the content of messages you send us | You |
Sales recorded while you are offline are kept on your phone until they sync. We do not collect sensitive personal data.
We use personal data only for the purposes below. Under the GDPR we must identify a legal basis for each purpose. The DPA recognises equivalent grounds, and we rely on the corresponding grounds under the DPA.
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and managing accounts and signing you in | Account data | Performance of our contract with you (the Terms) — GDPR Art. 6(1)(b) |
| Running the App for your business: storing and showing your items, sales, costs and reports, and syncing sales recorded offline | Business data | Performance of contract — GDPR Art. 6(1)(b) |
| Writing an AI insight for your business, only when you ask for one (Premium) | Your business name, currency and figures for the current month and the three months before it, your costs by category and your five best-selling items (sent to an AI service); the insight text | Performance of contract — GDPR Art. 6(1)(b) |
| Managing your free trial and Premium subscription | Subscription data | Performance of contract; legal obligation (tax and accounting records) — GDPR Art. 6(1)(b) and (c) |
| Keeping the App secure, isolating each business's data, limiting repeated password-reset attempts and investigating incidents | Technical and security data | Our legitimate interest in running a secure service — GDPR Art. 6(1)(f) |
| Diagnosing errors and improving the App | Technical and security data | Our legitimate interest in a reliable, working product — GDPR Art. 6(1)(f) |
| Sending service messages such as password-reset codes and notices of changes | Account data | Performance of contract; legitimate interest — GDPR Art. 6(1)(b) and (f) |
| Responding to support requests | Support data | Performance of contract; legitimate interest — GDPR Art. 6(1)(b) and (f) |
| Complying with law and defending legal claims | Any relevant data | Legal obligation; legitimate interest — GDPR Art. 6(1)(c) and (f) |
Where we rely on legitimate interests, we have balanced those interests against your rights. You can ask us for more information about this assessment and you have the right to object (see section 9).
What we do not do. We do not sell personal data, use it for advertising, or make automated decisions with legal or similar effects about anyone. An AI insight is an explanation of your own figures, shown only to you. It can contain mistakes, so check it before relying on it, and any decision about your business stays with you.
We share personal data only with the following recipients, and only to the extent necessary:
A current list of our service providers is available on request from asbnlabs@outlook.com.
App data is hosted in Ireland, where the GDPR protects it. Some of our service providers, including those that provide AI insights, subscription management, email delivery and app builds, are based in the United States or may access data from there, and we access data from Botswana to operate and support the App. Transfers from Botswana take place only as the DPA permits, with contractual safeguards.
We use appropriate technical and organisational measures to protect personal data, including:
Sales recorded offline are kept on your device until they sync. Downloaded PDF statements and Excel exports leave our protection once saved or shared, so store them securely. Please use a strong password and lock your phone.
If a breach affects personal data, we will contain it promptly and notify the Information and Data Protection Commission, the relevant EU authority and affected people where the law requires.
We keep your data while your account is open. When you delete your account in the App, your business, all its records (including saved AI insights) and your login are deleted from our active systems straight away. Backups held by our hosting provider expire on its normal schedule. Short-lived password-reset records are cleared automatically.
Subscriptions. Deleting your account does not cancel a Premium subscription. Cancel it in Google Play (Payments and subscriptions → Subscriptions) so you are not billed again. Records of subscription purchases held by Google and RevenueCat are kept under their own policies. If you would like us to ask RevenueCat to delete its record, email us.
We may keep data longer only where the law requires it or to establish or defend a legal claim.
Subject to applicable law, you may: be informed about how your data is used; access it and receive a copy; correct it; have it deleted; restrict or object to processing; receive your data in a portable format (the App's free Excel export supports this, or ask for a full copy by emailing us); withdraw consent where we rely on it; and complain to a supervisory authority.
You can change your business details and export or delete your data directly in the App. For anything else email asbnlabs@outlook.com. We respond within one month.
Where the GDPR or UK GDPR applies, you have the rights above and the legal bases in section 4 apply. We are the controller of the personal data described in this notice. EU users may complain to the data protection authority where they live or work (in Ireland, the Data Protection Commission); UK users to the Information Commissioner's Office.
Please contact us first at asbnlabs@outlook.com. You may also complain to the Information and Data Protection Commission in Botswana or your local EU or UK authority.
The App is for adults running a business. We do not knowingly collect data from anyone under 18.
We may update this notice, for example when we add features, change prices or add new service providers. The current version is always in the App under Account, and on this page. We will notify Owners of material changes before they take effect.
Aone Sebinanyane (StreeTill), Plot 7581, Maratanang, Tlokweng, Botswana.
Email: asbnlabs@outlook.com