Soko ecosystem privacy

The data shared across every Soko product is small and intentional:

• Your account — email, name, role, password hash (managed by Supabase Auth).
• Your tenant — business name, subdomain handle, owner reference.
• Your subscription — plan, status, billing history.
• Payment metadata — Marzpay transaction IDs, method, amount, status. We never see card numbers or mobile-money PINs.

We don't process card numbers, CVVs, or mobile-money PINs. Payments go through Marzpay's hosted gateway (cards) or STK push (MoMo) — those credentials never touch our servers.

Every Soko product reads from the same account/tenant rows so that signing in once gives you access to every product you've entitled. Product-specific data (your marketplace catalogue, your CRM contacts, your finance ledger) is scoped to that product and doesn't leak across.

We use a small set of infrastructure providers:

• Supabase — auth, database, file storage.
• Marzpay — payment processing for plan upgrades.
• Vercel — hosting and CDN for the Soko applications.

None of these resells your data. Each is contractually a processor acting on our behalf.

You can export, edit, or delete your account-level data from Account. Deleting your account cascades and removes everything we hold, across every product, in a single transaction.

Each product has its own privacy notice covering the data that product collects in operation — see the marketplace privacy policy as an example. By using a product you agree to both notices.

Privacy questions or data requests? Reach us at +256 778 087 986 on WhatsApp.