Legal

Privacy & Cookie Policy

Effective 12 September 2026 · ILO FLOW is operated by Finotech Solutions LLP, Kenya

This policy describes exactly what ILO FLOW collects, why, and what we do not collect. It is written to be read rather than to be defensible, so it says where your data goes in plain terms.

1. Who we are

ILO FLOW is an interactive accounting-education product operated by Finotech Solutions LLP ("we", "us"), a limited liability partnership in Kenya. Finotech Solutions LLP is the data controller for the personal data described here.

For anything in this policy, write to finotechsolutionsllp@gmail.com.

2. What we collect

ILO FLOW is usable without an account. What we hold depends on how you use it, and the table below is the complete list.

Data	When	Where it is stored
Learning progress — which missions you completed, your answers, mistakes, XP, streak, level and mastery scores	As you learn, whether signed in or not	In your browser while you are a guest. On our servers once you create an account, so it survives a lost device
Account details — username, email address, a one-way hash of your password, display name, chosen tutor	Only if you create an account	Our database
Subscription status — free or premium, and when premium expires	Only if you buy Premium	Our database
Payment records — amount, currency, provider, provider reference, status, and the phone number you enter for M-Pesa/KCB	Only when you make a payment	Our database. Card and M-Pesa PIN details are entered on the provider's own systems and never reach us
Device sign-in tokens — a random token per signed-in mobile device, its type and expiry	Only if you sign in on the mobile app	Our database, so you can sign a device out remotely
Technical request data — IP address, timestamp, requested URL and error details in server logs	Every request, as with any website	Server logs, kept short-term for security and debugging
Your settings — sound, animation, reduced motion, notification and mentor-voice preferences	When you change one	Your browser, and our database if you have an account

3. What we never collect

We do not ask for, receive or store: your card number, CVV, bank credentials or M-Pesa PIN; your national ID or KRA PIN; your location; your contacts; your microphone or camera. The mentor's voice is produced by your own device's speech engine — nothing you say is recorded, and ILO FLOW never requests microphone access at all.

We also do not use what you learn here to target advertising. Your mistakes, scores and answers are never shared with an advertiser.

4. Why we process it

To run the product — showing you the right next lesson, keeping your progress, and signing you in. Without this there is no service to provide.
To honour a purchase — recording that you paid, and for how long, so Premium unlocks. This is necessary to perform our contract with you.
To keep accounts safe — rate limiting sign-in attempts, detecting abuse, and keeping short-lived logs. This is our legitimate interest in a service that is not trivially broken into.
To show advertising on the free plan — only on the basis of your consent, which you can change at any time (see section 6).
To meet legal and tax obligations — payment records are kept because Kenyan law requires it.

5. Cookies and local storage

ILO FLOW uses very few cookies, and none for tracking you across other websites.

sessionid — set only when you sign in. It is what keeps you signed in. Removing it signs you out.
csrftoken — a security cookie that proves a form was submitted from this site and not forged by another one.

Both are strictly necessary and are set without consent, which the law permits for exactly this category. Neither is used for advertising or analytics.

We also use your browser's local storage — not a cookie, and never sent to a server on its own — to hold your guest learning progress, your interface preferences, and your advertising choice from section 6. Clearing your browser data clears all of it.

If advertising is switched on and you agree to it, Google sets its own cookies and identifiers. Those are described next.

6. Advertising

The free plan is funded by advertising supplied by Google AdSense. Premium subscribers see no advertising at all.

Three things are worth stating plainly:

Nothing loads before you choose. Google's advertising code is not requested, and no advertising cookie is set, until you have answered the consent prompt. Declining is a real option, not a formality.
You can choose non-personalised ads. These are based on general context rather than a profile of you. The free plan is identical either way — nothing is withheld for declining.
No ads inside a lesson. Advertising appears only at the bottom of the Home page and the About Finotech Solutions LLP page. It is never placed in Business World, Journal Practice, Error Hunter, Learner Testing, Academy or the tutor screens, so it can never interfere with learning or be mistaken for part of a lesson.

As a third-party vendor, Google uses cookies to serve ads based on your prior visits to this and other websites. You can opt out of personalised advertising across the whole web in Google's My Ad Center, independently of your choice here. Google's own handling of that data is described in the Google Privacy & Terms partner-sites notice.

Changing your mind: at any time. Your previous answer is discarded and nothing further is requested from Google until you answer again.

We do not sell personal data. It reaches a third party only in these cases:

Payment providers — KCB (M-Pesa / BUNI) and PayPal receive what they need to take a payment. They are independent controllers for that transaction under their own policies.
Google — advertising, on the free plan, with your consent, as described above.
RevenueCat — if you subscribe inside the mobile app, this is the service that validates the store receipt.
Our email provider — delivers password-reset messages.
Hosting and infrastructure — operates the servers this runs on.
Authorities — only where we are legally compelled, and only what is compelled.

8. How long we keep it

Learning progress — for as long as your account exists. It is the record of what you have learned, and deleting it early would lose your history for no benefit to you.
Account details — until you delete your account.
Payment records — seven years, as Kenyan tax and accounting law requires. These outlive account deletion by necessity.
Server logs — short-term, for security and debugging.
Guest progress — in your browser only, until you clear your browser data. We cannot see it and cannot delete it for you.

9. Your rights, and how to use them

Under Kenya's Data Protection Act, 2019 — and under the GDPR if you are in the EEA or UK — you may ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or object to processing based on our legitimate interests. You may also withdraw consent for advertising at any time, and withdrawing it does not affect anything done beforehand.

Two of these you can do yourself, immediately, without asking us:

Delete your account — from account settings in the app. It asks for your password and an explicit confirmation because it cannot be undone.
Withdraw advertising consent — .

For anything else, email finotechsolutionsllp@gmail.com. We answer within 30 days. If you are not satisfied, you may complain to the Office of the Data Protection Commissioner in Kenya, or to your own supervisory authority if you are in the EEA or UK.

10. Children

ILO FLOW teaches accounting and is intended for learners aged 16 and over. We do not knowingly collect personal data from children under 16. Advertising on this site is never targeted at children, and we do not request an age or date of birth — so if you believe a child has created an account, tell us at finotechsolutionsllp@gmail.com and we will delete it.

11. Security

Passwords are stored only as one-way hashes and cannot be read back by us or by anyone who obtains the database. Traffic is encrypted with HTTPS and the site is served under a Content Security Policy that limits what a browser may execute. Sign-in attempts are rate limited. Sign-in and password-reset responses are deliberately identical whether or not an account exists, so that the site cannot be used to discover who has one.

No system is perfect. If you find a security problem, please report it to finotechsolutionsllp@gmail.com before disclosing it publicly, and we will work with you.

12. Changes to this policy

If we change how we use your data in a way that affects you, we will update the effective date above and, for a material change, ask again rather than assume your previous answer still holds.

13. Contact

Finotech Solutions LLP, Kenya
Privacy: finotechsolutionsllp@gmail.com
General: finotechsolutionsllp@gmail.com
More ways to reach us: contact page