Privacy Policy
Last updated 16 October 2026
This policy explains what Onesmus collects, why, who sees it and what choices you have.
1. Who we are
Onesmus is point-of-sale, inventory and online-store software operated by the business named under Contact. For the information a merchant enters about its own customers, the merchant decides why and how it is used and Onesmus processes it on the merchant's behalf. For merchant account details, Onesmus decides how the information is used.
2. Information we collect
Account details: name, email address, username, business name and a password that is stored only as a salted hash. If you sign in with Google we receive your Google account identifier, verified email address and name. Business data you enter: shops, products, stock, orders, customers (name, phone number, email), suppliers, staff and employee records, expenses and income. Payments: payment references, amounts and status from our payment provider. We never see or store card numbers or mobile-wallet PINs. Store visitors: when someone orders from an online store we receive the name, phone number and optional email they type, and the basket they place. Security and technical data: IP address, device and log information used for sign-in protection, rate limiting and fault finding.
3. How we use it
To provide and secure the service; to authenticate users and protect accounts (including two-step verification); to process orders, payments, refunds and subscriptions; to send service messages such as verification codes, password resets and billing notices; to detect abuse; and to meet legal obligations. We do not sell personal information and we do not use it for third-party advertising.
4. Who receives it
Service providers that are needed to run Onesmus: hosting and database providers, the payment provider that collects mobile-money payments (Paynow), our email and SMS delivery service, and Google when you choose Google sign-in. They receive only what they need and may only use it to provide their service. Each merchant's data sits in its own isolated area and is not visible to other merchants. We may disclose information where the law requires it.
5. Cookies and similar storage
Onesmus does not use advertising or analytics cookies. To keep you signed in, your browser stores a short-lived access token and a refresh token in local storage; they are removed when you sign out. Online stores keep your basket in local storage on your device.
6. How long we keep it
Account and business data is kept while your account is active. When you close your account your sign-in details are erased immediately; business data is held for 30 days so it can be recovered if you change your mind, then permanently deleted. Records we must keep for tax, accounting or dispute reasons are kept for the period the law requires. Verification codes and reset links expire within hours and are stored only as hashes.
7. Security
Data is encrypted in transit; passwords are hashed with a strong one-way function; two-step verification secrets are encrypted at rest; refresh tokens rotate and are revoked when a password changes; failed sign-ins lock the account temporarily. No system is perfectly secure. If a breach affects your information we will tell the affected account holders and the regulator as the law requires.
8. Your rights
You may ask to see, correct or delete the personal information we hold about you, object to or restrict certain processing, and withdraw consent you have given. You can change many details yourself in the app, and you can close your account from Security settings. If you are a customer of a merchant using Onesmus, please contact that merchant first; we will help them respond.
9. Children
Onesmus is for businesses and is not directed at children under 16, and we do not knowingly collect their personal information.
10. International transfers
Some providers may process data outside Zimbabwe. Where that happens we rely on contractual safeguards that require protection comparable to this policy.
11. Changes
We will update this page when our practices change and change the date above. For significant changes we will notify account holders in the app or by email.
Contact
Onesmus. Questions about your data or these terms can also be raised through the support option in your account.