This document is provided in English. Where a translation exists, the English text is the one that applies.

Privacy Policy

This policy explains what personal data DoroSync collects, why, and what rights you have. The data controller is Kennaa Tech PLC (Anfo 105 Adebabay, Girshe Tulu Bldg, 4th Floor, Addis Ababa, Ethiopia). Contact: [email protected].

What we collect

Account data: your name, email address, phone number if you give one, password (stored only as a salted hash), preferred language, calendar and theme, and the times you sign in. If you choose to sign in with Google, we receive your name and email address from Google.
Organization data: the farm records your organization enters (flocks, production, stock, health events, purchases, sales, expenses, payments, tasks and notes) and the names and contact details of your customers, suppliers and staff as you record them. Your organization is the controller of that data; we process it on its behalf.
Technical data: the IP address and browser of each sign-in, kept with that sign-in until 30 days after it ends; the IP address of each change, kept in the activity log; and the IP address, browser and page of requests in our server logs, which are kept by size and overwritten as new lines are written. We use them for security and to stop abuse.
Activity log: who created, changed, approved or viewed what and when inside an organization, with the values before and after, so corrections are traceable. It is visible to the organization's Managers and above who see every farm, and is kept as long as the organization exists.
Records saved offline: daily records and most day-to-day entries (treatments, egg and stock movements, expenses and purchases, sales and payments, cash, wages, tasks done) typed while a phone has no connection are kept in that device's browser storage until they reach us, and are then removed from the device. Signing out on that device deletes any that have not been sent yet; the application warns you first.

We collect no more than this. There is no advertising, no tracking pixel and no data broker. We count visits to our pages with Cloudflare Web Analytics, which sets no cookies and does not identify you.

Why we process it

To provide the service you signed up for (contract).
To keep the service secure and prevent abuse (legitimate interest).
To send service messages: invitations, sign-up codes, password resets, replies to your Help conversations, and account and billing notices.
To send owners tips and news about DoroSync, which they can stop at any time (legitimate interest). We do not send advertising for anyone else.

Where it is stored and who sees it

Data is stored in our production database on a server rented from Hostinger, and in its nightly backups: kept 14 days on that server, and encrypted before they leave it, up to 6 months with Backblaze. Connections to DoroSync pass through Cloudflare's network, which protects the service from attacks.

It is accessible to the people in your organization according to their roles. Our support staff (the DoroSync Team) see the farm records only:

when an owner lets one of them look, from a Help conversation, to view only or to view and fix, for 1 hour or 24 hours. Everyone in the organization sees a banner while it lasts, the owner can end it at once, and every page they open and every change they make is in the activity log;
to prepare a copy of the data or delete it, when the organization asks; or
where strictly needed to restore the service from a backup or to investigate a security incident, and we then tell the organization what was looked at.

To run billing and support, the DoroSync Team sees the organization's name, contact details, plan and payment status, how many farms, hens, people and records it has, its members' names, email addresses, phone numbers, roles and last sign-in, its Help conversations and the messages we sent it. We do not sell data.

Email is delivered through Resend, text messages through GeezSMS, and Telegram messages through Telegram with your organization's own bot, each only to the destinations your organization sets up. Phone notifications go through your browser's push service (Google, Mozilla or Apple, depending on the device), only for users who allow them. If you sign in with Google, Google knows that you signed in to DoroSync. When you open Learn, our lessons site (learn.kennaa-tech.com, run by us) receives your name, email address and organization name to sign you in.

If your organization turns on the AI-written evening summary for a destination (on plans that include it), that day's farm figures, breed and vaccine names, and the day's notes are sent to Google's Gemini service to write the message, with money totals only if you allow money in that message. The names of your organization, farms, flocks, stock items and owner are replaced by placeholders and put back on our server; other words in a note, including any name typed into it, are sent as written, so do not write people's personal details in notes while it is on. Your customer list, sales records and contact details are not sent. Google may keep what it is sent under its own terms. The feature is off unless you turn it on, and you can turn it off at any time.

Messages we send you

We send the owners of each business notices about their account (the trial ending, renewal, payments received, access paused) by email and, where a phone number is given, by SMS. We also send tips and news (help finishing setup, a reminder when records stop, announcements). Every tips-and-news email has a link to stop them; account notices still come, because they are about the service you use. Our emails record when they are opened, so we can tell whether a message reached you.

How long we keep it

For as long as your organization has an account, including while it is read-only after a trial or paused for non-payment. When an owner asks us to delete it, we delete it within 30 days. Deleted data leaves our backups as they expire: within 14 days on the server and within about 6 months off-site, where it stays encrypted and is used only to restore the service. Sign-in records are deleted 30 days after the sign-in ends.

Your rights

You can see and edit your own profile inside the application and ask us to see, correct or delete your personal data. Your organization can print its reports and download them as CSV files. Once your organization has paid for at least one subscription period, an owner or general manager can ask, from Help or at [email protected], for a complete copy of its data, which we send as a data file within 14 days. Requests go to [email protected] or through Help; we answer within 30 days. If you believe we have handled your data unlawfully, you may complain to the supervisory authority in your country.

Children

The service is for businesses and is not directed at children under 16.

Changes

We will announce material changes inside the application before they take effect.

Last updated: 2026-11-12