Privacy Policy

Workfola is operated by Belasoft Solutions ("Workfola", "we", "us"). This policy explains how we collect, use, and protect data when a business ("your company") signs up for Workfola, and when that company's own staff use it as employees. If you're an employee using Workfola because your employer has set it up, your employer controls your account and data as the data controller; we act as the processor on their instructions.

Depending on which modules your company subscribes to, Workfola may process:

• Account and contact information (name, email, phone, role) for anyone your company adds as a user.
• Employment data: job history, compensation, leave and attendance records, performance reviews, documents you or your employer upload (contracts, certificates, identity documents).
• Payroll and financial data: salary components, statutory deductions, bank/M-Pesa details used to run payroll and disbursements, invoices, and accounting records.
• Customer and operational data your company enters: CRM contacts, inventory, point-of-sale transactions, support tickets, and similar business records.
• Technical data needed to run the service: login timestamps, IP address for security/rate-limiting, and device/browser information.

We do not run third-party advertising or analytics trackers on Workfola. Sign-in uses a token stored in your browser's local storage, not tracking cookies.

• To provide the modules your company has subscribed to (HR, payroll, accounting, CRM, inventory, and the rest of the platform).
• To process payments and payroll disbursements through our payment processors (M-Pesa via Safaricom's Daraja API, and Binance Pay for crypto checkout where enabled).
• To send transactional notifications (email and SMS) your company configures — payslip availability, leave approvals, ticket updates, and similar.
• To secure the platform: detecting abuse, enforcing rate limits, and investigating incidents.
• To provide support when your company's admins or users contact us.

Workfola is multi-tenant: many companies use the same platform, but every record is scoped to the company that created it and enforced on our servers, not just hidden in the interface. One company's employees, payroll, financials, and customer data are never visible to another company.

• Your own company's authorized users — the people your company's admins grant access to, per the roles they're assigned.
• Payment processors — Safaricom (M-Pesa/Daraja) and Binance Pay, only for the transaction data needed to process a payment or disbursement your company initiates.
• Infrastructure providers — our hosting and email/SMS delivery providers, acting strictly on our instructions to run the service.
• We do not sell personal data, and we do not share it with advertisers.

We keep your company's data for as long as your company's account is active, plus a reasonable period afterward in case of reactivation or a legal obligation to retain records (e.g. payroll and tax records under Kenyan law). We run automated daily encrypted backups of the production database with a 14-day retention window, used solely for disaster recovery.

Access to the platform requires authentication, and sensitive actions are role-gated. Passwords are hashed, not stored in plain text. We run regular dependency and vulnerability audits and patch findings as part of our ongoing security process. No system is perfectly secure, and we encourage your company's admins to use strong, unique passwords and remove access promptly when someone leaves.

If you're an employee whose employer uses Workfola, requests to access, correct, or delete your personal data should generally go through your employer first, since they control the account. If your employer is unable to assist, or if you're contacting us directly as a registered company admin, email us at belasoftsolutions@gmail.com and we'll respond within a reasonable time.

To request deletion of your personal data, email belasoftsolutions@gmail.com with the subject line "Data deletion request" and the email address or account you used. We'll verify the request and confirm once it's complete, generally within 30 days.

If you connected a Facebook Page or Instagram account to Workfola for social media publishing, this also removes the access token and any cached Page/Instagram account data we stored for that connection. You can also revoke Workfola's access directly from your Facebook account at Settings & Privacy → Business Integrations — this removes our access on Meta's side immediately, independent of our own deletion process.

If you're an employee whose employer uses Workfola, see "Your rights" above — your employer controls the account and should generally be your first point of contact.

We'll update this page when our practices change, and update the "last updated" date above. For material changes affecting how your company's data is handled, we'll make a reasonable effort to notify account admins directly.

Questions about this policy or how your data is handled: belasoftsolutions@gmail.com, or via our Support page.