ShivorA Solutions Limited
Privacy Policy
At a glance
A summary for speed. It does not replace the detail below, and where they differ the detail governs.
| Who we are | Shivora Solutions, Lusaka, Zambia — the provider of ClientConnect |
| The most important thing | If your employer gave you ClientConnect, your employer decides what is collected and why. Ask them first; we act on their instructions |
| The most sensitive thing we collect | Your location, in the background, including when the app is closed — but only between checking in and checking out |
| How long location is kept | 12 months, then deleted automatically |
| Can you refuse it? | You can refuse the permission, but you cannot then start a working day — recording visits is what the app is for |
| Do we sell your data? | No. Never, to anyone, for any purpose |
| Do we use it for advertising? | No |
| Where it is held | Ireland — see section 6 |
| Who to contact | support@shivora.co.zm |
Contents
- Who we are
- There are two different situations, and they matter
- What ClientConnect collects
- Why we collect it — and on what legal basis
- Who else receives it
- Where your information is held
- How long we keep it
- Your rights
- How we protect it
- Children
- Changes to this policy
- Contact
1. Who we are
ClientConnect is provided by Shivora Solutions, a business registered in Zambia under the Registration of Business Names Act, Business Registration No. 320261072752.
Address: Plot No. 5998, 6B Chitemene Road, Northmead, Lusaka, Zambia Email: support@shivora.co.zm Phone / WhatsApp: +260 767 022 275
In this policy, “we”, “us” and “our” mean Shivora Solutions. “ClientConnect” means our customer relationship management software, including the mobile app and the web application.
2. There are two different situations, and they matter
ClientConnect is sold to businesses. Most of the people whose information it holds are not our customers — they work for our customer, or they buy from our customer.
When your employer gives you ClientConnect, your employer decides what is collected, who can see it, and why. Your employer is responsible for that information; we hold and process it on their instructions, under a written agreement. If you want your information corrected or deleted, or want to know why something is collected, ask your employer first. We will help them respond, and we will not act on our own initiative on data that belongs to their account.
When you deal with us directly — you visit our website, send a sales enquiry, raise a support request, or your business pays us — we decide what happens to that information, and this policy governs it directly.
3. What ClientConnect collects
3.1 Your account
Your name, mobile number, email address, employee code, job role, profile photo if you add one, and your notification preferences. If you sign in with a mobile number, we create an internal sign-in identifier from that number.
3.2 Your location — please read this section
ClientConnect records location in the background, including when the app is closed or not in use. This is the core of what the product does: it records where field visits happened, how far a person travelled, and how long they spent at each stop, so that work done outside an office can be recorded without anyone having to write it down.
The specifics, plainly:
- Location is recorded only between checking in and checking out. Check out and it stops. If a check-in is left open, it closes automatically at midnight.
- It records when you move, not on a fixed clock — a new point roughly every 25 metres, with a keep-alive roughly every 3 minutes.
- While it is running, Android shows a permanent notification. It is deliberately not hidden.
- We keep location history for 12 months, then it is deleted automatically.
- Your employer, and managers your employer designates, can see your recorded locations, routes, stop times and distances.
- Location is required to start a working day. Recording where field visits happened is what the product is for, so if you refuse the permission you cannot check in. You can change your mind at any time in your phone’s settings.
- But a phone that simply cannot find your position does not stop you. If location is switched on and no fix arrives — indoors, a cold start, no signal — you still check in, and your employer can see that the position was unavailable. Refusing and not being able to are different things, and we treat them differently.
3.3 Photos
Photos you take at a visit, and images of payment proof. They are stored privately and are reachable only through short-lived links issued to people entitled to see them.
3.4 Documents you upload
Enquiries, quotations, purchase orders, delivery notes and invoices. To read the text out of them automatically, we send them to a third-party artificial-intelligence provider — see section 5. These documents usually contain information about your employer’s customers.
3.5 Business records
Customers and contacts, products and prices, enquiries, quotations, orders, deliveries, invoices, payments, targets, tasks, follow-ups and visit plans.
3.6 Technical information
App version, device and operating-system details, crash reports, and how features are used. A notification token so we can deliver push notifications.
3.7 Security records
Sign-in events, administrative actions, and changes to important records, so that a dispute about what happened can be answered.
4. Why we collect it
| Purpose | What it uses |
|---|---|
| Running the service you or your employer signed up for | account, business records, documents |
| Recording field work — visits, routes, distance, time on site | location, photos |
| Reading uploaded documents so figures don’t have to be retyped | documents |
| Reports and analysis for your employer | business records, location |
| Sending notifications and reminders | account, notification token |
| Keeping the service secure and investigating problems | technical, security records |
| Meeting our legal and tax obligations | account, business records |
We do not sell personal information. We do not use it for advertising. We do not share it with anyone except the providers listed below and where the law requires it.
4.1 On what legal basis
Zambia’s Data Protection Act works differently from the European model many privacy policies are copied from. Under section 15(1), personal data may not be processed unless the person has consented, subject to specific exceptions in the Act. We have written this policy against the Zambian Act rather than against a foreign template.
Where you deal with us directly, we rely on your consent, and on the Act’s exceptions where processing is necessary to provide a service you asked for or to meet an obligation the law places on us.
Where ClientConnect was given to you by your employer, your employer is responsible for obtaining your consent and must be able to demonstrate it (section 15(4)). To help them do that, the app records your answer to the location permission request — whether you allowed it or refused it — with the date. Your employer can produce that record.
You can withdraw consent at any time, and object at any time. Two things follow:
- If you withdraw consent, anything collected after that must be destroyed immediately (section 15(7)). Withdrawal does not undo what was lawfully done before it.
- If you object to processing, it must stop (section 15(9)).
Tell your employer, and tell us at support@shivora.co.zm. We will act on it and will support your employer in acting on it. ⚠️ Be aware that some of what ClientConnect records is also a business record your employer must keep — an order, an invoice, a payment. Where that is so, we stop what can be stopped and tell you plainly what must be retained and why, rather than quietly continuing.
4.2 Decisions made automatically
The service analyses your business’s own records to produce reports, prompts and suggestions — for example, that a customer looks overdue for a reorder, or that a payment is late. These are suggestions to a person, not decisions. Nothing in ClientConnect makes a decision about an individual that produces a legal or similarly significant effect without a person deciding it. Where the product uses artificial intelligence, it is to read a document or to phrase a sentence; the figures themselves are computed from your records, never invented.
4.3 Our website
If you only visit shivora.co.zm, we collect far less: what your browser sends in the ordinary course of requesting a page, and anything you choose to send us by email or WhatsApp. There is no contact form and no advertising tracking on the site.
5. Who else receives it
We use the following providers to run the service. Each receives only what it needs.
| Provider | What it receives | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage — all service data | Ireland |
| Google (Firebase Cloud Messaging) | Notification token and message content | Google infrastructure |
| Google (Gemini) | Uploaded documents, for reading text; product descriptions; typed questions | Google infrastructure |
| Geoapify | Approximate coordinates, rounded to about 11 metres, to turn them into a place name. It never receives who you are. | European Union |
| Google Maps | Requests for map imagery | Google infrastructure |
| Sentry | Crash reports and device details | Sentry infrastructure |
| PostHog | How features are used | PostHog infrastructure |
Uploaded documents are sent to Google (Gemini) to extract their text. If we ever change which provider does that, we will update this policy and tell account administrators before the change takes effect. We will not quietly send your documents somewhere else.
6. Where your information is held
ClientConnect’s data is stored in Ireland. Our infrastructure provider offers no data-centre region in Zambia or elsewhere in Africa, so this is a technical necessity of providing the service rather than a preference. Some of the providers listed in section 5 process information in the European Union and the United States.
Transfers of personal data outside Zambia are made in accordance with Part X of the Data Protection Act, and our arrangements with the Data Protection Commission are in place. Each provider is bound by contract to protect the information, to process it only on our instructions and only to provide their service to us, and to maintain security measures no less protective than our own.
Shivora Solutions is registered with the Data Protection Commission of Zambia as a data controller and as a data processor. We will provide our registration details on request.
If you want to know more about the safeguards applying to a particular transfer, ask us at support@shivora.co.zm and we will tell you.
7. How long we keep it
| Information | Kept for |
|---|---|
| Location history | 12 months, then deleted automatically |
| Your account | While your employer’s account is active |
| Business records — orders, invoices, payments | For the life of the account, and afterwards where we must keep them for tax or legal reasons |
| Activity history | Retained as a permanent business record of what was done |
| Crash and usage data | As long as the provider’s standard retention allows |
When an account is closed, we delete or anonymise personal information within a reasonable period, except where a financial or legal record must survive. Where we must keep such a record, we remove the personal details from it rather than keeping it intact.
8. Your rights
Zambia’s Data Protection Act gives you these rights by name. They are not a courtesy:
| Your right | What it means | In the Act |
|---|---|---|
| Access and notification | See what is held about you, and be told what is being done with it | section 58 |
| Rectification | Have it corrected if it is wrong | section 59 |
| Erasure | Have it deleted | section 60 |
| Objection | Object to processing — and it must then stop | section 61, section 15(9) |
| Restriction | Have its use limited rather than deleted | section 63 |
| Portability | Receive a copy in a portable, machine-readable form | section 65 |
| Compensation | Claim compensation for damage caused by a contravention | section 72 |
| Withdraw consent | At any time; anything collected afterwards must be destroyed immediately | section 15(6), 15(7) |
Exercising these rights is free, and we will not treat you any differently for having done so. We may charge a reasonable fee only for a request that is manifestly excessive or repetitive, and we will tell you before we do.
If ClientConnect was given to you by your employer, send your request to your employer. They decide what happens to information in their account, and we are obliged to act on their instructions. We have built tools that let them export or erase an individual’s data, and we will help them use those tools.
If you deal with us directly, email support@shivora.co.zm. We will respond within the period the law requires. We may need to verify who you are before we act.
You also have the right to complain to the Data Protection Commissioner in Zambia.
9. How we protect it
The separation of one business’s information from another’s is the control we treat as absolute.
Your business’s information is isolated from every other business’s. That separation is enforced by the system itself on every single request, not by each screen remembering to ask. It is not something a mistake in one part of the product can switch off, and it is tested continuously as part of how we release.
Inside your account, people see only what their job requires. A field representative cannot reach pricing or credit information; a sales representative cannot reach another’s confidential commercial terms. These limits are enforced at the point the information is retrieved, so they hold no matter which part of the product asks.
Access to your account is protected. Sign-in requires a password meeting a minimum strength, passwords issued or reset must be changed on first use, two-factor authentication is available and can be required for privileged roles, and sessions can be revoked immediately if a device is lost.
Your files are private. Photographs, documents and payment proofs are never publicly addressable. They are released only through short-lived links issued to a person already entitled to see them, and those links expire.
Information is encrypted in transit and at rest, and backups are held encrypted with point-in-time recovery.
Administrative actions, sign-in events and changes to important records are logged, so a question about what happened, when, and by whom can be answered rather than guessed at.
People on our side see only what they need. Access is limited to those who require it to support the service, under confidentiality obligations.
If something goes wrong, you will hear it from us. No system is perfectly secure, and we will not pretend otherwise. If a breach occurs that puts your information at risk we will notify the affected account administrators without undue delay, and the regulator as the law requires, with what we know, what it means and what we are doing about it — rather than a reassurance while we work it out.
Your part matters too. Keep credentials confidential, use two-factor authentication where it is offered, remove people who leave, and tell us promptly if you believe an account has been compromised.
10. Children
ClientConnect is workplace software. It is not intended for anyone under 18, and we do not knowingly collect information from children.
11. Changes to this policy
If we change this policy we will update the version and date above and publish the new version
at https://shivora.co.zm/privacy. Where a change materially affects how personal information is
used — including any change to who receives uploaded documents — we will notify account
administrators before it takes effect.
12. Contact
Shivora Solutions Plot No. 5998, 6B Chitemene Road, Northmead, Lusaka, Zambia support@shivora.co.zm · +260 767 022 275
Version history
| Version | Date | What changed |
|---|---|---|
| 1.0 | 21 August 2026 | First published. |
The current version is always the one at https://shivora.co.zm/privacy. Material changes are
notified to account administrators before they take effect.