Privacy & Cookies

Raut collects what the platform needs to do its job, and no more. There is no advertising, no profiling and no third-party analytics: the console loads no external scripts, trackers or fonts.

Location is the most sensitive thing Raut handles, so it is worth being precise about it.

At check-in. When a field rep checks in at a customer, the app records the GPS position at that moment, and the server compares it against the customer’s stored pin or the territory boundary. The verdict — verified or not, and the distance — is stored on the visit. This happens only when the rep taps check-in.

Continuous tracking is off by default. A rep may switch on route tracking, which records periodic points: position, accuracy, speed, heading, battery level, and whether the device is moving. The app states plainly whether tracking is on. While it is off, no background positions are recorded.

Location is used to verify that field work happened where it was reported, and to sequence routes by distance. It is never sold, and never shared outside the company that employs the rep.

Raut sets one cookie, and it is strictly necessary. There are no advertising or analytics cookies, which is why the platform shows no consent banner: there is nothing optional to consent to. Refusing the session cookie simply means you cannot sign in.

To operate the service you or your employer signed up for: signing people in, enforcing what each role may see, recording sales and visits, verifying field activity, and keeping an audit trail. We also use it to keep the service secure and to diagnose faults.

We do not use your data to train models, build advertising profiles, or sell to anyone.

Between companies, never. Raut is multi-tenant: every record carries the company it belongs to, and that scope is derived from your signed-in session rather than from anything the browser or app sends. One company cannot read or write another’s data.

Within your company, access depends on your role and on which modules the company licenses. Data leaves the platform only where we are legally required to disclose it, or to the infrastructure provider hosting the service on our behalf.

The platform runs on a virtual private server in Europe. Where the SMS module is enabled, message content and recipient numbers are passed to the SMS provider your company configures.

Operational records — customers, visits, orders, invoices, payments — are kept for as long as the customer company keeps its account. They are that company’s business records, and usually carry their own statutory retention period under tax law.

We do not currently run automated deletion of location history or audit logs; they are retained until the account is closed. If your company needs a defined schedule — discarding location points after 90 days, for instance — contact us and we will configure it.

Traffic is encrypted in transit with TLS. Passwords are stored hashed, never in readable form. Sessions use short-lived access tokens with rotating, device-bound refresh tokens, so a stolen token has a narrow window and a replayed one is refused outright.

No system is perfectly secure. If you believe an account or a record has been accessed improperly, tell us, so we can investigate the audit trail.

Under the Kenyan Data Protection Act 2019 you may ask to access, correct or delete your personal data, to object to or restrict how it is used, and to receive a copy in a portable form. You may also complain to the Office of the Data Protection Commissioner.

Because most data in Raut belongs to a customer company, we normally have to pass such requests to that company as the controller. Approaching them directly is usually quicker.

Tari Africa Platforms Limited, Nairobi, Kenya.
Privacy enquiries: phinetechltd@gmail.com — or use the contact form, which prefills what we need.

If we change how the platform handles personal data, we will update this page and the date at the top.