Privacy Policy

Last updated: 7 October 2026

OTO is business software made by Kapp Microsystems ("Kapp", "we", "us"), KK 565 St, 1st Floor 1F29, Kigali, Rwanda. This policy explains what personal data OTO handles, why, who it is shared with, and the choices you have. It covers the OTO web apps (POS, Frontdesk, Inventory, Backoffice), the OTO mobile app for iPhone and Android, OTO Box on Windows and macOS, and this website, otocloud.io.

1. Who is responsible for your data

Businesses use OTO to run their sales, stock, hotels and accounts. When a business records information about its own customers, guests, suppliers or staff in OTO, that business decides what is recorded and why; Kapp stores and processes it on the business's behalf and only to provide OTO to them. Questions about those records are best sent to the business first; we will help them answer.

Kapp is responsible for the data we collect for our own purposes: the accounts of people who sign in to OTO, our billing of the businesses that use it, messages sent through our contact forms, and visits to this website.

2. What we collect

Account details. For each person who signs in: name, username, email address, role in the business, the business they belong to, and a password (stored only in a form that cannot be read back). We record when people sign in and the actions they take that the business must be able to account for, such as payments, cancellations and refunds.

Business records. What a business enters while it works: sales, bills, orders, payments, discounts, cancellations, stock, purchases, invoices, bookings and accounting entries. These can include details of the business's customers or guests: name, phone number, email address, postal address, tax identification number (TIN), the RRA purchase code for a business receipt, and, for hotel guests, identity document details where the law requires them.

Device details. To register a phone or computer as a till, the OTO mobile app and OTO Box create an installation identifier and read the device's own identifier (on iPhone, the identifier Apple gives each app maker; on Android, the Android ID). They are sent with each request so that sales are filed under the right till and machine code. They are not used to follow you across other apps or websites.

Messages to us. When you use the contact form on this website or write to us: your name, email address, phone number and message.

Usage information. On this website, Google Analytics records pages visited, the device and browser, and an approximate location, using cookies. In the OTO web apps, we measure which screens and buttons are used, so we can find what is slow or confusing, and record errors so we can fix them. The OTO mobile app does not include analytics or advertising tools.

3. What the mobile app does on your phone

• Camera: only to scan product barcodes and the pairing code shown by OTO Box, and only when you open the scanner. Pictures are not stored or sent anywhere.
• Local network: only to reach the computer running OTO Box on the business's own Wi-Fi, to print receipts and kitchen tickets.
• Storage on the phone: your sign-in, the printer pairing and the sale in progress are kept in the phone's secure storage; the product list is kept so it opens quickly. Signing in to another business removes the previous business's products.
• The app does not use your location, contacts, photos or microphone, and it does not track you.

4. Why we use it

• To provide OTO: signing people in, recording sales and stock, printing receipts, filing sales with the tax authority, and keeping each business's records available to it.
• To meet legal obligations, in particular electronic billing (EBM) and tax record-keeping in Rwanda.
• To keep OTO secure and working: preventing misuse, finding and fixing faults, and restoring data from backups.
• To support the businesses that use OTO and answer messages.
• To improve OTO, using usage information.

We do not sell personal data, and we do not use it for advertising.

5. Who we share it with

• Rwanda Revenue Authority (RRA). For businesses that issue EBM receipts, each sale and refund is sent to RRA through its electronic billing system, as the law requires. A business receipt includes the buyer's TIN and purchase code.
• Service providers that work for us under contract: cloud hosting and backups, email delivery, Google (website analytics, and reCAPTCHA to keep spam out of our forms), and the tools we use to measure use of the web apps and record errors. They may only use the data to provide their service to us.
• Authorities when the law requires it.
• Within a business: people who sign in to a business see that business's records, according to the role the business gives them.

6. How we protect it

Each business's records are kept in a database of its own. Connections to OTO are encrypted (HTTPS). Access inside a business depends on the role it gives each person, and sign-ins expire. Data is backed up regularly. No system is perfectly secure; if a breach affects your personal data, we will tell the business concerned and the authorities as the law requires.

7. How long we keep it

Business records are kept while the business uses OTO, and afterwards for as long as Rwandan tax and accounting law requires such records to be kept. Sales filed with RRA cannot be deleted, only cancelled with a refund, because they are tax records. Accounts are kept while the person works for the business; the business can deactivate them at any time. Messages sent to us are kept for as long as needed to deal with them.

8. Your rights

You can ask to see the personal data held about you, to correct it, to have it deleted where the law allows, to object to or restrict its use, and to receive it in a usable form. Some records cannot be deleted while tax law requires them to be kept.

If you are a customer or guest of a business that uses OTO, ask that business first; it controls those records. For your OTO account, or anything Kapp holds for its own purposes, contact us below.

9. Children

OTO is software for businesses and is not meant for children. We do not knowingly collect personal data from children.

10. Changes to this policy

When this policy changes, we will update the date at the top of this page, and tell the businesses that use OTO about important changes.

11. Contact us

Kapp Microsystems, KK 565 St, 1st Floor 1F29, Kigali, Rwanda
Email: info@kapp.rw
Phone: +250 788 383 590
Or use our contact form.