Privacy policy

CoreSync and CoreSync Team apps · Effective 4 November 2026

CoreSync is a platform internet service providers ("ISPs") use to run their customers' accounts. It is built and operated by Avitech Cloud Services, the trading name of Avitech Solutions Ltd, a company registered in Kenya ("Avitech", "we"). This policy covers two apps:

CoreSync: for customers of an ISP that uses CoreSync, to manage their home internet or hotspot Wi-Fi.
CoreSync Team: for that ISP's staff (technicians, support, sales and administrators).

The short version

Your internet account belongs to your ISP. The apps show you, or the ISP's staff, what CoreSync already holds for that account.
The data is stored on CoreSync servers on Avitech's own network in Kenya.
The apps contain no advertising, analytics, crash-reporting or tracking code. We never sell your data.
The CoreSync app never uses your location, contacts, camera or microphone.

Who is responsible

Your ISP decides what it records about your account and why. For that data it is the data controller, and Avitech processes it for the ISP. Avitech is responsible for the apps themselves and for the CoreSync platform they connect to. If you are unsure who your ISP is, it is the provider you picked when you first opened the CoreSync app.

The CoreSync app (customers)

Signing in

You choose your provider, then enter the account number on your bill. Your ISP texts a one-time code to the phone on the account. After you sign in, a sign-in token is kept on your phone so you stay signed in. It is removed when you sign out, or when it expires under your ISP's settings. We don't use passwords for customers.

What the app shows and uses

Account details from your ISP: name, phone number, email, account number, plan, price and paid-up date.
Payments and invoices: amounts, dates and payment references.
Usage: data used, connection times and the IP address your connection was given, as recorded by your ISP's network.
Support requests you create in the app and their status.
Hotspot Wi-Fi, if you use it: the phone number you pay with, the bundles and vouchers you bought, and the devices (by hardware address) using a bundle.

Paying

When you pay, CoreSync asks your ISP's mobile-money provider (for example Safaricom M-Pesa) to send a payment prompt to the number you enter. You approve the payment on your phone. The app never sees your M-Pesa PIN. The payment provider handles the payment under its own privacy policy, and CoreSync records the result on your account.

My router

If your ISP offers it, the app can show and control the router your ISP installed:

Signal level on your fibre line.
Wi-Fi name and password. A new password is sent to your router through your ISP's management system and is not shown back in the app.
Connected devices: the names, hardware addresses and local IP addresses of devices on your home network, as reported by your router when you open that screen. They are only shown to you.
Speed test and restart, when you ask for them.

Speed test on your phone

"Test on this phone" downloads test data from Cloudflare (speed.cloudflare.com) to measure your connection. Cloudflare sees your IP address for that download, under its own privacy policy.

Safe browsing

If your ISP offers Safe browsing and you switch it on, the web addresses (domain names) that devices on your home internet look up are checked against the categories and sites you chose to block. We keep your settings and simple counts, such as how many requests were blocked today. We don't use the addresses you visit for anything else, and we don't sell or share them.

Demo

"Try the demo" uses made-up sample data stored inside the app. Nothing you do in the demo is sent anywhere.

The CoreSync Team app (ISP staff)

Sign-in: staff sign in with their company code, email and CoreSync password. A sign-in token is kept on the device until they sign out or it expires.
Customer data: staff see the customer accounts, tickets, leads and network status their role at the ISP allows. They see them for the purpose of serving those customers, under the ISP's own rules.
Location: used only when a staff member taps "I've arrived", checks coverage at their current spot or saves a sales lead. The position is sent to the ISP's CoreSync account at that moment. The app asks for permission the first time and does not track location in the background.
Directions and messages: "Directions" opens the job's location in Google Maps, and WhatsApp buttons open WhatsApp. Those apps handle the data under their own privacy policies.
Camera and photos: used only when a staff member adds a photo to a job. The photo is attached to that ticket.

Who else receives data

Your ISP, which holds your account.
Payment providers such as Safaricom M-Pesa, for payments you make.
SMS providers, to deliver sign-in codes and messages from your ISP.
Cloudflare, for the phone speed test and for our websites' domain names.
Authorities, only when Kenyan law requires it.

We don't sell personal data and we don't share it for advertising.

How long data is kept

Your ISP decides how long your account records are kept. Sign-in codes expire within minutes. Sign-in tokens on your phone are deleted when you sign out or uninstall the app. Technical logs on CoreSync servers are kept only as long as needed to run the service, fix problems and protect against abuse.

Deleting your data

Your account is created and closed by your ISP: contact them to close it and have your records deleted. To remove the app's data from your phone, sign out (Help → Account) or uninstall the app. You can also email us at support@avitechcloud.com. We'll help, or pass your request to your ISP if it is theirs to handle.

Security

The apps only connect to the CoreSync API (coresyncapi.avitechcloud.com) over encrypted connections, plus Cloudflare for the phone speed test. Access to CoreSync servers is limited to staff who need it, and every action staff take in CoreSync is permission-checked.

Your rights

Under Kenya's Data Protection Act, 2019 you can ask to see the personal data held about you, have it corrected or deleted, and object to how it is used. Ask your ISP, or email us. If you're not satisfied, you can complain to the Office of the Data Protection Commissioner (odpc.go.ke).

Children

The apps are for an ISP's account holders and staff, not for children under 18. Safe browsing lets parents filter what children can reach on the home internet. The children themselves don't use the app.

Changes

If we change this policy, we'll update this page and the effective date above. For significant changes, we'll also say so in the apps.

Contact

Avitech Cloud Services (Avitech Solutions Ltd), Nairobi, Kenya · support@avitechcloud.com