Afriboosta Privacy Policy (Kenya)
1. Who we are
1.1 This policy explains what personal data [Afriboosta legal company name] ("Afriboosta", "we", "us") collects through the Afriboosta app, website and related services (the "Platform"), why, who sees it, how long we keep it, and your rights.
1.2 We follow the Data Protection Act, 2019 and its regulations. We are registered with the Office of the Data Protection Commissioner as [data controller and data processor; registration number].
1.3 This policy forms part of our Terms of Service. Words such as "Platform" mean the same here as there.
2. What we collect
| Kind of data | Examples | Where it comes from |
|---|---|---|
| Account | Name, phone number, email, profile photo, country, language | You, at sign-up and in Settings |
| Business profile | Business name, type, location, opening hours, photos, KRA PIN or registration documents for verification | The business owner |
| Business records | Sales, stock, prices, expenses, orders, bookings, suppliers, staff, promotions | The business owner and their staff, and Buddy when you confirm a card |
| Customer records kept by a business | A customer's name, phone, purchases, loyalty stamps, credit owed, bookings | The business that serves the customer (section 10) |
| Credits and rewards | Top-ups, credits used, plan charges, referral rewards, offers in your wallet | The Platform and payment providers |
| Messages | Messages between you and businesses or other users | You and the people you message |
| Photos and voice | Photos you take for Buddy to read (receipts, shelves, invoices); what you say to Buddy | You. Voice recordings are not kept after the answer |
| Location | Your phone's location, only when you allow it, to find nearby businesses and suppliers | Your phone |
| Lender reports and consents | The business summary you agree to share, and your consent record | You and the lender you choose |
| Device and usage | App version, device type, IP address, crash reports, which screens are used | Your phone and our servers |
Identity details, only for the features that need them:
| Feature | What we collect | Why |
|---|---|---|
| Borrower checks | National ID number of the borrower and any guarantor | So the lender knows who it is lending to, with the borrower's consent |
| Vehicle rentals | Driver's date of birth, licence details and a selfie | So the rental business can confirm the driver |
| Age-restricted goods | Date of birth read from an ID document | To confirm the buyer is old enough |
| Phone number disputes | Selfies of the people claiming the number | To settle who owns the number |
| Customer consent | A selfie taken when a customer gives consent at a counter | Proof the customer agreed |
We collect these only when you use the feature, and use them only for the reason shown.
3. Why we use it
| What we do | Lawful basis under the Data Protection Act, 2019 |
|---|---|
| Run your account and the tools you use, keep your records, take plan charges and give rewards | Our contract with you (the Terms) |
| Answer your questions through Buddy, read your photos, suggest prices and actions | Our contract with you |
| Keep the Platform safe: stop fraud, fake accounts, abuse and security attacks | Our legitimate interests, and legal duties |
| Keep tax and payment records, and answer lawful requests from authorities | Legal obligation |
| Identity checks for borrower checks, rentals, age checks and disputes | Your consent, or the contract for that feature |
| Send you marketing messages from Afriboosta | Your consent, which you can withdraw at any time in Settings |
| Improve the Platform and produce figures that identify no one (for example average prices in an area) | Our legitimate interests |
We never sell your personal data, and we never use it to decide something about you that has legal effect without a person able to review it.
4. Buddy and AI
4.1 When you ask Buddy something, send it a photo or speak to it, we send the question and only the records needed to answer it to an AI service provider that works for us under contract. The answer comes back to you.
4.2 Our AI providers may not use your data to train their models and must delete it after a short safety period [confirm against each provider's terms].
4.3 Buddy acts for you only after you tap a confirm button. It never acts on a spoken "yes" alone.
4.4 Voice recordings are turned into text to answer you and are not kept afterwards. We keep the text of your conversation with Buddy so you can scroll back and so we can fix mistakes.
5. Who we share it with
We never sell your personal data. We share it only with:
- Businesses you deal with. A business you buy from, book with or message sees what it needs to serve you: your name, phone, order, booking or messages.
- Lenders you choose. A lender sees a business report or borrower check only with your recorded consent.
- Service providers who work for us under contract: hosting and database, AI, SMS and email, payment and mobile money providers, and crash reporting. They may use the data only to provide their service to us.
- Authorities, where Kenyan law requires it, for example a court order or a lawful request from a regulator. We share only what the request covers.
- A new owner, if Afriboosta is sold or merged. This policy would still protect your data, and we would tell you first.
Business pages, product listings, public reviews and public offers can be seen by anyone using the Platform.
6. Where your data is kept
6.1 On our servers. Our main database is in Singapore, and some service providers (AI, SMS and email) are in other countries. We send data outside Kenya only with the safeguards the Data Protection Act, 2019 requires: a contract that protects it to the Kenyan standard, and only what the service needs. Where Kenyan law requires a kind of data to be processed or kept in Kenya, we keep it in Kenya.
6.2 On your phone. The app keeps a copy of data you have recently opened on your phone, so it keeps working when the network is weak or down. The copy is deleted when you sign out, when someone else signs in on the same phone, and in any case after 7 days. Anyone who can open your phone may see it, so use a screen lock.
7. How we protect it
- Data is encrypted while it travels between your phone and our servers, and while it is stored.
- Each business sees only its own records; database rules block one account from reading another's.
- Only staff who need it for their work can reach personal data, and their access is logged [confirm].
- Identity details (section 2) are shown only to the people and features that need them.
- If a breach puts your data at risk, we tell the Data Protection Commissioner within 72 hours and tell you without delay, as the law requires.
8. How long we keep it
| Kind of data | How long |
|---|---|
| Account and business profile | While the account is open, then deleted within 30 days of closing, except what the rows below require us to keep |
| Business records, credits, plan charges, top-ups and rewards | 5 years after the year they relate to, as Kenyan tax law requires, then deleted or made anonymous |
| Messages | While the account is open, then deleted within 30 days of closing [confirm] |
| Conversations with Buddy (text) | [12 months — confirm] |
| Voice recordings | Not kept after the answer |
| Photos sent to Buddy | [Until the record they belong to is deleted — confirm] |
| Identity details for borrower checks, rentals, age checks and disputes | Only as long as the feature needs them, at most [5 years — advocate to confirm] |
| Consent and acceptance records (including which version of these documents you accepted) | 5 years after the account closes, as proof of what you agreed to |
| Device and usage data | [12 months — confirm] |
| The copy on your phone | Until you sign out, and at most 7 days |
9. Your rights
9.1 Under the Data Protection Act, 2019 you can:
- be told what personal data we hold about you and get a copy of it;
- have wrong or incomplete data corrected;
- have data deleted when we no longer have a lawful reason to keep it;
- object to processing based on our legitimate interests, and to direct marketing at any time;
- withdraw a consent you gave, without affecting what was done before;
- take your data to another service in a common format;
- not be subject to a decision with legal effect made only by a computer.
9.2 Many of these you can do yourself in the app: edit your profile, change marketing choices in Settings, and (business owners) download your records. For anything else, write to [privacy email] or use Help in the app. We may ask you to confirm it is you. We reply within 7 days and act within 30 days.
9.3 Deleting your account. Ask in the app or at [privacy email]. Once we confirm it is you, we delete your account and profile within 30 days. Records the law requires us to keep (section 8) are kept for that period only, then deleted.
10. Business owners and their customers' data
10.1 When a business records its customers (names, phones, purchases, stamps, credit, bookings), the business decides why, and it is the data controller for that data. Afriboosta stores and processes it for the business, as its data processor.
10.2 The business must have a lawful reason for each record, tell customers what it keeps, get consent where the law requires it (for example before sending marketing messages), and answer customers' requests to see or correct their data. We help the business do this.
10.3 A customer who asks us about data a business holds will be referred to that business. If the business does not answer, the customer can come back to us or complain to the Data Protection Commissioner.
11. Children, changes and contact
11.1 Children. The Platform is for people aged 18 and over. We do not knowingly collect data about children. If we learn that we have, we delete it.
11.2 Changes. We will tell you about important changes in the app or by SMS or email at least 30 days before they take effect, and change the date at the top. Where a change needs your consent, we will ask for it again.
11.3 Complaints. Please contact us first and we will try to put things right. You can also complain to the Office of the Data Protection Commissioner at any time.
11.4 Contact. [Afriboosta legal company name], [postal address], Nairobi, Kenya. Data protection officer: [name], [privacy email].