This policy explains how Juuhudi Technologies ("we", "us") handles personal data when you use our marketplace (juuhudi.co.ke). We are the data controller for this processing, and we handle personal data in accordance with the Data Protection Act, 2019 (Kenya).
Trust is our product. That applies to your data too: we collect what the Service needs to work and keep you safe, we don't sell it, and we tell you plainly what happens to it.
1. What we collect
Information you give us:
- Identity & profile: name, username, profile photo, bio, general location (e.g. "Westlands, Nairobi").
- Contact: email address, phone number.
- Verification data: one-time codes sent to verify your phone number (we store a hashed code temporarily, never in plain text).
- Listings: photos, descriptions, condition, prices, and item locations you publish.
- Messages: conversations you have with other members on the Service.
- Reports & reviews: reports you file and reviews you write.
Information created when you use the Service:
- Transaction records: credit purchases (amount, bundle, M-Pesa receipt number, the phone number used to pay), credit spending, exchange confirmations. We never see or store your M-Pesa PIN.
- Activity data: listings you view and save, response activity, moderation history.
- How you found us: when you sign up, we record how you found Juuhudi (campaign tags and landing page) on your account.
- Technical data: device and browser information, IP address, and log data used for security and to operate the Service.
Information from third parties:
- Google, if you sign in with Google: your name, email address, and profile photo.
- M-Pesa, when you buy credits: payment confirmation details.
2. Why we process it (and the legal basis)
- To provide the Service — accounts, listings, messaging, credits, notifications (performance of a contract).
- To keep the marketplace safe — verifying phone numbers, moderating listings, investigating reports and suspected fraud, enforcing our Terms (legitimate interests in a safe, trusted marketplace; and legal obligation where applicable).
- To communicate with you — transactional emails and SMS about your account, listings, and purchases (performance of a contract); marketing communications only with your consent, which you may withdraw at any time (consent).
- To comply with the law — keeping records required for tax, accounting, and lawful requests (legal obligation).
- To improve the Service — aggregated, de-identified usage analysis (legitimate interests).
3. What other members can see
Your public profile shows: your name, username, photo, general location, join date, verification badges, active listings, sold-item history, exchange count, and reviews.
Your phone number and email address are never shown publicly and are never shared automatically with other members. Whether to share contact details with someone you're transacting with is always your choice.
Messages are visible only to the two participants in a conversation. Our staff do not read messages in the ordinary course; access is limited to safety and fraud investigations (for example, reviewing a reported conversation) and every such access is logged and auditable.
4. Who we share data with
We do not sell personal data. We share it only with:
- Service providers (processors) who help us run Juuhudi under contract — for database and storage hosting, application hosting, network security, email delivery, SMS delivery, mobile-money payment processing, product analytics, and measuring our advertising.
- Authorities, where required by law or a valid legal process, or where necessary to prevent fraud or harm.
- A successor entity, if we undergo a merger, acquisition, or asset sale — under this policy's protections.
We use Cloudflare Turnstile to protect our sign-in, sign-up, and password-reset forms from bots and automated abuse. To distinguish real people from bots, Turnstile may process device and browser signals and your IP address. Cloudflare handles this data as described in its Turnstile Privacy Addendum.
5. International transfers
Some of our providers store data outside Kenya (including in the European Union and the United States). Where personal data is transferred outside Kenya, we do so in accordance with the Data Protection Act's cross-border transfer requirements, using providers with appropriate safeguards and security certifications.
6. How long we keep it
- Account data: for as long as your account exists.
- Messages: for the life of the conversation, retained as a safety record.
- Transaction and credit records: up to seven (7) years, as required for accounting and tax purposes.
- OTP codes: minutes — deleted on verification or expiry.
- After account deletion: see below.
7. Your rights
Under the Data Protection Act, 2019, you have the right to:
- access the personal data we hold about you;
- correct inaccurate or incomplete data (most profile data you can edit yourself in Settings);
- delete your data (right to erasure);
- object to or restrict certain processing;
- data portability, where applicable;
- withdraw consent at any time, where processing is based on consent.
To exercise any right, email privacy@juuhudi.co.ke.
Deleting your account. You can ask us to delete your account from Settings → Delete account, or by emailing privacy@juuhudi.co.ke. You can cancel a request from Settings until we process it. We confirm by email once deletion is complete. Account deletion cannot be reversed.
When we delete your account:
- your sign-in is closed, and your profile, photos, listings, contact details and other personal data are erased;
- messages you sent stay in the other member's conversation, shown without your name, so their record of the exchange remains complete;
- reviews you received remain (they are other members' statements about their own experience), and reviews you wrote may remain in anonymised form;
- transaction and credit records are kept for the legal retention period in section 6, then deleted. A payment record includes the phone number the payment was made from, because that is part of the record the law requires us to keep;
- we keep a minimal record that the account was deleted, and when, with no personal details, for security and fraud prevention.
8. Security
We protect personal data with encryption in transit, access controls, row-level database security, audited administrative access to sensitive data, and the principle of least privilege for our systems and staff. No system is perfectly secure; if a breach occurs that puts your rights at risk, we will notify you and the ODPC as the Act requires.
9. Cookies
We use necessary cookies to keep you signed in and to secure the Service. These are always on, as the Service cannot work without them.
We also use analytical cookies to understand how the Service is used so we can improve it, and marketing and advertising cookies to measure our ads and show them to people likely to be interested in Juuhudi listings. Our analytics sets cookies only once you tap Okay on the cookie notice or switch analytics on in Cookie settings. Until then, your visits are counted anonymously, with nothing stored on your device. You can switch analytics or marketing and advertising cookies off at any time in Cookie settings.
Our Cookie Policy explains each type, links to Cookie settings, and explains how to block or delete cookies in your browser. We never sell your data.
10. Age
Juuhudi is for adults aged 18 and over. We do not knowingly collect data from anyone under 18; if we learn we have, we will delete it.
11. Changes
We may update this policy. We will post the updated version with a new effective date and notify you of material changes through the Service or by email.
12. Contact
Data protection contact: privacy@juuhudi.co.ke
General support: support@juuhudi.co.ke
Controller: Juuhudi Technologies (juuhudi.co.ke)