Privacy Policy

1. What we collect

• Sellers: name, business name, email, phone, town, and the content of your listings (including photos). Your password is stored only as a strong one-way hash, so we cannot read it.
• Buyers: when you reserve a car or buy parts we collect your name and M-Pesa phone number, nothing else, and you never need an account. If you report a listing, your phone number is optional.
• Payments: transaction metadata from our payment provider: amount, M-Pesa receipt number, and the phone number charged. We never see or store your M-Pesa PIN.
• Technical: standard server logs (IP address, request time, page requested) kept for security and debugging. We run no analytics trackers and no advertising pixels.

2. Why we collect it (lawful basis)

To run the marketplace you asked us to run: publishing listings, processing M-Pesa payments, holding reservations, and connecting buyers with sellers (performance of a contract); verifying sellers and reviewing reports (legitimate interest in a safe marketplace); and keeping records the law requires us to keep (legal obligation). We do not sell personal data, and we do not use it for advertising.

3. Who sees your data

• Sellers see buyers: when your payment for an order or reservation settles, the seller receives your name and phone number so they can complete the sale. That is the whole point of the transaction. But it only happens after payment, never for browsing.
• Buyers see sellers: a seller's public profile shows their chosen name, town, and contact numbers.
• Service providers: our payment provider processes M-Pesa transactions; our hosting provider stores the data. Both act on our instructions.
• Authorities: we disclose data when Kenyan law genuinely requires it, for example a court order in a stolen vehicle investigation.

4. Cookies and local storage

We set one cookie: ab_token, an essential session cookie that keeps sellers and staff logged in. It expires after 12 hours. Your shopping cart is kept in your own browser's local storage and never leaves your device until you check out. There are no analytics, advertising or third-party cookies, which is why our cookie notice is a notice, not a twelve-toggle consent maze.

5. How long we keep data

Seller accounts and listings: for the life of the account, then deleted on request (transaction records are retained as required for tax and legal purposes). Buyer order details: 7 years, in line with Kenyan commercial record-keeping practice. Reports on listings: 2 years. Server logs: 90 days.

6. Your rights

Under the Data Protection Act, 2019 you can:

• ask what data we hold about you and get a copy;
• correct data that is wrong;
• ask us to delete your data (we will, except records the law obliges us to keep);
• object to processing or ask us to restrict it;
• complain to the Office of the Data Protection Commissioner (odpc.go.ke) if you believe we've mishandled your data.

To exercise any of these, email [email protected] and we respond within 14 days.

7. Security

All traffic is encrypted (HTTPS). Passwords are hashed with bcrypt. Payment credentials live with the payment provider, not with us. Access to production data is limited to staff who need it and every administrative action is attributable to a specific account. No system is unbreakable; if a breach ever affects your data we will notify you and the Commissioner as the Act requires.

8. Changes and contact

Material changes to this policy are announced on the site with a new effective date. Questions: [email protected]. See also our Terms of Service.