Privacy Policy

1. Introduction

This Privacy Policy explains how Shopinn Commerce Limited ("Shopinn," "we," "us," or "our") collects, uses, shares, stores, and protects your personal information when you use our services. This includes:

• Our website at https://shopinn.co.ke
• The Shopinn customer mobile app (iOS and Android)
• The Shopinn merchant, station agent, and rider mobile apps
• Our customer support, communications, and any related services

By using Shopinn, you confirm that you have read this policy and accept our practices described here. If you do not agree, please discontinue use of our services.

2. Who We Are

Shopinn is a Kenyan multi-vendor e-commerce platform connecting customers with independent merchants and a logistics network of station agents and delivery riders. We operate the platform, the apps, and the customer-facing website. Independent merchants list and sell products through our marketplace; we facilitate ordering, payment, fulfilment, and delivery.

For purposes of the Kenya Data Protection Act, 2019 (the "DPA"):

• Data controller: Shopinn Commerce Limited, registered in Kenya.
• Data Protection Officer: reachable at dpo@shopinn.co.ke.
• Registered office: Nairobi, Kenya. Postal correspondence address available on request.

3. Information We Collect

We only collect information needed to operate the marketplace, fulfil orders, process payments, prevent fraud, and meet our legal obligations. Different roles see different data; we describe them below.

3.1 Information you provide directly

• Account information: name, email, phone number, password (stored hashed and salted), date of birth (where required for age verification).
• Profile photo if you choose to upload one.
• Shipping addresses, including geographic coordinates when you select an address on the map for delivery.
• Order details: items purchased, quantities, delivery preferences, special instructions.
• Communications: messages exchanged with merchants and our support team via in-app chat, email, or our contact form. Reviews and ratings you post.
• Bargain offers you submit on listed products.
• Reels and video content if you, as a merchant, upload product videos.
• Identity and compliance documents for merchants, riders, and agents — national ID, KRA PIN, license number, vehicle registration, emergency contact details, banking and M‑PESA payout numbers. These are required to onboard onto regulated parts of the platform (selling, delivering, handling cash on delivery).
• Loyalty and referrals: referral codes you share or redeem, points earned, redemption history.

3.2 Information collected automatically

• Device identifiers: device model, operating system version, application version, language and region, IP address, mobile network carrier.
• Push notification tokens issued by Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM), used solely to deliver push notifications you have opted into.
• Usage and crash data: screens viewed, features used, in-app errors, performance metrics. Used to debug and improve the product.
• Approximate location derived from IP address for fraud prevention.
• Cookies and similar technologies on the website. See Cookies Policy.

3.3 Information from third parties

• Sign in with Google or Apple: if you choose this option, we receive your name, email, and a unique identifier from the provider. We do not receive your password.
• Payment processors (M‑PESA via Safaricom, Paystack) confirm transaction status, receipt numbers, and reference codes. We do not receive your full M‑PESA PIN or full card details.
• Geocoding and maps providers (Google Maps) when you pick an address — they return latitude, longitude, and a formatted address.
• Public reviews of merchants are visible to other customers; that is by design.

3.4 Sensitive personal data

We do not knowingly collect categories of sensitive personal data classified under the DPA (such as health, religion, political views, or biometric identifiers used for unique identification) other than the on-device biometric authentication described in section 8. We do not store fingerprints or face data on our servers.

4. How We Use Your Information

We use the information we collect to:

• Operate the marketplace: create your account, present products, accept and process orders, route orders to merchants and riders.
• Process payments and pay vendors: initiate M‑PESA STK pushes, settle merchant earnings, process rider commission payouts and customer refunds, withdraw to merchant and rider M‑PESA accounts.
• Coordinate delivery: share your name, delivery address, and order contents with the assigned rider, station agent, or pickup hub. Generate one-time pickup OTPs and delivery codes.
• Track orders: tell you and the merchant where the package is in real time; pin the rider's location on a map during the active leg of your delivery only.
• Communicate with you: send order status updates, OTP and delivery codes, account-security alerts, refund and dispute notifications via push notification, email, SMS, and in-app chat.
• Provide customer support: investigate complaints, resolve disputes, and process returns.
• Personalise your experience: show recommended products, recently viewed items, saved addresses, and your wishlist.
• Run loyalty and bargain programmes: apply referral credits, accumulate and redeem points, manage seller-initiated price negotiations.
• Prevent fraud and abuse: detect duplicate orders, payment fraud, account takeover attempts, and policy violations.
• Improve the product: analyse aggregated usage patterns, fix bugs, and design new features. We use anonymised or aggregated data wherever possible for this purpose.
• Comply with legal obligations: respond to lawful requests from authorities, retain transaction records for tax purposes, and meet consumer-protection requirements.

We do not sell your personal information to third parties. We do not run third-party advertising on Shopinn.

5. Legal Basis for Processing

Under the Kenya Data Protection Act, 2019, we process your personal data on the following lawful bases:

• Performance of a contract: almost everything related to operating your account, processing your order, and delivering goods is necessary to perform the contract you enter into when you place an order.
• Consent: for marketing communications, optional features (camera, microphone, location), and analytics cookies. You can withdraw consent at any time.
• Legitimate interest: for fraud prevention, internal product analytics, securing the platform, and responding to legal claims.
• Legal obligation: for tax records, accounting, anti-money-laundering checks, and lawful requests from regulators or courts.
• Vital interest: only in extremely rare circumstances such as protecting the life or safety of a person.

6. How We Share Your Information

We share your data only when needed to deliver our services or when required by law. Specifically:

• Merchants you buy from: receive your name, delivery address, contact phone, items ordered, and any order notes you write. They do not see your payment card details.
• Station agents at our pickup and dropoff hubs: see the tracking number, package destination, and customer name needed to route the package and verify pickup OTPs.
• Delivery riders: see the route, your delivery address with map coordinates, your name, and a short delivery code valid only for the day of delivery. Riders can see your phone number to call ahead. They do not see what is inside the package beyond what is necessary for handling.
• Payment processors: Safaricom (M‑PESA), Paystack. Receive transaction amount, your phone number for STK Push, and unique reference codes. Subject to their own privacy policies.
• Cloud and infrastructure providers: Vercel (web hosting), Render or equivalent (API hosting), Neon (database hosting), Firebase (push notifications, file storage). They host data on our behalf under contractual obligations to keep it confidential.
• Communication providers: email service providers and SMS gateways for transactional messages.
• Apple and Google: when you sign in with their services or download our apps from their stores. Push notification metadata is routed via APNs and FCM to reach your device.
• Law enforcement and regulators: only in response to valid legal process or where required by Kenyan law.
• In a business transfer: if Shopinn is acquired, merged, or restructured, your data may be transferred to the successor entity, subject to the same protections.

We require all third parties who handle data on our behalf to apply security and confidentiality protections at least equivalent to ours.

7. Payments and Wallets

All payment instructions are processed by Safaricom (M‑PESA) or Paystack. Shopinn:

• Stores transaction amounts, statuses, and reference numbers needed to reconcile orders and payouts.
• Stores your M‑PESA registered phone number (only) when you set it up for refunds, merchant payouts, or rider commission withdrawals.
• Does not store your M‑PESA PIN, full card numbers, CVVs, or banking credentials.
• Operates a wallet for merchants and riders to track available and pending balances. Withdrawal instructions are executed through M‑PESA Business-to-Customer (B2C) — we keep an audit trail of every withdrawal request, approval, and settlement.

8. Mobile App Permissions

Our mobile apps ask for the following permissions only when you use a feature that needs them. You can revoke any permission at any time in your phone's settings.

9. Push Notifications and Marketing

We send two categories of notifications:

• Transactional notifications (order placed, dispatched, ready for pickup, delivered, OTP codes, delivery codes, payment receipts, refund updates): these are part of the service and you cannot opt out without losing core functionality. They are not used for marketing.
• Promotional notifications (new products, deals, merchant promotions, loyalty offers): we send these only with your consent. You can opt out at any time from inside the app or by emailing privacy@shopinn.co.ke.

Merchants can run their own promotional push campaigns to customers who have followed their store. These are subject to weekly frequency caps that we enforce centrally.

10. Cookies and Similar Technologies

We use cookies and similar local-storage mechanisms on the website and mobile apps to keep you signed in, remember your preferences, and measure how the site is used. For full details, see our Cookies Policy.

11. How Long We Keep Your Data

We keep personal data only for as long as it is needed for the purposes set out in this policy or to comply with legal obligations. Indicative periods:

• Account profile data: for as long as your account is active. Deleted within 90 days of account closure, unless retention is required for legal or accounting reasons.
• Order and transaction records: seven (7) years to comply with tax and accounting law.
• Chat history with merchants: kept while your account is active; deletable on request.
• Logistics records (rider trips, agent handoffs): two (2) years after delivery for dispute resolution.
• Push notification tokens: deleted automatically when invalid; retained otherwise for active devices.
• Idempotency keys used to prevent duplicate orders or payments: deleted after 24 hours.
• Crash and analytics data: 90 days at most.
• Cookie data: see Cookies Policy.

12. International Data Transfers

Some of our service providers (Apple, Google, Firebase, Vercel, Neon) host data outside Kenya, primarily in the European Union and the United States. Where personal data is transferred internationally we rely on adequacy decisions, standard contractual clauses, or your explicit consent, in line with section 48 of the Kenya Data Protection Act, 2019.

13. How We Protect Your Information

We apply administrative, technical, and physical safeguards designed to protect your personal information, including:

• HTTPS encryption for all traffic between your device and our servers.
• Passwords stored using industry-standard hashing.
• JWT-based session tokens with refresh rotation; tokens stored in your device's secure storage (Keychain on iOS, Keystore on Android).
• Role-based access control: agents see only packages routed to their station; riders see only trips assigned to them; merchants see only their own orders.
• Logging and monitoring of administrative access.
• Rate-limiting and abuse detection on sensitive endpoints.
• Idempotency protection on order and delivery actions to prevent duplicates from network retries.
• Periodic third-party reviews where appropriate.

No system is perfectly secure, but we work to keep yours as safe as practical. If a personal data breach occurs and is likely to result in high risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner and you in line with sections 43 and 44 of the DPA.

14. Children's Privacy

Shopinn is intended for users aged 18 and over. We do not knowingly collect personal information from children under 18. If you believe a child has provided us with personal data, please contact us at privacy@shopinn.co.ke and we will delete it promptly.

15. Your Rights

Under the Kenya Data Protection Act, 2019, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete information.
• Object to certain types of processing, including direct marketing.
• Restrict processing in certain circumstances.
• Erase personal data we hold about you (the "right to be forgotten"), subject to retention obligations.
• Receive a copy of your data in a portable format.
• Withdraw consent for any processing based on consent at any time.
• Lodge a complaint with the Office of the Data Protection Commissioner (Kenya).

To exercise any of these rights, email privacy@shopinn.co.ke with your request. We will respond within thirty (30) days. We may need to verify your identity before acting on a request to make sure we don't disclose data to the wrong person.

Some account-level rights are also self-service: you can edit your profile, addresses, and notification preferences in Account settings, or request account deletion using our public deletion page (no login required).

16. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the latest version. If we make material changes, we will notify you through the app or by email before the changes take effect. Continued use of Shopinn after the effective date constitutes acceptance of the revised policy.

17. Contact Us

If you have questions, comments, or complaints about this Privacy Policy or how we handle your personal data, please reach out: