Privacy Policy

1. Personal data we collect

• Account data: name, email address, phone number, university, campus location, authentication identifiers, account role, and the version and date you last accepted our Terms and Privacy Policy.
• Order data: items, quantities, prices, delivery or pickup location, contact details, payment method, and order status. If you order during a Campus Weekend sale, the order also records which sale it was and what the listing would have cost outside it, so your saving stays provable later.
• Listing price history: we record every price a listing carries, with the date it changed. This is about the listing, not the seller or the buyer, and it is what lets us calculate an honest “was” price instead of taking a seller’s word for it. It is visible to anyone, because it is the evidence behind a public claim.
• Booking data: when you request a service, we record the day and the time of day you asked for, the short note you write about what you need, how many units you asked for, and where you say the service should happen. That provider receives all of it, because it is what they need to confirm and do the work. We keep it with the order so both of you have a record of what was agreed. Please do not put anything in the note you would not want the provider to read.
• Seller data: business details, phone number, social handles, shop profile, product listings with their photos and videos, profile photo, identity document photo, subscription details, M-Pesa reference code, and payment phone number.
• Seller availability: if you sell on ShopPepe, we record the availability you choose (available, busy or away) and the time you were last active on the site while signed in — on any ShopPepe page, not only the dashboard. We also treat a listing you add or update, and an order you move out of pending, as signs you have been active. Buyers are shown only a rough indication from all of this — “Online now”, “Active today”, “Active this week”, “Busy” or “Away” — and never an exact time. This applies to sellers only; nothing equivalent is recorded for buyers. Set yourself to Away in your dashboard and buyers see only that.
• Product videos: if you add a video to a listing, your own device prepares it before anything is uploaded. It keeps at most the first 20 seconds and writes a new file, which leaves behind the location and device details phones store inside videos. The video keeps its sound unless you switch the sound off, so anything audible in the clip — including other people’s voices — becomes public with the listing. The prepared video is kept with our storage provider, reviewed before it appears, and then shown publicly with the listing. We record its length, file size, whether it has sound, and upload time. When you remove the video or delete the product, we delete the file. A buyer’s device only downloads a video when the buyer taps play. Please do not film or record other people without their permission, or anything that shows where you live.
• Communications: support messages, reports, reviews, and quick feedback.
• Technical and usage data: IP address, browser and device information, referral source, pages viewed, performance measurements, security logs, and marketplace events such as shop views, product views, cart additions, checkout starts, and WhatsApp clicks. Your browser may also store your cart, sign-in preference, and theme choice locally.
• Shop link data: when you open a shop or product through a shared link, we record which channel the link was tagged with (for example WhatsApp, WhatsApp Status, Instagram, TikTok, or a scanned QR code), the page you landed on, the website domain you arrived from, and a random device identifier your browser stores locally. That identifier is not your name or your account — it exists only so a shop can tell forty visits from four people apart from forty visits from forty people. It is never linked to your account, and clearing your browser storage resets it.

Please do not submit unnecessary sensitive information in listing descriptions, reviews, or support messages.

2. How and why we use personal data

We use data to operate accounts and orders, connect buyers with sellers, review seller applications, moderate listings, process seller subscriptions, provide support, prevent abuse, secure the service, measure marketplace performance, meet legal obligations, and improve ShopPepe.

Depending on the activity, processing is based on performing our agreement with you, your consent, compliance with law, or our legitimate interests in operating a safe marketplace. You may withdraw consent where consent is the basis, without affecting earlier lawful processing.

Marketing communications: with your consent, we may send product updates or seller promotions by email, SMS, or WhatsApp. Marketing is separate from order, security, and account-service messages. You can opt out through the method shown in the message or email support@shoppepe.co.ke with “Unsubscribe” in the subject.

3. When we share data

• Sellers and providers: a seller receives the customer and order details needed to fulfil that seller’s items; a service provider also receives the day, time of day, note and place for the booking they are being asked to do. Do not use this data for unrelated marketing, and do not keep a buyer’s address or phone number for longer than the job needs.
• Seller reach reporting: a seller sees counts and totals for their own shop only — how many visits and how many separate devices each of their link channels brought, and how their shop ranks against others. Sellers are never shown who visited, any individual visitor identifier, or another shop’s figures.
• Platform providers: Supabase provides authentication, database, and file storage services, while Vercel provides hosting, performance monitoring, and traffic analytics.
• Analytics: Google Tag Manager and connected Google analytics services may receive device, page, referral, and interaction data used to understand traffic and improve campaigns. Vercel Analytics and Speed Insights measure visits and site performance.
• M-Pesa: when a seller starts an M-Pesa payment, Safaricom receives the phone number, amount, account reference, and transaction information needed to process and confirm it. ShopPepe does not receive or store the user’s M-Pesa PIN.
• WhatsApp: when you choose a WhatsApp link, WhatsApp receives data under its own privacy terms.
• Legal and safety reasons: we may disclose information where required by law or reasonably necessary to protect users, rights, property, or the marketplace.
• Business changes: data may transfer as part of a merger, financing, reorganisation, or sale, subject to appropriate safeguards.

We do not sell personal data.

4. International processing

Some service providers may process or store data outside Kenya. In practice that means: the database and uploaded files sit with Supabase in Ireland (European Union); the website is served by Vercel’s global network; and analytics and error reports go to Google and Sentry. We only use providers that are contractually bound to protect the data and to process it only on our instructions, and we rely on the safeguards Kenyan data protection law requires for a transfer out of the country. If you want the current list of providers, ask us.

5. Retention

We keep personal data only for as long as it is needed to operate the marketplace, resolve disputes, prevent fraud, and meet legal or accounting duties. Seller identity records are restricted to authorised review and support personnel and are deleted or anonymised when they are no longer required for verification, disputes, fraud prevention, or law. Local cart, sign-in preference, and theme data remain on your device until you clear them or sign out using the relevant option.

6. Security

We use access controls, Supabase authentication, row-level database security, role and ownership checks, restricted storage paths, HTTPS, and listing moderation. No online service can guarantee absolute security. Use a unique password, protect your device, and report suspicious activity promptly. We will notify affected users and the Office of the Data Protection Commissioner when a breach notification is required by law. If personal data is lost, exposed or taken, we notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it where the law requires, and we tell the people affected without undue delay where there is a real risk to them, in plain language and with what we are doing about it.

7. Your rights

Subject to Kenyan law, you may ask to be informed about processing, access your data, object to processing, correct inaccurate data, request deletion of false or misleading data, or request data portability where applicable. You may also complain to Kenya’s Office of the Data Protection Commissioner.

We may need to verify your identity before completing a request. Some data may be retained where law or a valid legal claim requires it.

Automated placement scoring for sellers: ShopPepe calculates an Activity Score for each approved shop from that shop’s own recent activity — listings added or refreshed, link visitors, orders, how quickly orders are moved out of pending, and whether shop details are kept current. The score decides whether a shop appears in homepage rotation. It never affects a shop’s search results, category listing, or direct link, never affects buyers, and is not used to profile any individual. Every input and its current value is shown to the seller in their dashboard, and a seller who believes their score is wrong can ask us for a human review.

8. Children

ShopPepe is not intended for children under 18. Do not create an account or submit seller identity documents if you are under 18. Contact us if you believe a child has provided personal data.

9. Changes to this policy

We may update this policy as the service or law changes. We will publish the revised date and provide additional notice where a material change requires it.

10. Contact and privacy requests

Email support@shoppepe.co.ke or use the support form. Include “Privacy Request” in the subject. You can also contact the Office of the Data Protection Commissioner.