Zaruni Privacy Policy

1. Introduction

Welcome to Zaruni ("we", "our", or "us"). Zaruni is a Kenya-first super-app operated by Zaruni Ltd., designed to connect buyers, sellers, gig workers, employers, couriers, and service providers across Kenya through a unified, trust-enforced platform.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use the Zaruni mobile application, website, and related services (collectively, the "Platform"). It applies to all users of the Platform, regardless of their role.

By creating an account or using the Platform, you agree to the collection and use of your information in accordance with this Privacy Policy. If you do not agree, please do not use the Platform.

2. Data Controller

The data controller responsible for your personal information is:

Zaruni Ltd.
Nairobi, Kenya
Email: [email protected]
Registration Status: Pending — Office of the Data Protection Commissioner (ODPC), Kenya

3. Legal Basis for Processing

We process your personal data under the Kenya Data Protection Act, 2019 (DPA 2019). Our legal bases for processing include:

4. Information We Collect

4.1 Account & Identity Information

When you register on Zaruni, we collect:

• Full Name and preferred display name
• Phone Number (E.164 format) — used as your primary account identifier and for OTP verification
• Email Address (optional, used for backup recovery and transaction receipts)
• Date of Birth (to verify you are at least 18 years of age)
• Profile Photo
• Selected Roles (Buyer, Worker, Employer, Shop Owner, Service Provider, Commuter)

4.2 Identity Verification (Zaruni ID)

To participate in higher-trust tiers (Silver and Gold) and unlock enhanced platform capabilities, we collect:

• National Identity Card (ID) or Passport number and photo upload
• Liveness Selfie for biometric matching against your identity document
• Verification Tier Status achieved (Bronze: Phone verified; Silver: Government ID verified; Gold: ID verified + Community vouched)

Identity documents are processed securely and deleted as soon as verification is confirmed. Only identity verification metadata is retained.

4.3 Location Information

Zaruni relies on location information to enable matches and deliveries. We collect location data based on your interactions:

4.4 Device & Security Information

To prevent fraud, multiple account abuses, and account takeovers, we collect:

• Device Fingerprint (device model, OS version, unique device ID)
• Root/Jailbreak Status and spoofing checks (to identify mock locations)
• IP Address at login and during financial transitions
• Access logs (timestamps, login outcomes)

4.5 Financial & Payment Information

To support the lock-first transactional ledger system, we collect:

• Zaruni Ledger Balance digital transactional records (double-entry accounting records)
• M-Pesa Phone Number used for top-ups and payouts
• Safaricom transaction references (M-Pesa transaction ID, top-up outcome)
• Transaction lock state events (locks established, locks released, locks disputed)
• Idempotency Keys to prevent double-charging

4.6 Marketplace & Commerce Data

• Shop Details: name, category, description, profile/cover images, operating hours, and service locations
• Product Catalogs: names, descriptions, images, prices, variants (sizes, colors), and stock levels
• Order history: items purchased, quantities, pricing, delivery addresses, and status history
• Supplier-Reseller relationships (for dropshipping arrangements)

4.7 Jobs & Services Data

• Job Listings: employer name, location, wage rate, requirements, and job description
• Job Applications: worker applications, cover messages, status tracking
• Assignment history: check-in/check-out timestamps, GPS coordinates at check-in
• Work Evidence: photos or text descriptions uploaded by workers to prove task completion
• Service bookings (Fix-It module): booking category, agreed quotes, schedules, and completion proof

4.8 Trust & Reputation Data

We calculate your Zaruni Trust Score (0–1000) based on:

• Government verification status (Bronze/Silver/Gold)
• Ratings and reviews received from other users (1–5 scale, optional comments)
• Transaction history (on-time delivery, cancellation rates, no-show disputes, payment disputes)

4.9 Communication Data

• In-app Chat Messages: text, images, and attachments sent between buyers/sellers, workers/employers, and service providers/clients. Chat messages are securely associated with specific transaction records.
• Chat Encryption: In-app chat supports end-to-end encryption using the TweetNaCl protocol.
• Push Notification Tokens: to deliver real-time messages and status updates via Expo/FCM.

4.10 Community & Content Data

• Moments posts: social posts, photos, comments, and reactions uploaded to share updates or showcase completed work.
• Community Safety Reports: incident reports, details, and photos shared to warn other users of local security issues.
• Transit information: routes, crowding, fare rates, and safety reports submitted to the Transit module.
• Price Reports: crowdsourced commodity price intelligence submitted to help build the Price Radar system.

5. How We Use Your Information

We use your personal data for the following purposes:

5.1 Core Service Delivery

• Authenticating your account and verifying your identity.
• Matching you with local shops, gig jobs, and service providers using geospatial queries (PostGIS).
• Coordinating top-ups, transaction locks, releases, and payouts processed by Safaricom M-Pesa and our licensed payment partners.
• Generating digital receipts for every completed transaction.
• Enabling in-context chat messaging for active transactions.

5.2 Trust & Safety Controls

• Calculating and displaying your public Trust Score.
• Running anti-fraud algorithms (mock location detection, fake QR scan alerts, reseller SLA enforcement).
• Managing dispute resolutions in the Resolution Center by reviewing chat history, GPS logs, and uploaded evidence.
• Enforcing graduated account penalties (warnings, temporary suspensions, permanent bans) to maintain platform safety.

5.3 Geospatial Logistics

• Calculating distance and estimated times for deliveries, gig assignments, and service calls.
• Enforcing cell-based courier accountability (co-couriers in the same zone).
• Validating delivery completion (couriers must scan a time-bound and geo-bound QR code within 50 meters of the delivery destination).

5.4 Compliance & Legal Obligations

• Complying with Kenyan financial regulations, tax reporting, and AML checks.
• Responding to valid legal requests, court orders, or law enforcement directives in Kenya.

6. How We Share Your Information

We do not sell your personal data. We share your information only in the following limited circumstances:

6.1 With Other Platform Users

• Your display name, profile picture, Trust Score, and verification badges are public and visible when other users view your profile, shops, or listings.
• When you participate in a transaction, the counterparty can view details necessary to complete the transaction (e.g. delivery address for couriers, phone number for active bookings, or work description).
• Your precise GPS coordinates are never shown to other users. Only your generalized service area or active delivery route is visible.

6.2 With Payment Partners & Service Providers

• Safaricom M-Pesa & Licensed Payment Partners: We share your phone number, name, and transaction details to facilitate transaction settlement via secure payment APIs.
• AWS S3 / MinIO: Files, documents, profile pictures, and evidence uploads are stored on secure cloud servers.
• Sentry: Anonymized crash logs and device models are shared to resolve software bugs.
• Expo / Google FCM: Push notification tokens are shared to route in-app alerts to your device.

6.3 For Legal and Safety Reasons

We may share your data with government authorities, regulators, or courts if we believe disclosure is reasonably necessary to comply with Kenyan law, respond to a valid legal process, prevent physical harm or financial loss, or protect the integrity of the Platform.

7. Data Retention

We retain your personal information only as long as necessary to fulfill processing purposes or comply with legal obligations:

8. Your Rights (Kenya Data Protection Act, 2019)

As a data subject under the DPA 2019, you have the following rights, which you can exercise at any time:

• Right to Access: Request a copy of all personal data we hold about you.
• Right to Rectification: Request the correction of inaccurate or incomplete personal records.
• Right to Erasure (Deletion): Request that we delete your personal data, subject to legal financial retention requirements.
• Right to Object/Restrict: Object to processing of data on legitimate interest grounds, or request restriction of processing.
• Right to Data Portability: Request a download of your data in a structured, machine-readable format.
• Right to Lodge a Complaint: File a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya if you believe we have violated your rights.

To exercise these rights, please email us at [email protected]. We will respond to all requests within 21 days.

8.1 Clear Location History

You can delete all your cached location coordinates directly from the app. Navigate to Settings → Privacy → Clear Location History.

8.2 Account Deletion

You can request account deletion via Settings → Account → Delete Account. If you have an active Ledger Balance, you must request a payout of your funds before your account can be deleted. Once deleted, your profile is wiped, but financial ledger details are retained for 7 years for compliance.

9. Security Measures

Zaruni implements advanced, enterprise-grade safety protections:

• JSON Web Tokens (JWT): Short-lived access tokens combined with refresh token rotation.
• Cryptographic Chat (TweetNaCl): End-to-end encrypted messaging channels for private user conversations.
• Secure Storage: Sensitive tokens are encrypted at rest using Expo SecureStore.
• Network Encryption: TLS 1.3 for all client-to-server data in transit.
• Idempotent API Requests: Preventing accidental duplicate charges by enforcing strictly unique request keys.
• Immutable Audit Trails: Financial, transaction lock, and QR scan events are written to append-only ledgers to prevent manipulation.

In the unlikely event of a data breach, we will notify you and the ODPC within 72 hours of verification, as required by DPA 2019.

10. Children's Privacy

Zaruni is strictly intended for individuals aged 18 and older. We do not knowingly collect or verify data for anyone under 18. If we discover a minor has created an account, it will be terminated immediately.

11. International Transfers

Zaruni stores and hosts data locally within Kenya. Certain third-party services (such as error tracking or push notification servers) may route data outside Kenya. We ensure all external processors sign Standard Contractual Clauses complying with Part V of the DPA 2019, guaranteeing equivalent data protections.

12. Cookies & Local Tracking

The Zaruni mobile app does not use web cookies. We store token credentials on your local device storage using AsyncStorage and SecureStore. Our website uses minimal, non-tracking cookies to persist user interface dark/light preferences.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When updates occur, we will adjust the date at the top and notify you via in-app alert or email. For material changes, you will be prompted to re-accept the updated terms before you can continue using the Platform.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact our Data Protection Officer:

Zaruni Ltd.
Email: [email protected]
Address: Nairobi, Kenya

You may also contact the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.