Privacy Policy

1. Who we are

BidhaaLink is the data controller for the personal data described in this Policy. We operate the BidhaaLink multi-vendor marketplace.

"Personal data" means information about an identifiable person. "Processing" means anything we do with that data: collecting, storing, using, sharing, deleting.

These Terms describe the contract between you and BidhaaLink: Terms and Conditions — Who we are.

2. What we collect

We collect the following categories of personal data:

Account data (Customer)

• Full name.
• Auto-generated username.
• Phone number (required).
• Email address (optional, used for password reset).
• Password, stored as a one-way bcrypt hash — we never see the plain password.
• Date of registration.

Account data (Business Admin)

• Login email.
• Password, stored as a bcrypt hash.
• Business name, category, phone, and the location the business gives at registration.

Order and delivery data

• Products ordered, quantities, prices, order reference, order status history.
• Delivery address, recipient name, recipient phone, delivery instructions, pickup details, delivery code.
• Order chat messages and any delivery dispute messages.

Payment metadata

• Payment method (M-Pesa, Airtel, PayPal, bank, payment on delivery).
• Amount and currency.
• Provider transaction identifier and any callback reference the provider returns.
• Status of the payment (pending, success, failed).

We do not collect or store card numbers, PINs, or bank passwords. Those are handled directly by the payment provider.

Location data

• Business-provided location names, such as county and town, for discovery when a visitor searches for a place.
• Delivery addresses and any delivery coordinates a Customer provides with an order.

Usage data

• Cart contents.
• Wishlist.
• Chat messages that are not tied to a specific order.
• Reviews and ratings.
• Admin activity log entries for business admins and super admins (action, timestamp, details).

Acceptance records

• The date and time you accepted these documents.
• The version you accepted.
• Basic technical information about the device and browser that submitted the acceptance (user-agent, IP address).

The categories above are collected only as needed. For example, we cannot create a customer account without a phone number, because the phone number is the primary login identifier in Terms — Eligibility and accounts.

3. How we use it

We use personal data to:

• Create and secure your account, and let you log in.
• Let Customers place orders and Businesses fulfil them.
• Process payments through the payment providers.
• Send transactional email (order confirmations, status updates, password reset, dispute notices).
• Let Customers and Businesses communicate about an order.
• Show businesses whose business-provided location names match a place typed into marketplace search.
• Detect and prevent fraud, abuse, and platform misuse.
• Comply with legal obligations.
• Improve the Marketplace: aggregate, non-identifying statistics about usage.

We do not sell personal data. We do not use personal data for behavioural advertising on third-party networks. We do not share a Customer's coordinates with any Business — the coordinates are used on the server only to rank results.

4. Business data

For each Business, we store the business name, slug, description, mission, vision, logo, hero image, phone numbers, email addresses, physical location, the categories the business selected, the "What You Sell" keywords, the search tag, the payment methods the business accepts, and the delivery, return, replacement, and cancellation rules the business configured.

Most of this data is shown publicly on the Business's profile, because it is what a Customer needs in order to buy. The Business's login email and password hash are never shown publicly. The Business's obligations to keep this data accurate are in Terms — Business obligations.

5. Order data

An order record contains the items, prices, quantities, the order reference, the status history, and the delivery or pickup details for that order. It links to the Customer who placed it and the Business that fulfils it.

Order chat messages are stored so that both parties can refer back to what was agreed. A delivery record with a delivery code is stored so that handover can be verified.

The rights and obligations attached to an order are described in Terms — Orders and Terms — Returns, replacements, refunds, cancellations.

6. Payment data

We store the metadata of each payment (method, amount, status, provider transaction identifier). We do not store the customer's payment credentials. Those remain with Safaricom, Airtel, or PayPal, and we only receive the confirmation the provider sends us.

For payment on delivery, the order stores the fact that a payment-on-delivery agreement was signed, together with the timestamp, IP address, and text of the agreement. The payment itself is settled between the Customer and the Business or its delivery agent.

The rules for paying for an order are in Terms — Payments.

7. Location data

Marketplace discovery does not request a Customer's device GPS, save a preferred shopping area, or estimate a visitor's location from their IP address. Visitors can type a town, county, or other place into the single search field. Search matches business-provided location names.

If a Customer provides a delivery address or delivery coordinates for an order, we use those details to fulfil that order and share them with the Business responsible for delivery. This order information is separate from marketplace discovery.

Customer discovery coordinates or preferred areas saved before this feature was retired are no longer used for search. They remain only as legacy account data until the account is deleted; account deletion clears those fields.

8. Reviews data

When a Customer leaves a review on a product or a business, the review text, the star rating, and the date of the review are stored against that product or business. The review is displayed publicly with the Customer's display name.

A Customer can ask us to remove their own review. We may also remove a review that breaches Terms — Ratings and reviews.

9. Acceptance records

When you accept these Terms and the Privacy Policy — on the welcome splash, at registration, or at any point where we ask for a fresh acceptance — we record the following, so that we can prove the acceptance if it is ever questioned:

• Which document was accepted (Terms, Privacy, or both).
• Which version was in force at the time.
• The timestamp of acceptance.
• The user-agent string of the device.
• The IP address that submitted the acceptance.
• The identifier of the account, once the account exists.

This is the only piece of data we collect specifically for legal purposes. It is described in Terms — Eligibility and accounts.

10. Who we share with

We share personal data only in these cases:

• With the specific Business you bought from. The Business sees your order details, your name, your phone number, your delivery address, and the chat messages you sent about that order. Nothing more.
• With the payment provider you chose at checkout, to process the payment.
• With Cloudinary, for media you uploaded, so that the images and videos can be served back to the Marketplace.
• With the transactional email provider, to deliver the emails described in Section 3.
• With our map and geocoding partners, only when a Customer searches by a place name or when an address is looked up.
• With the authorities, where we are legally required to disclose, or where disclosure is necessary to investigate fraud or to protect the safety of a user.
• With our own team, and only to the extent needed to operate the platform, respond to a dispute, or fix a technical problem.

We do not sell personal data. We do not rent it. We do not share it with advertising networks. The contract that governs the Business's use of the data it receives through the Marketplace is in Terms — Third-party services.

11. Third-party services

Each of these services receives only what it needs:

• Safaricom receives the phone number and the amount for an M-Pesa payment.
• Airtel receives the phone number and the amount for an Airtel Money payment.
• PayPal receives the amount and the order reference.
• Cloudinary receives the media files uploaded by businesses.
• Google (Gmail SMTP) or SendGrid receives the recipient address and the body of the transactional email.
• OpenStreetMap Nominatim receives the search text a Customer typed for a place lookup.
• CartoDB receives only the tile coordinates needed to render the map in the browser.

The list of third-party services the Marketplace relies on is also in Terms — Third-party services.

12. Cookies and sessions

We use a small number of cookies, all of them strictly necessary:

• authToken — the login session cookie. HttpOnly, SameSite=Lax, Secure in production.
• csrfToken — the double-submit CSRF cookie that protects any state-changing request.
• welcome_seen — remembers that you dismissed the welcome splash, so we do not show it again on this browser.
• rotation_seed — a short-lived integer used to rotate the marketplace listing so the same customer does not always see the same order.
• bidhaalink_welcomed — set by the welcome splash, equivalent to the server-side welcome cookie.
• legal_notice_ack — set by the cookie notice banner, so it is only shown once.

We do not set advertising cookies. We do not set third-party tracking cookies. Everything we set is required for the platform to work, or for the legal notices to be remembered.

13. Retention

We keep personal data only for as long as we need it:

• Account data — for as long as the account exists, plus the grace period described in Section 14.
• Order data — for as long as necessary to provide receipts, resolve disputes, and satisfy tax and accounting obligations.
• Payment metadata — for as long as the payment can be disputed, plus the retention period required by the payment provider.
• Chat messages — for as long as the order chat can be referred back to; order chat is kept with the order.
• Legacy discovery location data ? until the account is deleted; this data is no longer used for search.
• Reviews — for as long as the reviewed product or business exists on the platform.
• Acceptance records — for the entire life of the account, plus the period required to defend against a legal claim.
• Admin activity log — for as long as needed for audit purposes.

The end-of-life behaviour of a Customer or Business account is described in Terms — Suspension and termination.

14. Account deletion

Customer account

A Customer can schedule their account for deletion from the account page. Once scheduled, the account is placed in a 30-day grace period. If the Customer logs back in during that period, the deletion is cancelled automatically. When the grace period ends, the account is anonymised: name, email, phone, and password are cleared, and location data is removed. The account row itself is not hard-deleted, because orders and chat messages reference it. Those references keep working, but they no longer identify the Customer.

Business account

A Business admin can schedule the business for deletion. The business is hidden from the Marketplace immediately, and placed in a 60-day grace period. If the admin logs back in during that period, the deletion is cancelled and the business is restored. When the grace period ends, the business is deactivated, its products are hidden, the owner's admin account is deactivated, and the search tag is released. The business row is not hard-deleted, because orders reference it.

The customer-facing wording of the deletion flow is in Terms — Suspension and termination.

15. Your rights

Under the Kenya Data Protection Act, 2019, and subject to the conditions in that Act, you have the right to:

• Be informed about how your personal data is being used — this Policy does that.
• Access the personal data we hold about you.
• Ask us to correct inaccurate data.
• Ask us to delete data that we no longer have a lawful reason to keep.
• Object to processing in certain circumstances.
• Ask us to restrict processing in certain circumstances.
• Receive your data in a portable format.
• Lodge a complaint with the Office of the Data Protection Commissioner of Kenya.

To exercise a right, contact us at georgebabji1220@gmail.com. We will respond within the time the Act requires. Some rights are limited where the data is needed to perform a contract, to comply with a legal obligation, or to defend a legal claim.

16. Security

We protect personal data with technical and organisational measures, including:

• Passwords are stored only as one-way bcrypt hashes.
• Sessions use HttpOnly, SameSite cookies, marked Secure in production.
• A double-submit CSRF token protects state-changing requests.
• A strict Content-Security-Policy limits which scripts and resources can load.
• Rate limiting protects authentication, order, and payment endpoints.
• Database connections use TLS.
• Access to production data is restricted to the people who need it to operate the platform.

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at georgebabji1220@gmail.com. The contractual consequence of an account being closed for security reasons is in Terms — Suspension and termination.

17. Children

The Marketplace is not intended for anyone under 18. We do not knowingly collect personal data from anyone under 18. If you believe we have collected data from a person under 18, contact us at georgebabji1220@gmail.com and we will delete the account. The eligibility rule is in Terms — Eligibility and accounts.

18. International transfers

Some of the third-party services in Section 11 store data outside Kenya. Where that happens, we rely on the service's own data-protection commitments, and we share only the minimum data each service needs. The full list of services is in Terms — Third-party services.

19. Changes

We may update this Policy from time to time. When we do, we will change the version number and effective date at the top of this page. If the change is material, we will notify you in-app or by email before it takes effect. If you continue to use the Marketplace after the change takes effect, you accept the updated Policy.

20. Contact

For any question about this Policy, or to exercise a data-protection right:

If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner of Kenya.

For the general terms of using the Marketplace, see Terms — Contact.