Privacy Policy

The Services are operated by East Africa Data Handlers Ltd, a company registered in Kenya. We are the data controller for the personal information described in this policy, and we process it in line with the Kenya Data Protection Act, 2019 and its regulations.

For any privacy question or request, contact us at info@gubato.co.

• Account and profile: phone number (used to sign in with a one-time code), name, email address, profile photo, and optional details such as date of birth and gender.
• Delivery details: delivery addresses, saved locations (including map coordinates you choose), pickup points and delivery instructions.
• Identity verification (KYC): national ID number and identity documents you submit when verification is required, for example to use wallet features or to sell on Gubato.
• Orders and payments: group orders you create or join, cart items, order history, wallet top-ups, withdrawals and transaction history, including M-Pesa payment references. We do not store your M-Pesa PIN.
• Messages and content: group chat messages, photos, videos and files you share, product reviews, and comments in livestreams.
• Invites and referrals: details of people you invite to Gubato or to a group.
• Support: what you tell us when you contact us.

• Contacts: if you allow it, we read phone numbers from your address book to show which of your contacts are on Gubato and help you invite them. Numbers are converted into one-way hashes before matching, and we do not keep your address book. You can turn off your own discoverability at any time.
• Camera and microphone: used only when you take a photo, scan a code, upload media, go live or join a livestream or call.
• Notifications: used to send order, payment, group and message alerts.

You can withdraw any of these permissions in your device settings. Some features will stop working without them.

• Device information: device model, operating system, app version, language and a push notification token.
• Usage and logs: sign-in sessions, pages and features used, actions taken in the app, IP address and approximate region derived from it, and timestamps.
• Diagnostics: crash reports and performance data.
• Cookies: our website uses essential cookies to keep you signed in and secure. We do not use advertising cookies.

• Payment providers confirm the status of your payments and withdrawals.
• Delivery partners send delivery status, proof of delivery and tracking updates.
• Other members may add you to a group or invite you using your phone number.

• Create, secure and manage your account and sign you in.
• Run group orders: matching members, pooling carts and placing orders with suppliers.
• Process payments, wallet transactions, refunds and payouts.
• Arrange delivery and pickup, and keep you updated on your orders.
• Provide messaging, livestreams, rewards, streaks and referral features.
• Verify identity, prevent fraud and abuse, and keep the Services safe.
• Provide customer support and respond to your requests.
• Understand how the Services are used so we can fix problems and improve them.
• Send you service messages and, where you have agreed, offers and news. You can opt out of marketing at any time.
• Meet our legal, tax, accounting and regulatory obligations.

We only process your personal information when we have a lawful basis to do so:

• Contract: to provide the Services you sign up for, such as orders, payments and delivery.
• Consent: for contacts access, camera, microphone, notifications and marketing. You can withdraw consent at any time.
• Legal obligation: for identity verification, financial record keeping and responding to lawful requests.
• Legitimate interests: for security, fraud prevention and improving the Services, where these interests are not overridden by your rights.

We do not sell your personal information. We share it only as follows:

• Other members: people in groups you join see your name, photo, messages and group activity. Contacts who use Gubato may see that you are on Gubato unless you turn off discoverability.
• Suppliers and creators: receive the order details they need to supply and fulfil your order.
• Delivery partners and pickup points: receive your name, phone number, delivery location and order details.
• Payment providers: such as Safaricom M-Pesa, to process payments and withdrawals.
• Service providers: who host and run our systems on our behalf, including Google Cloud and Firebase (hosting, push notifications and crash reporting) and Agora (live video and calls). They may only use your information to provide services to us.
• Authorities and legal requests: where the law requires it, or to protect the rights, property or safety of Gubato, our users or others.
• Business changes: if Gubato is involved in a merger, acquisition or sale of assets, your information may transfer to the new owner under this policy.

Some of our service providers store or process information on servers outside Kenya, including in the United States and Europe. When we transfer personal information abroad, we do so in line with the Kenya Data Protection Act and use providers that apply appropriate safeguards to protect it.

• Account and profile information: while your account is open.
• Payment, wallet and order records: up to 7 years after the transaction, as required by tax and financial laws.
• KYC records: as long as the law requires after your account closes.
• Messages and shared content: while your account is open, or until you delete them.
• Logs and diagnostics: generally no longer than 12 months.

When information is no longer needed, we delete or anonymise it. See how to delete your account.

We use technical and organisational measures to protect your information, including encryption in transit, secure storage of sign-in credentials on your device, one-time code sign-in, hashing of contact numbers, and access controls that limit staff access to those who need it. No system is completely secure, so please keep your phone and sign-in codes safe and tell us straight away if you suspect unauthorised use of your account.

Under the Kenya Data Protection Act, you have the right to:

• be told how your personal information is used;
• access the personal information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information, subject to legal retention requirements;
• object to processing, including for direct marketing;
• withdraw your consent at any time;
• receive your information in a portable format.

To use any of these rights, email info@gubato.co. We may ask you to confirm your identity first, and we will respond within the time the law allows. You can also complain to the Office of the Data Protection Commissioner (odpc.go.ke).

The Services are for people aged 18 and over. We do not knowingly collect information from children. If you believe a child has given us their information, contact us and we will delete it.

The Services may link to websites or services run by others, such as supplier or payment pages. Their own privacy policies apply, and we are not responsible for how they handle your information.

We may update this policy from time to time. We will post the new version here with a new “Last updated” date and, for significant changes, let you know in the app or by message before they take effect.

East Africa Data Handlers Ltd
Email: info@gubato.co

See also our Terms and Conditions.