Privacy Policy

Jirani Hub is a community marketplace operated from our physical shop off Kikuyu Road, Near Kirigu Police Station, Mutuini-Kirigu, Dagoretti South, Nairobi, Kenya. We are the data controller for all personal information collected through the Jirani Hub website (jiranihubmarket.co.ke), mobile interface, and shop counter.

If you have any questions about this Privacy Policy or about how we handle your personal data, you can reach us:

• WhatsApp: +254 742 744 502
• In person: Off Kikuyu Road, Near Kirigu Police Station, Mutuini-Kirigu, Dagoretti South, Nairobi — Monday to Saturday, 07:00–20:00

We collect personal data in three ways: information you give us directly, information generated when you use the platform, and information received from third-party services you connect (such as Google login).

We only use your personal data for the following purposes. We do not use it for any other purpose without informing you first.

• Processing your orders — your name, phone number, address, and payment reference are used to confirm, pack, dispatch, and complete your order.
• WhatsApp notifications — we send order confirmations, reservation reminders, delivery dispatch alerts, and stock-ready notifications via WhatsApp to your registered phone number. These are operational messages, not marketing.
• Account management — your email and password (hashed) are used to authenticate your login and manage your account. We never store passwords in plain text.
• Seller operations — seller data including Seller Badge, product listings, stock quantities, and payout records are used to manage the seller relationship and calculate payouts.
• Dispute resolution — order history, M-Pesa references, and timestamps are used to investigate and resolve disputes fairly.
• Platform security — server logs and session data are used to detect and prevent fraudulent activity and unauthorised access.
• Platform improvement — aggregated, anonymised data (e.g. most-ordered product categories, peak order times) may be used internally to improve the service. This data cannot be traced back to any individual.

We share personal data only where necessary to operate the platform. We do not sell data or share it for marketing purposes. The third parties we work with are:

We may also disclose personal data if required to do so by Kenyan law or a lawful order from a competent authority (such as a court order or a request from law enforcement). We will notify affected users where we are legally permitted to do so.

All Jirani Hub data is stored in a MySQL database hosted on servers in Kenya by Truehost Kenya. We take the following security measures:

• Passwords are hashed using bcrypt (cost factor 12) before storage. We cannot read your password — not even our admin team.
• HTTPS is enforced across the entire platform. All data in transit is encrypted.
• Access control — only admin accounts have access to the database. Staff accounts have limited access defined by their role. Riders have no account access beyond their time-limited session token.
• Session tokens for riders are single-use per delivery slot and expire automatically after the slot ends.
• API authentication uses Bearer tokens passed in the Authorization header. Tokens are not stored in URLs or browser history.
• Product photos are stored in the server's /uploads/ directory, not in the database, with paths stored in the photo_paths field.

No security system is perfect. In the unlikely event of a data breach that affects your personal information, we will notify you as soon as reasonably practicable via WhatsApp and take immediate steps to contain and investigate the incident.

We keep your data for as long as it is needed to deliver the service or meet a legal obligation. Here is how long specific data types are retained:

When data reaches the end of its retention period, it is deleted from our database and any associated files are removed from server storage. We do not archive data beyond these periods.

Jirani Hub uses a minimal number of cookies — small text files stored in your browser. We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

• Session cookie — keeps you logged in during a browsing session. Expires when you close your browser or log out. This is essential for the platform to function.
• Auth token cookie — stores your JWT authentication token to keep you logged in across sessions (if you choose to stay logged in). You can clear this by logging out.

We do not use Google Analytics, Facebook Pixel, or any third-party tracking tools. The only cookies on this site are the ones necessary to make it work.

If you disable cookies in your browser, you will not be able to stay logged in, but you can still browse products as a guest.

Under the Kenya Data Protection Act 2019 and reasonable privacy practice, you have the following rights regarding your personal data. To exercise any of these rights, contact us via WhatsApp at +254 742 744 502. We will respond within 10 business days.

Jirani Hub is intended for users aged 18 and above. We do not knowingly collect personal data from anyone under 18. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly.

If you believe a child has created an account on our platform, please contact us immediately via WhatsApp at +254 742 744 502.

We may update this Privacy Policy from time to time. When we make material changes — such as collecting a new type of data or sharing with a new third party — we will update the "Last updated" date at the top of this page and notify active users via WhatsApp where practical.

Minor updates such as clarifications or corrections to wording do not constitute material changes. Continued use of the platform after a policy update constitutes acceptance of the revised policy.

We encourage you to review this policy periodically. Previous versions are available on request.

This policy was last reviewed and updated in January 2025.