AgriVesta ("we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, including when you sign in with Google.

We comply with the Kenya Data Protection Act, 2019 and adhere to best practices for data protection and privacy.

• Account Management: Create and manage your account, verify your identity
• Marketplace Operations: Enable buying, selling, and hiring of agricultural products
• Payment Processing: Facilitate M-Pesa payments processed by IntaSend
• Communication: Send order updates, notifications (including via OneSignal), and marketing communications (with your consent)
• Fraud Prevention: Detect and prevent fraudulent activities
• Legal Compliance: Comply with Kenyan tax and financial regulations
• Service Improvement: Analyze usage to improve our platform
• Customer Support: Respond to your inquiries and resolve issues

Under the Data Protection Act, 2019, we process your data based on the following lawful grounds:

• Contract: Processing necessary to fulfil our Terms of Service and complete transactions you request
• Consent: For marketing communications, optional location sharing, and other optional data collection
• Legal Obligation: For tax, financial, KYC, and other regulatory compliance
• Legitimate Interest: To improve our services, secure the platform, and prevent fraud, balanced against your rights and freedoms

We share your information only when necessary, with these categories of recipients:

• Payment processors: IntaSend and Safaricom M-Pesa, to process transactions
• Infrastructure and hosting: Supabase, for secure database hosting and authentication
• Authentication: Google, for Google Sign-In
• Notifications: OneSignal, to deliver push and in-app notifications
• Other users: Your name and profile are visible to other users. Contact details are shared with the other party only after a successful payment
• Legal authorities: When required by Kenyan law, court order, or to protect rights and safety
• With your consent: Any other sharing with your explicit permission

We rely on the following categories of trusted third-party processors, each bound by confidentiality and data-protection obligations:

• IntaSend — licensed payment service provider processing M-Pesa transactions
• Supabase — database hosting, authentication, and secure file storage
• Google — OAuth sign-in services
• OneSignal — push notification delivery

AgriVesta may ask for permission to use your device location to make the marketplace more useful to you.

• Location permission is optional. Denying it does not prevent you from using AgriVesta.
• Seller location is used only to estimate the distance between a buyer and a listing.
• Buyer location is used only to improve search relevance by showing nearby products first.
• Precise coordinates are never publicly displayed. Only an approximate distance or a general area is shown — for example "approximately 2 km away", Rongo, Migori or Kisumu.
• We never display exact coordinates, GPS positions, street addresses, home locations or farm locations to other users.

You can withdraw location permission at any time through your device or browser settings.

AgriVesta may send you in-app notifications and WhatsApp notifications about important marketplace events, including:

• Purchase Request updates
• Payment confirmations
• Dispatch updates
• Dispute updates

These messages are transactional, not promotional. They keep you informed about activity on your own purchases and sales. Marketing messages are separate and always require your consent.

To give both buyers and sellers a clear view of a transaction, AgriVesta stores transaction history including:

• Purchase stages
• Activity history
• Payment status
• Delivery confirmations
• Dispute history

This information is used to improve transparency and to help both parties manage their transactions.

Photos, videos, and supporting documents submitted during a dispute are stored securely and are accessible only to the authorised parties involved in resolving that dispute, and to AgriVesta staff reviewing the case.

AgriVesta partners with secure payment providers, including IntaSend, to process marketplace payments and hold funds in escrow until a transaction is completed.

We do not permanently store sensitive payment credentials such as card details or mobile money PINs. We keep only the transaction records needed to run the marketplace and meet legal obligations.

In line with the Purchase Request workflow, buyer and seller contact information becomes visible to each other only after a successful payment. Before that point, communication happens through the marketplace.

Precise location data remains private even after payment. Only approximate distance or a general area is ever shown.

Some of our service providers (including Supabase, Google, and OneSignal) may process data on servers located outside Kenya. Where this occurs, we take reasonable steps to ensure such transfers are subject to adequate data-protection safeguards consistent with the Data Protection Act, 2019, including contractual protections with our processors.

We implement robust, layered security measures:

• Encryption: Data is encrypted in transit (TLS) and at rest
• Access Controls: Row Level Security (RLS) and least-privilege access restrict who can view data
• Authentication: Secure password requirements and OAuth
• Audit Logging: Key account and administrative actions are logged for accountability
• Monitoring: Regular security audits and vulnerability assessments
• Staff Training: Our team is trained in data protection practices

We retain your data according to the following schedule:

• Account Data: As long as your account is active
• Transaction Records: Up to 7 years (Kenyan tax and financial regulations)
• Communications: Up to 5 years, for support and dispute resolution
• Marketing Data: Until you withdraw consent

Upon account deletion, personal data will be removed within 30 days, except where legally required to retain it.

Under the Data Protection Act, 2019, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Limit how we use your data
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to data processing for marketing
• Withdraw Consent: Withdraw consent at any time

To exercise any of your rights above, contact our support team with your request and account details:

We aim to respond to all such requests within a reasonable timeframe and in any case as required by law. You may also call 0116 723 630.

AgriVesta is not intended for children under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal data, please contact us immediately so we can take appropriate action.

We use only essential cookies:

• Session Cookies: Required for authentication and keeping you logged in
• Preference Cookies: Remember your settings and preferences

We do not use third-party advertising cookies. Where we use basic, privacy-respecting analytics to understand platform usage and improve the Service, this data is aggregated and is not used to build advertising profiles about you.

We may update this Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new policy on this page
• Updating the "Last Updated" date
• Sending an email notification for significant changes

Your continued use of AgriVesta constitutes acceptance of the updated policy.

If you have questions, concerns, or requests about this Privacy Policy:

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner at www.odpc.go.ke.