Privacy notice
What personal data ADDPlus+ collects, why, who processes it and where, and your rights under the Data Protection Act, 2019 (draft for legal review).
Draft for legal review
This page is a draft. ADDPlus+’s advocate has not reviewed it yet, and it may change before ADDPlus+ takes payments. Where it and the way the site works differ, tell us through the contact form.
Last changed 30 September 2026
1. Who is responsible for your data
ADDPlus+ is run by its founder, Kennedy Muritu, from Nairobi, Kenya. It is not yet a registered company. When the company is registered, these pages will name it and give its registration details.
ADDPlus+ is the data controller for the data described here, under the Data Protection Act, 2019. ADDPlus+ has not yet registered with the Office of the Data Protection Commissioner (ODPC); it will register once the company exists. [Advocate: confirm the registration position under the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021.]
2. What we collect and why
| What | Why |
|---|---|
| Your email address and, if you give it, a display name | To create your account, send sign-in codes and order emails (performing our contract with you) |
| Passkeys (public keys only) and, if you set one up, an authenticator app secret | To sign you in and confirm sensitive actions |
| Sign-in records: time, device type, and approximate country and city from our hosting network | To show you your sessions and warn sellers and admins of sign-ins from a new device (security, a legitimate interest) |
| A keyed hash of your IP address | To limit repeated attempts and abuse. We do not store the address itself |
| The M-Pesa number you pay with (encrypted) | To request the payment, match it, and send any refund to the same number |
| Your orders, delivery or pickup choices, disputes, photos you add to a dispute, and reviews | To run the order, decide disputes and publish reviews (only your first name is shown) |
| Sellers: legal name, national ID or passport number, KRA PIN if given, a photo of the ID and a selfie holding it, the payout M-Pesa number, store details | To verify who runs each store, prevent fraud, and pay the seller. ID numbers, KRA PINs, legal names and phone numbers are encrypted before they are stored; ID photos are kept in private storage |
| Answers you send through our Tally forms (contact, reports, feedback, seller interest, grant applications) | To answer you or decide the request |
| Financial records of payments, payouts and refunds | Kept because the law requires financial records (a legal obligation) |
We do not use analytics, advertising or tracking scripts, and we do not sell or rent personal data.
3. Who processes it, and where
| Service | What it does for us, and where |
|---|---|
| Vercel | Hosts the site, runs our server code in its Dublin, Ireland region, stores product photos and private identity photos, and checks for bots. Vercel is a United States company. |
| Turso | Our database, stored in Ireland (Amazon Web Services, eu-west-1). |
| Brevo | Sends our emails. Brevo is based in France and keeps delivery records of each email. |
| Tally | Runs our forms. Tally is based in Belgium. |
| Pay Hero | Sends M-Pesa payment requests and reports their status. Pay Hero is based in Kenya. |
| Safaricom (M-Pesa) and Equity Bank | Process the payment and receive the money, in Kenya. |
Sending data to Ireland, France, Belgium and the United States is a transfer outside Kenya. We rely on these services’ own safeguards for it. [Advocate: confirm the basis for these transfers under sections 48 to 50 of the Act.]
Sellers see what an order needs: your name, delivery area and the items. They see your phone number only while they are delivering your order, only when they tap “Show number”, and we record each time.
4. How long we keep it
We are setting how long we keep each kind of record with our advocate and tax adviser, and this notice will list the periods. Until then we delete unused photo uploads after a day, and we keep everything else.
When you delete your account, we remove your personal details and keep the financial records the law requires under a pseudonymous ID.
5. Your rights
You have the right to be told how your data is used, to see it, to have it corrected, to object to its use, and to have it deleted where the law allows.
- Download your data as a file from your account page.
- Delete your account from your account page.
- For anything else, use the contact form. We answer within the time the law sets.
- You can complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).
6. Security and breaches
There are no passwords to steal: you sign in with an emailed code or a passkey. Sensitive fields are encrypted before they reach the database, and identity photos open only through links that expire after a minute.
If a breach puts your data at risk, we will tell the Data Protection Commissioner within 72 hours of finding it, and tell you, as section 43 of the Act requires.