Privacy policy
Last updated 23 October 2026
The short version
- Kibanda is software that lets shops sell on WhatsApp. When you order from a shop, the shop decides what happens with your order; we process your details for them.
- We collect what's needed to take and deliver an order: your WhatsApp number or ID, name, messages to the shop, delivery location, order and payment details.
- We never see your M-Pesa PIN or card number. Payments are handled by licensed payment providers.
- We don't sell your data or use it for advertising.
- You can ask for a copy of your data, or for it to be deleted, at any time: hello@kibanda.africa.
1. Who we are
Kibanda ("Kibanda", "we", "us") runs the Kibanda service at kibanda.africa, app.kibanda.africa and api.kibanda.africa, and the WhatsApp ordering experience for shops that use it. We are based in Nairobi, Kenya. Contact us about privacy at hello@kibanda.africa.
This policy covers three groups of people: shoppers who order from a shop on WhatsApp, shop owners and their teams who use the Kibanda dashboard, and riders who deliver orders. It is written to meet Kenya's Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021.
2. Our role
- For shoppers' order data, the shop you buy from is the data controller: it decides why and how your details are used for your order. Kibanda is its data processor and only uses those details to provide the service to the shop, as described here.
- For shop owners', team members' and riders' account data, and for keeping the service secure and working, Kibanda is the data controller.
3. What we collect
Shoppers
| Data | Where it comes from | Why |
|---|---|---|
| WhatsApp phone number or WhatsApp user ID, and profile name | WhatsApp, when you message a shop | To reply to you and recognise you next time |
| Your messages, taps and photos sent to the shop | You | To take your order and pass questions to the shop |
| Delivery location (a pin or a place you search for), landmark and delivery notes | You | To deliver your order; saved so you don't have to type it again |
| Orders, items, amounts, ratings | You and the shop | To process, deliver and support your orders |
| M-Pesa number, payment status and receipt numbers | You and the payment provider | To request and confirm payment |
| How you reached the shop (an ad, a website link, an AI assistant) | WhatsApp, the shop's website | So the shop knows which ads and links work (see section 6) |
Shop owners and team members
Name, email address, shop details (name, location, delivery and payment settings), products and photos, and activity in the dashboard. If you connect your own payment account (M-Pesa Daraja, Paystack, Flutterwave) or another system (Shopify, Odoo), we store the credentials you give us, encrypted. API keys are stored only as a one-way hash.
Riders
Name, phone number or WhatsApp ID, deliveries assigned, delivery status updates, cash recorded as collected, and messages relayed between you and customers.
Everyone
Technical data needed to run and secure the service: IP address, browser and device type, error reports and service logs.
4. How we use it, and our legal bases
- To provide the service — taking orders, payments, delivery, tracking and support (performance of a contract with you or with the shop).
- To keep it secure and working — preventing fraud and abuse, fixing errors (our legitimate interests).
- To meet legal obligations — tax and accounting records, responding to lawful requests (legal obligation).
- Ad measurement, only when you arrived from a shop's Click-to-WhatsApp ad (the shop's legitimate interests; see section 6).
We do not use your data for our own advertising, we do not sell it, and we do not make decisions about you that have legal or similarly significant effects purely by automated means. A shop may set rules — for example, asking for payment before delivery after earlier refusals — and those are the shop's decisions.
5. Who we share it with
Only with the people and services needed to provide Kibanda:
- The shop you order from, and its rider (your name, delivery location, landmark and notes for your order; riders never see your phone number — messages go through the shop's WhatsApp number).
- Meta Platforms, which operates WhatsApp, to send and receive messages.
- Payment providers — Safaricom (M-Pesa), Flutterwave and Paystack — to process payments. They handle your PIN and card details; we never receive them.
- Infrastructure providers: Cloudflare (hosting, storage and databases), Resend (email to shop owners), Sentry (error reports), and OpenStreetMap Nominatim or Google Maps (finding places you search for).
- Systems a shop connects, such as Shopify, Odoo, or the shop's own software and AI assistants through our API — the shop's orders, products and customer details go to them at the shop's instruction.
- Authorities, when the law requires it.
Our service providers act on our instructions and are bound to protect your data.
6. Ads
If you message a shop by tapping its ad on Facebook or Instagram, WhatsApp tells us which ad it was and gives a click identifier. If you then order within 7 days, we record that on the order and, for that shop, report the order event (created, paid, delivered or cancelled, with its value) to Meta along with that click identifier, so the shop's ads can be measured. We do not send your name, phone number or messages for this.
7. Where your data is stored
Our service runs on Cloudflare's global network, and WhatsApp messages pass through Meta's systems, so your data may be processed outside Kenya. When it is, we rely on safeguards required by the Data Protection Act — such as providers' contractual commitments and security measures — to protect it.
8. How long we keep it
- Orders, payments and delivery records: 7 years after the order, to meet tax and accounting law, unless the shop asks us to delete them sooner where the law allows.
- Conversation state and carts: until they're no longer needed to complete an order, and at most 12 months of inactivity.
- Saved addresses and your M-Pesa number: until you or the shop delete them, or 24 months after your last order.
- Shop accounts: while the account is open, then up to 90 days after it closes (except records we must keep by law).
- Logs and error reports: up to 90 days.
9. Your rights
Under Kenya's Data Protection Act you can ask to:
- know what data we hold about you and get a copy;
- correct data that's wrong or incomplete;
- delete your data, or restrict how it's used;
- object to processing based on legitimate interests;
- receive your data in a portable format.
Email hello@kibanda.africa from the phone number or email the data is linked to, or message the shop. We'll answer within the time the law allows. If we hold your data on behalf of a shop, we'll work with the shop to respond. You can also complain to the Office of the Data Protection Commissioner.
10. Deleting your data
To delete your data, email hello@kibanda.africa with the subject "Delete my data" and the WhatsApp number (or shop account email) it's linked to. We'll confirm your request, delete or anonymise your personal data within 30 days, and tell you when it's done. We may keep order and payment records the law requires us to keep, without your contact details where possible. Shop owners can close their account and have its data deleted the same way.
11. Security
We use encryption in transit, encrypt payment and integration credentials at rest (AES-256), store API keys only as hashes, and limit access to the systems that hold your data to the people who need it. No system is perfectly secure; if a breach affects your data, we'll notify you and the Data Protection Commissioner as the law requires.
12. Children
Kibanda is not meant for anyone under 18, and we don't knowingly collect children's data. If you think a child has given us data, contact us and we'll delete it.
13. Changes
We'll update this policy when our practices change and show the new date at the top. If a change materially affects you, we'll tell shops in the dashboard or by email, and shoppers through the shop's WhatsApp where appropriate.
14. Contact
Kibanda, Kenya — hello@kibanda.africa