Privacy Policy
Last drafted 5 September 2026 · not yet in effect
1. Who we are
Rudia is a data controller under Kenya’s Data Protection Act, 2019, and intends to register with the Office of the Data Protection Commissioner (ODPC) before launch. Our current registration status is shown on the Trust & Safety page.
2. What we collect
- Identity and contact details: your name, phone number and email address.
- Delivery details: your address, landmark and delivery preferences.
- Order history: what you bought, from which store, and when.
- Payment metadata: your M-Pesa phone number and payment status. We do not receive or store your M-Pesa PIN.
- Usage data: pages visited and actions taken, collected via PostHog for the purpose of improving the product.
3. Why we collect it
We use your data to operate your account, fulfil orders and subscriptions, send the messages described below, prevent fraud, and meet our own tax and accounting obligations.
4. Messages we send you
Order confirmations, delivery updates and renewal reminders are sent because you have an active order or subscription with a store — these are performance-of-contract messages, not marketing, and you cannot opt out of them while the subscription is active (you can pause or cancel the subscription itself instead). We separately ask your permission, with a clear unticked checkbox, before sending anything promotional. We never infer that permission from the fact that you paid us.
5. Who sees your data
A store you order from can see the contact and delivery details needed to fulfil your order. Our merchant agreement requires that a merchant only use your details for that purpose. We do not sell your data, and we do not share your data across merchants.
6. Your rights
You can download a copy of everything we hold about you, and you can ask us to delete your account, from your account settings. Deleting your account removes your name, email and phone number everywhere they appear. Past orders keep their amount and date, with your name and contact details removed, because tax and reconciliation records must be kept for a period after the transaction regardless of an account deletion request.
7. Retention
We keep order and payment records for as long as Kenyan tax law requires. Behavioural analytics data is retained for up to one year. We keep the minimum personal data needed to run your account for as long as it is active.
8. Contact
Questions about this policy go to support@rudia.co.