Privacy Policy

JADE254 ("we", "our", or "us") operates the JADE254 online marketplace available at this website. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform. By using JADE254, you agree to the practices described in this policy.

1. Information We Collect

1.1 Information You Provide Directly

• Full name and display name
• Email address
• Phone number (including M-Pesa number for sellers and riders)
• Delivery address and location details
• Payment information (processed securely via Paystack — we do not store raw card data)
• Profile photo (if uploaded)
• National ID number (riders only, for verification)

1.2 Information from Google Sign-In

When you choose to sign in using your Google account, we receive from Google only the information you authorize: your name, email address, and profile picture. We use this information solely to create and manage your JADE254 account. We do not access your Gmail, Google Drive, contacts, or any other Google service beyond basic profile data. We do not share your Google account data with any third party.

1.3 Information Collected Automatically

• Device type, browser, and operating system
• IP address and approximate location
• Pages visited and time spent on the platform
• Referring URLs and click behaviour

2. How We Use Your Information

• Create and manage your account
• Process orders and payments via Paystack
• Coordinate delivery to your address
• Communicate order status, support, and important notices
• Calculate and pay affiliate commissions and seller earnings
• Prevent fraud, abuse, and unauthorised access
• Improve the platform's features and user experience
• Comply with applicable Kenyan laws and regulations

3. Google API Services — Limited Use Disclosure

JADE254's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only request the minimum scopes needed: your basic profile (name, email, profile picture).
• We use your Google account data only to authenticate you and populate your JADE254 account profile.
• We do not use your Google data for advertising or sell it to any third party.
• We do not allow humans to read your Google account data unless you have given explicit permission, it is necessary for security purposes, or we are required to do so by law.

4. Sharing Your Information

We do not sell your personal information. We may share your data only in the following circumstances:

• Paystack — to securely process payments. Subject to Paystack's own Privacy Policy.
• Firebase / Google Cloud — our database and authentication infrastructure provider.
• Supabase — our backend infrastructure for order processing and delivery management.
• Delivery Riders — your name, phone number, and delivery address are shared with assigned riders to complete your delivery.
• Sellers — sellers see only the order details needed to fulfil your purchase (no payment card data).
• Legal Authorities — when required by Kenyan law, court order, or to protect the rights and safety of users.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. You may request deletion of your account and associated data at any time by contacting us (see Section 9). Order records may be retained for up to 7 years for financial and legal compliance.

6. Data Security

We implement industry-standard security measures including encrypted connections (HTTPS/TLS), Firebase Authentication for secure login, Firestore security rules to restrict data access, and Paystack's PCI-compliant payment processing. Despite these measures, no internet transmission is 100% secure. You are responsible for keeping your account credentials confidential.

7. Cookies and Tracking

We use browser local storage and session storage to keep you signed in and remember your cart. We may use analytics tools to understand usage patterns. These do not collect personally identifiable information beyond what is described in this policy. You can clear stored data via your browser settings at any time.

8. Your Rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your account and personal data
• Withdraw consent for Google Sign-In by revoking access at myaccount.google.com/permissions
• Object to certain data processing activities

To exercise any of these rights, contact us at the details in Section 9.

9. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Continued use of JADE254 after changes constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

11. Governing Law

This Privacy Policy is governed by the laws of the Republic of Kenya, including the Kenya Data Protection Act (2019). Any disputes shall be subject to the exclusive jurisdiction of Kenyan courts.