Privacy Policy

Last updated: October 3, 2026

1. Introduction

This Privacy Policy explains how Suadeo Technologies Limited ("Suadeo"), the owner and operator of Sinatabu ("we", "us", "our"), collects, uses, discloses and protects your personal information when you use our website, applications and related services (collectively, the "Service").
We are committed to handling your personal information in accordance with the Data Protection Act, 2019 (Kenya) and any other applicable data protection laws.

2. Data We Collect

We collect different types of information depending on how you interact with Sinatabu, including:

• Access and usage data (log data). When you visit our site, we may automatically collect information such as your IP address, device identifiers, browser type, operating system, internet service provider, the website or app you visited from, pages viewed, clickstream data, and access dates and times. This data usually does not directly identify you.
• Account and profile data. If you register an account or shop, we collect information such as your name, business name, contact details (email, phone number), country, password, and any profile information you choose to provide. Shop and personal-shopper profiles are public: the business name, description, photos, location and the contact details you add to them (such as phone number and social media handles) can be seen by anyone, including people who are not signed in, and may be indexed by search engines. If you use Sinatabu through a corporate or team account, or as a team member of a shop, the organisation or shop owner that administers it can see the activity you carry out for it. We also keep a record of the version of our Terms of Service and Privacy Policy you accepted when you created your account, together with the date, your IP address and your browser or device type.
• Transaction and interaction data. When you create or respond to finds, place or receive orders, send messages, leave reviews, or otherwise interact with buyers, merchants or personal shoppers, we may collect information about these interactions and related details (e.g., items requested, order details, dates, prices).
• Content and media you provide. When you create finds, shops or shopping lists, send messages, or otherwise use the Service, we collect the content you submit. This may include photos and images, voice recordings (for example, when you use your voice to create a find or send a voice message in a deal room), documents, and any other text or media you choose to upload. Voice recordings you use to create a find are sent to a third-party artificial-intelligence provider to be transcribed into text. If you, or the other party to a deal room, use a shopping agent, the content of that deal room — including messages from both sides — may be processed by that provider so that the agent can read the conversation and draft replies. To help you, some of this content — for example, an image or shopping-list photo you upload to create a find — may be sent to a third-party artificial-intelligence provider to automatically describe, tag or extract items from it. See Section 7 for the providers we use.
• Location data. We collect your device's precise location only when you take an action that needs it, and only while the app is open: (a) when you tap to add your location while creating a find, to fill in the find's area; (b) when you choose to share your location in a deal room, in which case it is shared with the other party to that deal so that delivery or collection can be arranged; and (c) when you claim a perk at an event we sponsor, to confirm that you are at the venue, in which case we store the location of the claim and your distance from the venue. We do not track your location in the background, and you can decline or revoke this permission at any time in your device settings. Separately, we estimate your country from your IP address (see Section 7).
• Device identifier. We store a randomly generated identifier in your browser or app install. We use it for security — for example to recognise a new device signing in to your account — and to prevent abuse of promotions, such as one person claiming an event perk or referral reward more than once.
• Communications. If you contact us (for example, via email, contact forms or support channels), we will collect the information you provide (such as your name, contact details and the contents of your message).
• Inferred and preference data. Based on your activity — such as the finds you create, the shops and personal shoppers you view, and the items you save — we may derive preferences and an interest profile so that we can personalise and rank what we show you. See Section 3 for how we use this.
• Cookies and similar technologies. We use cookies and similar technologies as described in Section 5 below.

3. How We Use Your Data

We use the information we collect for the following purposes:

• To operate, maintain and improve the Sinatabu platform and services.
• To create and manage your user or merchant account, including authentication and security.
• To enable you to create and respond to finds, discover shops, and connect with merchants, businesses and personal shoppers.
• To facilitate communication between buyers and merchants (for example, messaging and notifications).
• To provide customer support and respond to your inquiries and requests.
• To monitor and analyse usage, performance and trends, and to help us understand how people use Sinatabu.
• To personalise your experience — for example, to recommend and rank finds, shops and personal shoppers that may be relevant to you — using automated analysis of your activity and preferences. This helps us surface more relevant results; it does not produce legal or similarly significant effects for you, and you can contact us if you have concerns about it.
• To help your find reach more merchants by publishing new finds on our official social media accounts, such as our X account (@asksinatabu). These posts never identify you. See "Finds shared on social media" in Section 7.
• To detect, prevent and address fraud, abuse, security incidents and violations of our Terms.
• To comply with legal and regulatory obligations and to protect our rights and the rights of our users.
• To send you notifications about activity on your account (for example responses to your finds, matches, deal updates and reminders) by push notification, email or text message (SMS). You can switch these channels off, including text messages, in your notification settings.
• Where the law allows, to send you marketing communications, promotions, surveys or newsletters that may be relevant to you. You can opt out at any time.

4. Legal Bases for Processing

Where required by law, we rely on one or more of the following legal bases to process your personal information:

• Performance of a contract – to provide the Service and fulfil our obligations under our Terms.
• Legitimate interests – to operate, secure and improve Sinatabu, prevent fraud, and support our business operations, provided these interests are not overridden by your rights.
• Consent – for certain marketing communications, cookies or other uses where we ask for your consent.
• Legal obligations – to comply with applicable laws, regulations and regulatory requirements.

5. Cookies and Similar Technologies

We use cookies and similar technologies (small text files stored on your device) to:

• remember your preferences and settings;
• keep you signed in and secure your session;
• understand how you use our site and improve your experience; and
• support analytics and, where applicable, marketing activities.

Our Cookie Policy lists the cookies we set and lets you change your cookie preferences at any time. You can also control cookies through your browser settings, including blocking or deleting them. However, if you disable certain cookies, some features of the Service may not function properly.
For more information, please refer to your browser's help documentation on managing cookies.

6. Analytics, Crash Reporting and Diagnostics

We may use third-party analytics providers such as Google Analytics to help us understand how users interact with Sinatabu and to improve our services.

These analytics tools use cookies and similar technologies to collect information such as your IP address, device and browser information, and usage patterns. This information is usually transmitted to and stored on servers operated by the analytics provider, which may be located outside Kenya (for example, in the United States).

The analytics provider uses this information to compile reports and provide other services related to website usage and internet activity. They may also share this information with third parties where required to do so by law or where those third parties process the information on their behalf.

You can manage or disable analytics cookies through your browser settings. Google also offers an opt-out browser add-on for Google Analytics. Please note that if you disable analytics, some features or insights may no longer be available to us.

We also use Sentry, a third-party crash-reporting and performance-monitoring service, to detect, diagnose and fix errors, crashes and stability issues in our mobile and web applications. When the app encounters a problem, Sentry collects diagnostic information such as crash logs, performance data, the app version, and device and operating-system details, which we associate with your account identifier so that we can investigate issues affecting your account. We have configured Sentry not to collect your IP address or other default personal identifiers, and we remove sensitive data (such as authentication tokens) from these reports. This information is processed on Sentry's servers, which may be located outside Kenya, and is used solely to maintain and improve the reliability and security of the Service.

7. Data Sharing and Transfers

We do not sell your personal information for advertising purposes. We may share your information with:

• Other users (where necessary). For example, when you are a buyer, we may share relevant information with the merchant or personal shopper to enable them to respond to your find or fulfil your order, and vice versa.
• The public, through our social media accounts. We may publish new finds on our official social media accounts. See "Finds shared on social media" below.
• Service providers and partners (sub-processors). We share information with trusted third parties who provide services to us, such as hosting, analytics, payment processing, communications, push and messaging delivery, location and artificial-intelligence services. These providers are required to handle your data securely and only in accordance with our instructions. The specific providers we currently rely on are listed in the table below.
• Professional advisers. Such as lawyers, auditors or insurers, where necessary for the protection of our business and to comply with legal obligations.
• Authorities and regulators. Where required by law, regulation or legal process, or where we believe it is necessary to protect the rights, property or safety of Sinatabu, our users or others.
• Business transfers. In the event of a merger, acquisition, reorganisation or sale of some or all of our assets, your information may be transferred as part of that transaction, subject to appropriate safeguards.

The third-party service providers we currently use, and the information they receive, include:

We do not sell your personal information for advertising, and we do not use third-party advertising or cross-site tracking networks. This list may change as our providers evolve; we will update it when it does.

Several of these providers are located outside Kenya (for example, in the United States or the European Union). Where we transfer personal information outside Kenya, we will take appropriate steps to ensure that such transfers comply with applicable data protection laws and that your information remains protected.

Finds shared on social media

To help finds get more responses, we may publish new finds that individuals post on Sinatabu to our official social media accounts, including our X account (@asksinatabu). We do this on the basis of our legitimate interest in helping buyers reach merchants and in promoting the Service.

• What a post can include: the find's description, type, budget, quantity, needed-by date, a general location cut down to area and town, up to four of the find's photos, and a link to the find on Sinatabu. The wording may be written with the help of automated tools (see OpenAI above), using only these details.
• What a post never includes: your name, username, phone number, email address or other contact details. We also remove links, emails, social media handles and phone numbers from the text, and strip location data (such as GPS coordinates) from photos before publishing.
• Review: posts are reviewed by our team or by automated checks before they are published.
• What we don't post: finds made by corporate accounts, finds posted by shops or personal shoppers, drafts, and finds that have been hidden, flagged, deleted or have passed their needed-by date.
• Removal: we delete the post automatically if you delete the find, the find is hidden or removed, or you delete your account. You can also object to this use of your find, or ask us to remove a post at any time, by contacting us (Section 12).

Once published, a post is also subject to X's own terms and privacy policy. We cannot control copies that other people make or share before a post is removed.

8. Data Retention

We retain your personal information for as long as necessary to:

• provide the Service and maintain your account;
• fulfil the purposes described in this Privacy Policy;
• comply with legal, accounting or reporting obligations (for example, record-keeping requirements); and
• resolve disputes and enforce our agreements.

When personal information is no longer required, we will take reasonable steps to delete, anonymise or securely store it in accordance with our data retention policies and applicable law. In general terms:

• we keep security, fraud-prevention and access logs (which may include IP addresses) for up to 12 months;
• we retain financial and transaction records for up to 7 years, to meet tax, accounting and other legal obligations;
• we keep the record of your acceptance of our Terms of Service and Privacy Policy for as long as your account exists and for up to 7 years afterwards, in case of a dispute; and
• we may keep aggregated or anonymised statistics, which no longer identify you, indefinitely.

When you delete your account, we remove or de-identify your personal profile information. However, some records that also involve other people — such as messages in a deal room, bookings, bids and reviews — may be retained and shown as coming from a "deleted user", so that the records and history of the other users involved remain intact.

For details on how to delete your account and what happens to your data when you do, see our Account Deletion page.

9. Your Rights

Subject to applicable law, you may have the following rights in relation to your personal information:

• the right to be informed about how we process your personal data;
• the right to access and obtain a copy of your personal data;
• the right to request correction of inaccurate or incomplete data;
• the right to request deletion of your personal data in certain circumstances;
• the right to object to or restrict processing in certain circumstances;
• where processing is based on consent, the right to withdraw your consent at any time; and
• the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) or other relevant authority.

If you live outside Kenya, you may have additional rights under the data-protection law of your own country, and nothing in this Privacy Policy limits them. To exercise any of these rights, please contact us using the details provided in Section 12. We may need to verify your identity before responding to your request.

10. Security

We implement appropriate technical and organisational measures designed to protect your personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us promptly if you suspect any unauthorised access to your account.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements or other factors. When we do, we will post the updated version on this page and update the "last updated" date at the top or bottom of the policy.
We encourage you to review this Privacy Policy periodically. Your continued use of the Service after any changes become effective means you accept the updated Privacy Policy.

12. Contact Us

If you have any inquiries, concerns or requests regarding this Privacy Policy or our handling of your personal information, please contact us by email at support@sinatabu.com, or use the contact details provided on our Help Desk page or any other official channel listed on the Sinatabu website. We are the data controller responsible for your personal information, and you may also use these details to reach us about data-protection matters.

13. Children's Privacy

The Service is for adults only. You must be at least 18 years old to create an account or use the Service, and we do not knowingly collect personal information from anyone under 18. If you believe that someone under 18 has provided us with personal information, please contact us at support@sinatabu.com so that we can take appropriate steps to remove it.