Privacy Policy

Garisea (“Garisea,” “we,” “us,” or “our”) is a vehicle classifieds marketplace serving Kenya. We connect buyers with verified car dealers across the country. This Privacy Policy explains what personal information we collect when you use Garisea (the website at garisea.com, the dealer dashboard at dealer.garisea.com, and the Garisea mobile apps for iOS and Android), how we use it, who we share it with, and the rights you have over your data.

Garisea is operated by Francton LLC, the legal entity behind the platform. For privacy matters, our contact is [email protected]. Mailing address available on request.

This Policy is written to comply with the Kenya Data Protection Act, 2019and is aligned with the principles of the EU General Data Protection Regulation (GDPR) where applicable. By using Garisea you agree to the practices described here. If you don't agree, please don't use the platform.

The data controller for personal information you share with Garisea is Francton LLC, operating as Garisea. When dealers list vehicles or respond to inquiries on the platform, they act as independent data controllers for the information they collect about you outside the platform (e.g. when you call them, visit their lot, or complete a sale). The boundary is:

• In-app or on-web actions (inquiries you send, messages you exchange through Garisea, listings you save, reviews you leave) — Garisea is the controller.
• Off-platform interactions(a phone call after we connect you, an email the dealer sends from their own account, a visit to the dealer's premises) — the dealer is the controller. Their own privacy practices apply to that data.

We collect personal information in three ways: information you give us directly, information we collect automatically when you use Garisea, and information we receive from third parties.

3.1 Information you give us

• Account information — name, email address, password (stored as a salted bcrypt hash; we never see the plaintext), phone number. Dealers additionally provide a dealership name, KRA PIN, physical address, and contact phone.
• Profile information — profile photo, language preference, currency, theme.
• Inquiry content— the message you send to a dealer, the vehicle you're asking about, your contact preferences (call / WhatsApp / email / in-app chat).
• Trade-in details — when you request a trade-in valuation, the make / model / year / mileage / condition photos of your current vehicle.
• Test-drive requests— preferred date, viewing location (the dealer's lot OR a location you propose), any notes you add.
• Financing and insurance requests — when you ask for a quote, the relevant inputs you provide (e.g. requested loan term, down payment, vehicle of interest). We share this with licensed partners — see Section 6.
• Reviews and ratings — text + star ratings + any review photos you upload of a dealer or vehicle.
• Support tickets — anything you write to us at [email protected] or through the in-app help center.
• Payment information (dealers only)— when dealers top up their wallet or buy packs, payment details are entered directly on our licensed Kenyan payment service provider's hosted checkout. Garisea does NOT see, store, or process card numbers or M-Pesa PINs. We receive only the transaction outcome (success / failure / amount / reference) from the payment provider's webhook.

3.2 Information collected automatically

• Device and browser information — IP address, browser type and version, operating system, device model, screen size, language, timezone.
• Mobile app identifiers — a per-install identifier and a device push-notification token used to deliver push notifications to your device. On iOS, the Advertising Identifier (IDFA) is collected ONLY if you grant App Tracking Transparency consent on first launch; we default this to off.
• Usage data— pages you visit, vehicles you view, searches you perform, time spent, clicks. Used to rank listings, populate “recently viewed,” and improve the marketplace.
• Location — when you grant permission, your approximate or precise location is used to show nearby dealers and populate the viewing-location field on test-drive requests. You can revoke location access in your OS settings at any time.
• Crash and performance data — when the app crashes or a request errors, we capture the stack trace, app state, and your user ID (so we can correlate, not so we can identify you to a third party). Handled by a third-party crash-monitoring provider with PII scrubbed in transit — see Section 6.
• Cookies and local storage — session cookies for authentication, CSRF tokens, preference flags. See our Cookie Policy for the full inventory.

3.3 Information from third parties

• Google Sign-In— when you sign in with Google, we receive your name, email, profile picture URL, and a Google account identifier. We don't receive your Google password.
• Apple Sign-In — when you use Sign in with Apple, we receive an Apple-issued identifier (the sub claim) and, on first sign-in only, your email (or a relay address from Apple if you chose “Hide my email”) and full name if you allowed sharing. We also exchange the one-time authorization code for a refresh token so we can revoke your Apple session at account deletion (Apple guideline 5.1.1(v) requires this). The refresh token is encrypted at rest (AES-256-GCM).
• Financing partners— when a licensed financing partner replies to a quote you requested, we receive the quote terms they're offering you and surface them in your inbox.
• Insurance partners — same pattern as financing partners.

We use the information we collect to:

• Provide the marketplace — show you vehicle listings, let dealers post inventory, route your inquiries to the right dealer, schedule test drives, calculate financing estimates, request insurance quotes.
• Connect you with the right vehicles and dealers— rank search results by relevance, populate “Recently Viewed” and “Saved Vehicles,” surface verified dealers, show buyer-trust signals (reviews, badges).
• Communicate with you— send transactional emails (account verification, password reset, inquiry receipts, test-drive confirmations), in-app push notifications (new lead, dealer response, price drop on a saved vehicle), and SMS for one-time passcodes via Africa's Talking.
• Send you marketing communications — newsletters, featured-vehicle digests, partner promotions. You can opt out anytime from your Notification Preferences. Transactional emails (account/security/payment) are not optional while you have an account.
• Prevent fraud and abuse — rate-limit inquiries, detect suspicious account creation, validate listings against our Acceptable Use Policy, investigate reported content, suspend or ban repeat offenders.
• Improve the platform — aggregate usage analytics (web with consent, in-app screen events) to understand which features people use, which listings convert, where users drop off.
• Process payments (dealers)— relay subscription and pack-purchase orders to our payment service provider; credit the dealer's wallet on the provider's confirmation webhook; generate VAT-compliant invoices and receipts (Kenya VAT rate set in admin Settings).
• Comply with legal obligations — respond to lawful requests from Kenyan regulators, courts, or law enforcement; retain transaction records for the 7-year statutory period.

Under the Kenya Data Protection Act 2019 and GDPR (Art. 6 where applicable), our lawful basis for processing your personal information is:

• Contract performance — we need to process your data to provide the marketplace service you signed up for (inquiries, listings, transactions).
• Legitimate interests— we have a legitimate business interest in keeping the platform safe (fraud prevention, security), improving it (analytics, A/B testing), and operating it (sub-processor relationships). We balance these against your rights and limit data use to what's necessary.
• Consent — for optional things like marketing emails, App Tracking Transparency on iOS, location access, push notifications. You can withdraw consent at any time without affecting other uses.
• Legal obligation — for things like KRA-compliant invoicing, audit log retention, responding to lawful regulator requests.

We share your information only when needed to provide the service, with your consent, or when required by law.

6.1 With dealers

When you send an inquiry, request a test drive, or submit a trade-in valuation through Garisea, we share your name, contact details (phone, email — depending on your contact preference), and the message content with the dealer you're inquiring about. The dealer needs this to respond. If you never inquire about a dealer's vehicles, that dealer never sees your information.

6.2 With financing and insurance partners

When you request a financing or insurance quote, we share the information you provided in that request with the relevant licensed partner (e.g. requested loan term, vehicle of interest, your contact details). Partners are independent businesses and have their own privacy policies — we recommend you review those before submitting a quote request.

6.3 With service providers

We use trusted third-party service providers to run Garisea. Each is bound by a data-processing agreement that limits how they may use your information. The categories of providers we engage are:

• Payment processing — to charge dealer subscriptions, packs, and wallet top-ups (your card / M-Pesa details are handled directly by the payment provider; Garisea does not see or store them).
• Email and SMS delivery — to send transactional messages (account verification, password reset, lead alerts, invoices) and, with consent, marketing communications and one-time passcodes.
• Cloud hosting and database — to run the Garisea API, web apps, and primary database. Data is encrypted in transit and at rest.
• Content delivery and image / video hosting — to serve vehicle photos, profile pictures, review images, and verification documents at scale.
• Push notifications — to deliver lead-update, message, and price-drop alerts to your device.
• Crash and error monitoring — to capture anonymized error reports so we can fix bugs (PII is scrubbed in transit).
• Aggregate web and in-app analytics — gated on the consent you set in the cookie banner; helps us understand which features get used.
• Maps and location autocomplete — to render dealership maps and pre-fill viewing-location fields.
• Bot mitigation and DDoS protection — to keep the platform safe from automated abuse.
• Background job scheduling — to run time-sensitive workflows like billing reminders and notification fan-out.
• AI-assisted features — limited use of large-language-model providers for lead suggestions and listing-description help. Content is sent under zero-data-retention agreements; no personal data beyond what the dealer explicitly entered is included.

We periodically review our provider list and add or remove providers as the platform evolves. Material changes to the processing arrangement (a new category of provider, a new jurisdiction) are reflected in this Policy and notified per §17.

We do not sell your personal information to anyone. We do not share it with advertisers for retargeting outside Garisea.

6.4 Legal disclosure

We may disclose your information when required by Kenyan law — for example, a lawful court order, a regulator's formal request, or a criminal investigation by the Directorate of Criminal Investigations (DCI). We'll notify you of the request unless legally prohibited from doing so.

6.5 Business transfers

If Garisea is sold, merged, or restructured, your personal information may be transferred to the acquiring entity under the same privacy commitments. We'll notify you by email before any such transfer.

We keep your personal information only as long as we need it for the purposes described in this Policy, then delete or anonymize it.

• Active accounts — your profile, preferences, and account-linked data are kept while your account is open.
• After account deletion — personally identifiable data is removed from active systems within 30 days. Anonymized usage / analytics derivatives may be retained indefinitely (they no longer link back to you).
• Notifications — kept for 90 days, then purged.
• Search history — personal search history (queries linked to your account or device) is anonymized after 90 days.
• Leads and reviews— kept while your account is active. After account deletion, leads are removed within 30 days. Reviews stay live to inform other buyers, but your name is replaced with “Former user.”
• Transaction records (dealers) — payment, invoice, and receipt records are retained for 7 years as required by Kenyan tax law (KRA records-retention rules).
• Audit log — moderation actions, account state changes, data exports, and deletions are kept for 7 years regardless of account state, for compliance and dispute reconstruction.
• Backups — automated database backups may retain your data for up to 30 days after deletion. Backups are access-restricted and used only for disaster recovery.

We take security seriously and apply industry-standard safeguards:

• Encryption in transit — all connections to garisea.com, dealer.garisea.com, api.garisea.com, and the mobile app use TLS 1.2 or higher.
• Encryption at rest — the production database encrypts data at rest. Sensitive secondary credentials (Apple Sign-In refresh tokens) are additionally encrypted with AES-256-GCM before storage.
• Passwords— never stored in plaintext. We use bcrypt with a per-password salt; even an internal employee with full DB access can't see your password.
• Authentication tokens — short-lived JWT access tokens (30 minutes) + refresh-token rotation. Stored on mobile in the device Keychain (iOS) / Keystore (Android); on web in httpOnly cookies with the SameSite attribute.
• Account lockout — after 5 failed login attempts in 30 minutes, the account is temporarily locked. We notify you by email.
• Webhook signature verification — all incoming webhooks (payment confirmations, email bounce reports, media upload notifications) verify HMAC signatures before being trusted.
• Access controls — engineer access to production data is role-based, audited, and time-bounded. Customer support staff see only the minimum data needed to help you.
• Regular reviews — we periodically review our infrastructure, dependencies, and code for security issues. We rotate secrets on a 90-day cadence and immediately on suspected compromise.

No system is 100% secure. If we ever detect a personal data breach affecting your account, we will notify you and the Office of the Data Protection Commissioner within 72 hours of becoming aware, as required by the Kenya Data Protection Act 2019.

Under the Kenya Data Protection Act 2019 (Sections 26–33) and GDPR (Articles 15–21) where applicable, you have the following rights:

• Right of access — request a copy of the personal information we hold about you. Available in-app: Profile → Download My Data generates a comprehensive export in JSON format and emails you a download link.
• Right to correction — fix inaccurate information. Most fields are editable directly in Profile → Settings. For things you can't edit yourself (e.g. email change with verification), email [email protected].
• Right to erasure (“right to be forgotten”) — delete your account and personal data. Available in-app: Profile → Delete Account. Personal data is removed within 30 days. Some data must legally be retained (transaction records for KRA, audit logs for 7 years) — those stay in their existing form.
• Right to data portability — receive your data in a structured, machine-readable format. The export from Profile → Download My Data is JSON and includes your profile, listings (dealers), inquiries, saved vehicles, reviews, and notification preferences.
• Right to object — object to processing based on legitimate interests (e.g. marketing emails). Toggle off in Profile → Notification Preferences, or email [email protected].
• Right to withdraw consent— where we process based on consent (App Tracking Transparency, location, push notifications, marketing), you can withdraw consent at any time from your device settings or in-app preferences. Withdrawal doesn't affect processing that already happened.
• Right to restrict processing — ask us to pause processing of your data while we investigate a complaint. Email [email protected].
• Right to lodge a complaint — if you believe we've mishandled your data, you can complain to the Office of the Data Protection Commissioner (Kenya).

We respond to rights requests within 30 days, as required by law. Our Data Protection Officer is reachable at [email protected].

Garisea's primary infrastructure runs on cloud providers with servers primarily located in Europe and the United States. When we transfer your personal data outside Kenya, we rely on the recipient's certifications (e.g. EU-US Data Privacy Framework participants) or contractual safeguards equivalent to the Kenya Data Protection Act 2019. We never transfer data to a jurisdiction without comparable privacy protections.

We do not collect special-category data — racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, or sexual orientation. If you accidentally include sensitive information in a review, message, or support ticket, you can ask us to delete it.

Garisea is for adults aged 18 and over. We don't knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact [email protected] and we'll delete it promptly.

With your consent, we may send you marketing emails (newsletter, featured vehicles, dealer promotions) and push notifications.

You can opt out anytime by:

• Clicking Unsubscribe at the bottom of any marketing email.
• Toggling categories off in Profile → Notification Preferences.
• Disabling push notifications in your device's OS settings.

Transactional and security communications (verification codes, password resets, account-deletion confirmations, payment receipts) are not optional while you have an active account.

The Garisea mobile app for iOS and Android requests these permissions. Each is optional except as noted, and you can revoke any of them in your OS settings at any time.

• Camera— to take photos of vehicles you're listing, profile photos, or trade-in submissions.
• Photo library — to attach existing photos from your camera roll to listings, reviews, or support tickets.
• Location (when in use) — to show nearby dealers and pre-fill the viewing-location field on test-drive requests.
• Notifications — to deliver lead updates, message alerts, price drops, and account notices. You can disable notifications entirely or per-category.
• App Tracking Transparency (iOS only) — controls whether we can correlate your in-app analytics with the Advertising Identifier (IDFA). Defaults to off; you must explicitly allow tracking for it to happen.

On-device storage we use:

• iOS Keychain / Android Keystore — authentication tokens (encrypted by the OS, never included in backup).
• SharedPreferences (Android) / UserDefaults (iOS) — user preferences (theme, language, last-viewed location).
• Hive boxes — local cache of recently viewed vehicles, search history (anonymized after 90 days server-side).
• Image cache — vehicle photos cached for offline viewing. Excluded from cloud backup.

Apple's Privacy Manifest (PrivacyInfo.xcprivacy) shipped with the iOS app declares each data type we collect and the corresponding purpose, matching this Privacy Policy. Google Play's Data Safety form has the same declarations.

Our use of cookies, local storage, and device storage is described in detail in our Cookie Policy. You can manage cookie preferences via the consent banner on first visit and in your browser settings at any time.

Garisea uses automated systems to rank search results, recommend vehicles, score lead intent (showing dealers a Cold-to-Very-Hot indicator), and filter clearly-fraudulent listings. None of these decisions have a significant legal or material effect on you in the sense of Section 35 of the Kenya Data Protection Act — they affect what order things appear in, not whether you can transact. If you believe an automated decision (e.g. a listing wrongly hidden, a review wrongly flagged) has materially harmed you, contact [email protected] and we'll review the outcome with a human moderator.

We may update this Privacy Policy from time to time as the platform evolves or as the law requires. Material changes will be communicated by email at least 14 days before they take effect, and by an in-app notice. The “Last updated” date at the top of this page will reflect the most recent revision. Continuing to use Garisea after an update means you accept the updated Policy.

For privacy questions, complaints, or to exercise your rights:

• Email: [email protected] (Data Protection Officer)
• Support: [email protected]
• Trust & safety: [email protected]
• Legal: operated by Francton LLC.

To complain to the Kenyan data-protection regulator: Office of the Data Protection Commissioner — www.odpc.go.ke.