Privacy Policy

Who we are

Kaya Leta is operated by Scratch Limited, a company registered in Tanzania (“Scratch”, “we”, “us”). We are the data controller for the information described in this policy.

This policy applies to everyone who uses Kaya Leta — people who buy, people who sell, and anyone who visits kayaleta.com. Kaya Go riders who deliver orders are covered by their own agreement with Kaya Go.

What we collect

We collect only what we need to run a marketplace and get orders to your door. In practice that is:

• Account and identity — your phone number, which you sign in with using a one-time code sent over WhatsApp; your name; and, if you use Sign in with Apple, the name and email address Apple shares with us (Apple may give us a relay address instead of your real one).
• Addresses and location — the delivery addresses you save, and your device’s location at the moment you choose to use it to pick an address or find shops near you. We do not track your location in the background.
• Orders and cart — what is in your cart, your order history, amounts, delivery details and any notes you add for the seller or rider.
• Wallet and payments — your Kaya Leta wallet balance, top-ups, transfers between wallet members and payment transactions. We keep transaction records. We never see or store your mobile money PIN.
• Messages and calls — the in-app chat messages you exchange with sellers, buyers and riders, and the fact that an in-app voice call took place. Calls are connected through our servers; we do not keep recordings of call audio.
• Notifications — a push notification token for your device, so we can tell you when an order moves or a message arrives.
• Seller verification (KYC) — if you register as a seller: your full legal name, a photo of your face and a photo or PDF of a government-issued ID. These are reviewed by our staff to confirm who runs a shop.
• Seller content — shop name and details, opening hours, product photos, prices and descriptions you upload.
• Diagnostics — crash reports and basic device information (device model, operating system version, app version) so we can find and fix problems.

How we use it

• To run the marketplace — showing you nearby shops, taking your order, processing payment and getting the order delivered.
• To connect you with the other side of an order — so a seller can prepare it, a rider can find you and you can reach each other if something changes.
• To send you notifications about your orders, messages and calls.
• To verify sellers, keep the marketplace safe and prevent fraud.
• To answer you when you contact support.
• To understand what breaks and improve the app.
• To meet our legal obligations in Tanzania, such as keeping financial records.

We do not use your data to build advertising profiles, and we do not show you third-party advertising.

Who we share it with

We do not sell your personal information. We share it only with the people and services needed to complete what you asked for:

• Sellers see what they need to fulfil your order — your name, the items, your delivery address and a way to contact you about that order.
• Kaya Go riders see the pickup and drop-off addresses, your name and a way to reach you, only for the delivery they are carrying.
• Service providers who help us run the app — hosting, sending the WhatsApp sign-in code, delivering push notifications through Apple and Google, and payment providers who process top-ups and payouts. Each receives only what it needs for its job.
• Authorities, where Tanzanian law requires us to.

Where it is stored and for how long

Your data is stored on servers operated by Scratch Limited. We keep it for as long as your account is active and for as long afterwards as we need it to resolve disputes, prevent fraud or meet a legal duty.

Payment and wallet transaction records are kept for the period Tanzanian financial and tax law requires, even after an account is closed. Seller verification documents are kept while the seller account is active and for a limited time afterwards for fraud prevention.

Your choices

• Location — you can deny or revoke location permission in your phone’s settings and type addresses instead.
• Notifications — you can turn push notifications off in your phone’s settings.
• Addresses and profile — you can edit or remove saved addresses and update your name in the app.
• Access and correction — you can ask us for a copy of the personal data we hold about you, or ask us to correct it.
• Deleting your account — in the app (Profile → Edit profile → Delete account), at kayaleta.com/delete-account, or by emailing support@kayaleta.com from the email on your account. The account is deleted 30 days after you ask, and you can cancel before then by signing in to the app. We then remove your personal data, except records we are legally required to keep (for example, transaction records).

Security

Data travels between your phone and our servers over encrypted connections. Access to personal data — and especially to seller verification documents — is limited to staff who need it for their work. No system is perfectly secure; if you believe your account has been accessed without your permission, tell us right away.

Children

Kaya Leta is not intended for anyone under 18 without a parent or guardian. We do not knowingly collect personal information from children. If you think a child has created an account without a guardian, contact us and we will remove it.

Changes to this policy

This is the first version of this policy. When we change it, we will post the new version here with a new effective date, and tell you in the app if the change is significant.

Contact

Questions, requests or complaints about your data: support@kayaleta.com. You can also write to Scratch Limited, Tanzania.