CommodityHub is a commodity price intelligence platform serving Kenya and the wider East African region. This policy explains what information we collect, why we collect it, how we use it, and the rights you have over it.
This policy applies to CommodityHub's web service at commodityhub.co.ke and any SMS, WhatsApp, USSD, or app-based services we operate. CommodityHub is operated as a pre-incorporation venture; legal entity registration is in progress in the United States and Kenya. Once Kenyan incorporation completes, we will register as a data controller with Kenya's Office of the Data Protection Commissioner (ODPC) under the Data Protection Act, 2019.
What we collect
We collect only the information needed to operate the service:
- Phone number — required to create an account, sign in via SMS verification code, and (if you opt in) receive price alerts or digest messages.
- Email address — optional, used only if you choose to add an email to your account for password-based sign-in or account recovery.
- Price submissions — if you contribute prices, we record the commodity, market, unit, price, optional notes, and the timestamp of submission. Your subscriber ID is attached to each submission for moderation purposes.
- Session information — when you sign in, we record the IP address, browser user-agent, and a randomly generated session identifier stored as an HTTP-only cookie. This is used to keep you signed in and to let you review and revoke active sessions from your account page.
- SMS and message logs — for messages we send to or receive from you, we record the phone number, message body, delivery status, and timestamp. This lets us troubleshoot delivery failures and respect opt-out requests.
- Payment information — when you subscribe to a paid tier, we record the M-Pesa transaction reference and the phone number used for payment. We do not store M-Pesa PINs or full transaction credentials; those are handled by Safaricom's Daraja payments platform.
We do not collect biometric data, location data beyond what your IP address implies, or sensitive personal data as defined under the Data Protection Act, 2019.
How we use it
We use your information for these purposes only:
- To verify your identity when you sign in and to maintain your account.
- To send you transactional SMS, such as one-time verification codes and account notifications.
- To deliver price alerts and digest messages that you have explicitly opted in to receive.
- To moderate price submissions, calculate contributor trust scores, and maintain data quality.
- To process payments via M-Pesa for paid subscription tiers.
- To respond to your support requests and to communicate important changes to the service.
- To detect and prevent fraud, abuse, and unauthorized access.
We do not sell your personal information. We do not use it for advertising, and we do not share it with advertisers or data brokers.
Who we share it with
We share the minimum information necessary with the following service providers, each of whom is contractually bound to use the data only to deliver their service to us:
- Twilio Inc. — sends the SMS messages we transmit to you, including verification codes and digest messages.
- Neon, Inc. — hosts our database in their cloud infrastructure (currently US West region).
- Vercel, Inc. — hosts and serves the web application.
- Safaricom PLC (Daraja) — processes M-Pesa payments for paid subscriptions. We share only the phone number and the transaction reference needed to initiate the payment.
We may disclose your information if compelled to do so by valid legal process (such as a subpoena or court order in Kenya, the United States, or another jurisdiction where we operate), but we will resist requests we believe are overbroad or unlawful.
How long we keep it
We keep your account information for as long as your account is active. If you delete your account, we delete your phone number, email, and session records within 30 days. We retain submission records (the prices you submitted) for the integrity of historical data, but with your subscriber ID removed.
Message logs are retained for one year for delivery troubleshooting and regulatory compliance, then deleted. Payment records are retained for seven years to comply with Kenyan tax law.
Your rights
Under Kenya's Data Protection Act, 2019, you have the right to:
- Access the personal data we hold about you.
- Correct any inaccurate or incomplete data.
- Delete your account and the personal data associated with it.
- Object to the processing of your data, including by withdrawing consent.
- Request a copy of your data in a portable, machine-readable format.
- Lodge a complaint with Kenya's Office of the Data Protection Commissioner if you believe we have mishandled your data.
To exercise any of these rights, email us at privacy@commodityhub.co.ke. We respond to verified requests within 30 days.
How to opt out of SMS
Reply STOP to any SMS we send you, and we will not send you further messages. You can also revoke notification consent from your account settings at any time.
Note: opting out of all SMS will prevent you from signing in to your account via phone (which requires a verification code). You can keep access by adding an email address to your account before opting out of SMS, which lets you sign in via email and password instead.
Security
We protect your data with industry-standard measures, including encryption in transit (HTTPS for web traffic, TLS for SMS provider connections, SSL for database connections), strong password hashing (scrypt with high cost factors) for users who set passwords, and principle-of-least-privilege access controls for our team. We do not guarantee absolute security, but we take reasonable steps to prevent unauthorized access.
International transfers
Our database is hosted in the United States (Neon, US West region). When you use the service from Kenya, your data is transferred to and processed in the United States. We rely on the legitimate-interest and contractual-necessity bases under the Data Protection Act, 2019 for these transfers.
Children
The service is intended for users aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a child has provided us with their information, contact us at privacy@commodityhub.co.ke and we will delete it.
Changes to this policy
We may update this policy as the service evolves. If we make material changes (changes that affect what data we collect or how we use it), we will notify you by email or SMS at least 30 days before the change takes effect. Continued use of the service after a change constitutes acceptance of the updated policy.
Contact
Questions about this policy or about how we handle your data, write to privacy@commodityhub.co.ke.