Privacy Policy

1. Information We Collect

We collect information you provide directly:

• Account information: name, email, phone number, and profile photo
• Item reports: descriptions, photos, locations, and identifying details of lost or found items
• Communications: messages sent through the platform regarding claims or inquiries
• Verification data: proof of ownership documents submitted to support claims
• Identity verification (KYC): government-issued ID documents (national ID, passport or driving licence), ID number, full name, date of birth and a selfie, submitted voluntarily by users who wish to receive reward payouts. These are used solely for verification and payout compliance.
• Ratings: star ratings and comments exchanged between owners and finders after a completed return
• Reward payments: payment amount and status processed through Paystack. We never see or store your card or M-Pesa PIN; card details are handled entirely by Paystack.
• Missing person reports: descriptions, photographs, last-seen locations and contact details provided by the reporter. Where a report concerns a child, we apply additional safeguards and prioritise verification.
• Safety reports: abuse, fraud and child-safety reports you file about other users or content

We also automatically collect technical information such as IP address, browser type, device info, and usage data via cookies.

2. How We Use Your Information

• Operate, maintain, and improve the platform
• Facilitate matching lost and found items
• Verify user identities and ownership claims
• Verify identity for reward payouts and prevent payment fraud
• Send notifications about matches, claims, sightings near you, and platform updates
• Review and act on safety and abuse reports
• Prevent fraud, abuse, and policy violations
• Comply with legal obligations

Our legal bases under the Kenya Data Protection Act, 2019 are: your consent (given at registration and before identity verification), performance of a contract with you (operating your account and processing rewards), our legitimate interests in preventing fraud and abuse, and compliance with legal obligations.

3. Information Sharing

We do not sell your personal information. We may share limited data with other users to facilitate item recovery, with service providers who help operate the platform, or when required by law.

Specific processors we share data with: Supabase (database, authentication and file storage), Paystack Payments Limited (reward payment processing), Vercel Inc. (application hosting), and Google (sign-in and push notifications). Each processes data only on our instructions.

4. Data Security

We implement industry-standard security measures including encryption in transit (TLS) and at rest, role-based access controls, rate limiting, and strict internal access to verification documents. However, no electronic storage method is 100% secure.

5. Data Retention

We retain your data for as long as your account is active. When you delete your account, your data is deleted within 30 days unless retention is legally required. More specifically:

• Listings: publicly visible for 30 days, after which they expire; personal data on expired listings is retained only while your account is active
• Identity documents: deleted within 90 days of verification being approved, rejected (after any appeal window), or of account closure — whichever comes first
• Payment records: retained as required by tax and accounting law
• Safety reports: retained while needed for platform safety decisions

6. Your Rights

You may access, correct, or delete your personal data, withdraw consent, object to processing, and request data portability. You can request account deletion directly from your profile page. To exercise other rights, contact privacy@secudox.com. We respond within 7 days.

7. Data Breaches

In the unlikely event of a personal data breach likely to cause harm, we will notify the Office of the Data Protection Commissioner within 72 hours as required by the Kenya Data Protection Act, 2019, and affected users where the breach is likely to cause significant harm.

8. Children's Privacy

Missing person reports may include data about minors, submitted by guardians or concerned parties for reunification purposes only. This data is not used for marketing, is access-restricted internally, and child cases receive priority handling. Accounts on Secudox require users to be 18 or older.

9. Third-Party Services

We use Google OAuth for authentication and Supabase for database infrastructure. Their respective privacy policies apply to data they process on our behalf.

10. Contact

For privacy inquiries: privacy@secudox.com. Secudox Management Systems, Nairobi, Kenya.