1. Who we are
Soukh is a marketplace for second-hand household goods. Sellers list items; buyers find them and contact the seller directly by phone or WhatsApp. Soukh does not process payments between users. Soukh is the data controller for the personal data described here and processes it in line with the Data Protection Act, 2019 of Kenya. You can reach us at support@soukh.app.
2. What we collect
Information you give us
- Account details — your name, email address and/or phone number, and a password (stored only as a one-way hash).
- Phone verification — your phone number and the one-time code we send by SMS. A verified phone number is required to publish listings.
- Profile — a display name and any profile details you choose to add, and your preferred language.
- Listings — titles, descriptions, prices, condition, category, photos and videos you upload, and the area where the item is located.
- Reports — when you report a listing or a user, the reason and any details you include.
- Messages to us — anything you send to our support team.
Information collected as you use the Service
- Location — with your permission, your device’s location so we can show listings near you and suggest your listing’s area. You can deny or revoke this in your device settings at any time; the app still works, you’ll just pick an area manually.
- Activity in the app — listings you save as favourites, listings you’ve recently viewed, and when you tap to call or WhatsApp a seller.
- Device information — a push-notification token (if you allow notifications), device type, operating system and app version.
- Technical logs — IP address, request times and error information our servers record to keep the Service secure and working.
We do not use advertising identifiers, we do not run third-party advertising or analytics trackers in the app, and we do not access your contacts.
3. How we use it
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and secure your account, sign you in, reset your password | Account details, phone verification, device and log data | Contract |
| Publish your listings and show buyers listings near them | Listings, location, profile | Contract |
| Connect buyers and sellers by phone or WhatsApp | Seller’s phone number, contact events | Contract |
| Review listings before they go live, handle reports, prevent fraud and abuse | Listings, reports, account and log data | Legitimate interests; legal obligation |
| Send notifications about your listings (e.g. approved, rejected) and saved items | Push token, email address | Contract; consent for push notifications |
| Record featured-listing fees paid to us off-platform | Account details, payment reference you give us | Contract; legal obligation (accounting) |
| Keep the Service running, fix bugs and improve features | Device and log data, activity in the app | Legitimate interests |
4. What other users see
- Your listings are public once approved: photos, title, description, price and the general area (for example, a neighbourhood). We never show your precise location or address.
- Your seller profile shows your display name and your other approved listings.
- Your phone number is not displayed on listings or profiles. It is revealed to a buyer only when that buyer chooses to call or WhatsApp you about one of your listings. Once they have it, how they use it is outside our control — please report misuse.
5. Who we share it with
We do not sell your personal data. We share it only with service providers who help us run the Service, under contracts that limit their use of it to providing that service to us:
- Cloud hosting and storage — servers, databases, and storage and delivery of listing photos (including Cloudflare).
- Email delivery — to send verification, password-reset and account emails (Resend).
- SMS delivery — to send phone-verification codes.
- Push notifications — Expo’s push service, Google Firebase Cloud Messaging (Android) and Apple Push Notification service (iOS).
- Maps — map tiles are loaded from OpenStreetMap, which receives your IP address and the map area being viewed, but not your account details.
- WhatsApp and your phone — when you choose to contact a seller, the app hands the seller’s number to WhatsApp or your phone dialler; their own privacy terms apply from then on.
We may also disclose information where required by law, to respond to a valid request from a public authority, or to protect the safety of our users and the public — for example, when investigating fraud.
6. How long we keep it
- We keep your account data for as long as your account is open.
- When you delete your account, we remove or anonymise your personal data within 30 days. Your listings are archived and no longer visible; your favourites, recently viewed items, notifications and device tokens are deleted.
- We keep a small set of records after deletion where we must: records of featured-listing fees (for accounting and tax), and moderation and audit records (to deal with fraud and legal claims). These are anonymised so they no longer identify you, except where the law requires otherwise.
- Server logs are kept for a limited period and then deleted.
7. How we protect it
All traffic between the app and our servers is encrypted with HTTPS. Passwords are stored as salted hashes, never in plain text. Access to personal data is limited to staff who need it to operate and moderate the Service. No system is perfectly secure, so please use a strong, unique password and tell us right away if you think your account has been compromised.
8. Your rights and choices
Subject to the law, you have the right to:
- Access the personal data we hold about you and get a copy of it.
- Correct inaccurate data — most of it you can edit directly in the app.
- Delete your account and personal data — in the app under Profile → Delete account, or via our account deletion page.
- Object to or ask us to restrict certain processing.
- Data portability — receive your data in a commonly used format.
- Withdraw consent — turn off location or notifications in your device settings at any time.
To exercise these rights, email support@soukh.app. We may need to verify your identity first and will reply within the time the law requires. If you’re unhappy with our response, you can complain to the Office of the Data Protection Commissioner (ODPC) in Kenya.
9. Children
The Service is for adults. You must be at least 18 years old to create an account. We don’t knowingly collect data from children; if you believe a child has given us personal data, contact us and we’ll delete it.
10. International transfers
Some of our service providers store or process data outside Kenya. Where that happens, we rely on providers that offer appropriate safeguards for your data, as the law requires.
11. Changes to this policy
We may update this policy as the Service changes. We’ll change the “last updated” date above and, for significant changes, let you know in the app or by email before they take effect.
12. Contact us
Questions or requests about your privacy: support@soukh.app.