Privacy Policy — strixbi Marketplace

strixbi ("strixbi", "we", "us") operates the strixbi marketplace — a classifieds platform in Kenya where buyers browse listings, post requests for matched quotes, and chat with sellers, and where sellers publish ads and run shops. This Privacy Policy explains what personal data we collect through the marketplace website and mobile apps, why we collect it, who we share it with, and your choices. Questions: privacy@strixbi.com.

We collect data you provide and data generated when you use the marketplace as a buyer or seller:

• Account data: name, phone number, email, profile photo, and sign-in method (email, phone one-time code, Google, Facebook, or Apple). When you use Google, Facebook, or Apple sign-in we receive your name, email address, and profile picture from that provider — see Section 5. Sessions are managed by Clerk.
• Verification data: SMS one-time codes for phone verification; for sellers, an optional KRA PIN (format check only — we do not verify against iTax).
• Marketplace location: ward, constituency, and county you set for browsing, quote matching, and your shop. Used to show local listings and match nearby sellers — not continuous GPS tracking.
• Buyer activity: searches, browsed categories, saved favourites, buyer requests you post, quotes you receive or accept, and chat messages with sellers.
• Seller activity: shop profile, listings and photos, prices, quotes you send, subscription plan, ad campaigns, ad-wallet balance, and chat with buyers.
• Listing photos: images you upload for ads. Embedded GPS/EXIF metadata is stripped before storage; images are screened for safety before publication.
• AI assistant: messages to the marketplace assistant (e.g. drafting a buyer request or editing a listing), plus context such as search terms or listing details when signed in.
• Advertising: for sellers running paid ads — campaign settings, wallet top-ups, and click events (hashed fingerprints from IP and browser type to filter duplicate or fraudulent clicks).
• Billing: seller subscriptions and ad purchases are processed by Paystack. strixbi does not see or store your full M-Pesa or card credentials. We do not process payment data for goods sold between buyers and sellers.
• Usage and device data: pages viewed, device type, browser, app version, and approximate IP-based location — for search relevance, fraud prevention, and product improvement.
• Cookies and tokens: session cookies and bearer tokens to keep you signed in and to power real-time marketplace chat. Google Analytics and Microsoft Clarity cookies are used in production to measure site usage and improve the product.

• To create your buyer or seller account and verify you are a real person.
• To show listings and shops near you, rank search results, and match buyer requests to relevant sellers.
• To operate in-app chat and notifications between buyers and sellers.
• To power the marketplace AI assistant — helping buyers describe what they need and helping sellers manage listings and ads.
• To deliver, measure, and bill seller advertising (pay-per-click campaigns and listing boosts).
• To bill seller plans (Starter, Pro Seller, Pro+, Enterprise) and issue invoices.
• To detect fake listings, fraud, and abuse, and enforce our Terms of Service.
• To send account, quote, billing, and safety notifications.

We do not sell your personal data. We share data with service providers needed to run the marketplace:

• Clerk — sign-in and account sessions (including Google, Facebook, or Apple when you choose those options).
• Twilio — SMS one-time codes for phone verification.
• Paystack — seller subscription and ad-wallet payments only (not buyer–seller goods payments).
• Cloudflare (R2) — stores and serves listing photos.
• Google Cloud (Vertex AI) — marketplace AI assistant, photo safety screening, and search/moderation. Data may be processed outside Kenya.
• Resend — transactional emails (welcome, billing receipts).
• Google Analytics 4 — usage measurement (pages viewed, Core Web Vitals, and similar events) to understand traffic and improve the marketplace.
• Microsoft Clarity — session recordings and heatmaps (clicks, taps, and scroll) to diagnose UX issues and improve the product.
• We may disclose data if required by law, to protect marketplace users, or in connection with a business transfer.

When you choose Sign in with Google, Google shares a limited profile with strixbi through our authentication provider, Clerk. We request only the openid, email, and profile scopes, which give us:

• your Google account email address, and whether Google has verified it;
• your basic Google profile: your name and your profile picture URL;
• a stable Google account identifier, used to recognise you when you sign in again.

We use this Google data only to create and secure your strixbi account, sign you in, show your name and photo on your profile, and contact you about your account. We do not use Google user data for advertising, we do not sell or rent it, and we do not share it with anyone except the service providers in Section 4 who run strixbi on our behalf, or where the law requires it.

strixbi's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. The same applies to data we receive from Facebook and Apple sign-in.

You can revoke strixbi's access at any time from your Google Account permissions. Deleting your strixbi account deletes the Google profile data we stored, subject to the retention periods below. See our Data Deletion Instructions.

When you pay a seller for an item (M-Pesa, cash, etc.), that transaction happens directly between you and the seller. strixbi does not receive, store, or process payment details for marketplace sales between users. Our payment processors only handle fees you pay to strixbi — such as a seller subscription or ad top-up.

We keep marketplace data while your account is active and for a limited period after deletion to meet legal and tax obligations (e.g. seller invoices under Kenyan tax rules). Chat, listings, and quotes are deleted with your account unless you remove them sooner. AI conversation logs are kept only as long as needed to operate the feature.

Under Kenya's Data Protection Act, 2019, you may access, correct, or request deletion of your data. Delete your account from seller settings, or see our Data Deletion Instructions. Other requests: privacy@strixbi.com.

Data is encrypted in transit (HTTPS/TLS). Production access is restricted to authorised personnel. No system is perfectly secure; we cannot guarantee absolute security.

The marketplace is not for anyone under 18. We do not knowingly collect data from children.

We may update this policy as marketplace features grow. Material changes are reflected in the date above; continued use after a change means you accept the revised policy.

Marketplace privacy questions: privacy@strixbi.com.