Privacy Policy

Version 2026-10-09

Draft — pending legal review

This text describes how Dabi works today. Details in brackets are still being confirmed, and the wording may change after legal review.

How Dabi AutoHub collects, uses, shares and protects your personal data, and the rights you have over it under the Kenya Data Protection Act, 2019.

Who we are

Dabi AutoHub (“Dabi”) is run by [LEGAL ENTITY NAME], [REGISTERED ADDRESS], the data controller for the personal data on Dabi. We are registered with the Office of the Data Protection Commissioner (ODPC) as [ODPC REGISTRATION NUMBER]. You can reach our Data Protection Officer at [DPO EMAIL].

What we collect

Account: your name, username, email address, phone number and password (stored only as a one-way hash), or your Google sign-in identifier if you sign in with Google.
Profile: photo, bio, town or area, gender (hidden unless you choose to show it) and date of birth (private; only an age band like 25–34 is ever shown).
Verification: the identity, licence, certificate and business documents and selfies you upload. ID and licence numbers are stored only as a one-way code, so the number itself can’t be read back.
Vehicles and listings: vehicle details, registration and chassis numbers, photos, insurance and compliance records, prices and terms.
Activity: bookings, offers, enquiries, reviews, saved items and the figures you agree with other members.
Payments to Dabi: for subscriptions and adverts, the M-Pesa transaction reference and amount. We never store card numbers, bank details or M-Pesa PINs.
Security records: your IP address and device details when you sign in, reset a password or confirm a code, and a log of who opened a restricted document.
Cookies and browser storage: see the Cookie Policy.

We don’t store your exact home address, bank account details or mobile-money settlement details.

Why we use it

To run the marketplace you signed up for: your account, listings, bookings, offers and reviews (performance of our contract with you).
To verify identities and documents, detect duplicate or fraudulent accounts, and keep the platform secure (our legitimate interests, and legal obligations where they apply).
To send you service messages about your bookings, offers, verifications and expiring documents.
For optional cookies and marketing messages, only with your consent, which you can withdraw at any time.

We don’t sell your personal data, and we don’t make decisions about you that have legal effects using automated processing alone.

Who can see what

Anyone: your display name, photo, bio, town, verification badges, member-since date, ratings and reviews — and, on a driver or mechanic page, your verified phone number partly hidden (like 0722 ***485) unless you hide it, and your email partly hidden only if you choose to show it (Settings › General). Logged-in members also see these partly hidden details on your profile and in the contact box on your listings.
Logged-in members: the full phone number or email behind those partly hidden ones, with one tap. Every reveal is logged, and there is an hourly limit. Gender is shown only if you choose to.
The other party to your booking: the exact pickup point once the booking is confirmed.
Only you: your date of birth, cancellation rate, saved items, notification and privacy settings.
Only Dabi’s verification team: your identity and licence documents, selfies and certificates.

Who we share it with

Service providers who process data for us under contract: Vercel (hosting), our database provider, Resend (email), Google (if you sign in with Google) and Safaricom (M-Pesa payments). Some of them process data outside Kenya; where they do, we rely on the safeguards the Act requires, such as contractual clauses: [SAFEGUARDS TO BE CONFIRMED]. We share data with authorities only where the law requires it.

How long we keep it

Verification documents: deleted 90 days after the verification decision. The result (verified or not) is kept.
One-time codes and password-reset links: deleted 30 days after they expire.
Sign-in attempt records: deleted after 90 days.
The access and action log for restricted data: kept, as the record of who did what.
Bookings and reviews: kept, because they are the other member’s records too. If you close your account they stay, shown as “Deleted user”.

Your rights

Under the Data Protection Act you can:

be told how your data is used (this policy);
get a copy of your data, in a portable format — Settings › Your data › Download my data;
correct it — Settings › General;
have it deleted by closing your account — Settings › Your data › Close my account;
object to or restrict a use — for example, hide your phone or email, turn off marketing messages, or change your cookie choices;
complain to the Office of the Data Protection Commissioner at www.odpc.go.ke.

For anything you can’t do in Settings, write to [DPO EMAIL].

Security

Passwords, codes and document numbers are stored as one-way hashes; authenticator secrets are encrypted. Restricted documents are never public and every opening is logged. Dabi staff use separate work accounts with two-factor sign-in and only the permissions their role needs. If a breach puts your data at risk, we will tell the ODPC within 72 hours and tell you without undue delay.

Age

Dabi is for people aged 18 or older. We don’t knowingly collect data from children.

Changes

We’ll post changes here with a new version date and, for significant changes, tell you before they apply. The Cookie Policy covers cookies and browser storage.