Privacy Policy

Last updated: 26 July 2026

This policy explains what personal data SellMyStuff collects, why, how we protect it, and what rights you have over it. It is written to meet our obligations as a Data Controller under Kenya's Data Protection Act, 2019.

1. Who we are

SellMyStuff is the Data Controller for the personal data described here, registered with the Office of the Data Protection Commissioner (ODPC). You can reach our data protection contact at admin@sellmystuff.co.ke.

2. What we collect

Account data

• Full name
• Phone number (verified by one-time passcode)
• Email address, where you register with one
• Password, stored only as a bcrypt hash — never in readable form
• Profile photo, where you upload one
• Town or city, where you provide it

Identity documents — sensitive personal data

If you register as a seller or reseller, we collect a photograph of your Kenyan National ID and, optionally, a selfie. Under the DPA 2019 this is sensitive personal data and we treat it accordingly — see section 4.

Listing and transaction data

• Items you list, including photographs, description, price and viewing location
• Bids placed and received; reserves created; items marked sold
• M-Pesa transaction references for fees you pay us. We never receive or store your M-Pesa PIN, and we do not store full payment instrument details.
• Messages exchanged with other users about a listing
• Ratings you give and receive

Technical data

• IP address, used for rate limiting, fraud prevention and abuse investigation
• Device and browser information
• Server logs of requests to the platform

3. Why we use it, and on what basis

• To operate your account and the marketplace — performance of our contract with you.
• To verify seller identity — your explicit consent, given when you submit the document, and our legitimate interest in preventing fraud against buyers.
• To send transactional messages (OTP codes, bid and reserve alerts, receipts) — performance of our contract. These are not marketing and cannot be switched off while your account is active.
• To prevent fraud and abuse — legitimate interest, and compliance with legal obligations.
• To meet legal and tax obligations — compliance with Kenyan law.

4. How your ID document is stored

This is the most sensitive data we hold, so we are specific about it:

• It is encrypted with AES-256 before it is written to storage. It is never stored in readable form.
• It is held in a private storage bucket that is not publicly reachable. No public or shareable link to it is ever generated — not even a temporary one.
• It can be viewed only by an administrator, only through an authenticated route that decrypts it in memory to serve the review, and every such access is recordedin an audit log with the administrator's identity and the time.
• It is deleted 90 days after your account is closed, unless we are required to keep it longer by law.

Evidence you attach to a fraud report is treated with the same protections, because it routinely contains other people's personal data.

5. What we share, and what we never share

Your phone number is never published. It is disclosed to another user only when they hold an active subscription and deliberately unlock your contact details on your listing — and that unlock is logged.

We share data with:

• Safaricom (M-Pesa Daraja) — to process payments you initiate.
• Africa's Talking — to deliver SMS one-time passcodes and alerts.
• Resend — to deliver transactional email.
• Law enforcement or the ODPC — where we are legally required to, or where it is necessary to investigate a serious fraud.

We do not sell your personal data. We do not share it with advertisers or data brokers.

6. What other users can see

• Public — your display name, profile photo, town, seller rating, badges, and your active and recently sold listings.
• Not public — your phone number, email address, ID document, exact address, transaction history, and messages.

7. How long we keep it

• Account data — for as long as your account is open.
• ID documents — until 90 days after account closure.
• Sold listings — visible on your shelf for 30 days, then archived.
• Transaction records — retained as required for tax and anti-fraud purposes, typically 7 years.
• Server logs — retained for a limited period for security investigation.

8. Your rights under the Data Protection Act 2019

You have the right to:

• be informed about how your data is used — this policy;
• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted, subject to records we must keep by law;
• object to processing based on legitimate interest;
• request that your data be transferred to you in a portable format;
• withdraw consent for identity verification — though this ends your ability to sell;
• lodge a complaint with the Office of the Data Protection Commissioner if you believe we have mishandled your data.

To exercise any of these, email admin@sellmystuff.co.ke. We respond within 30 days.

9. Security

We encrypt data in transit with TLS, encrypt identity documents at rest, hash passwords with bcrypt, rate-limit authentication attempts, and restrict administrative access to a small number of named accounts whose actions are audited. No system is perfectly secure, and we do not claim otherwise — if a breach affects your data, we will notify you and the ODPC as the Act requires.

10. Children

SellMyStuff is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has registered, contact us and we will remove the account.

11. Changes

We will post any change here and update the date above. Material changes will be notified through the platform.