1. Introduction

Welcome to Tuunda. Tuunda ("we", "our", "us", or "the Company") operates a loyalty platform that enables merchants to create loyalty programs and customers to earn and redeem rewards across multiple merchants in Kenya. We are committed to protecting your privacy and ensuring the security of your personal information.

This Privacy Policy explains how we collect, use, disclose, store, and safeguard your information when you use our website, mobile application, and services (collectively, the "Platform"). By using our Platform, you consent to the data practices described in this policy.

If you do not agree with the data practices described in this Privacy Policy, you should not use our Platform.

2. Information We Collect

2.1 Information You Provide to Us

We collect information that you voluntarily provide when you:

• Create an Account: Name, email address, phone number, password, and profile information
• Enroll in Loyalty Programs: Information required to join merchant loyalty programs
• Make Transactions: Purchase details, transaction amounts, and payment information (processed securely through M-Pesa)
• Redeem Rewards: Reward selections and redemption history
• Contact Us: Information you provide when contacting customer support
• Merchant Registration: Business name, business type, address, contact information, M-Pesa till number, and business registration details (for merchants)

2.2 Information Automatically Collected

When you use our Platform, we automatically collect certain information, including:

• Usage Data: How you interact with our Platform, pages visited, features used, and time spent
• Transaction Data: Transaction history, points earned and redeemed, reward redemptions, and loyalty program participation
• Device Information: Device type, operating system, browser type, device identifiers, and mobile network information
• Location Data: General location information (city/region level) based on IP address or device settings
• Log Data: IP address, access times, dates and times of visits, and referring website addresses
• Cookies and Tracking Technologies: Information collected through cookies, web beacons, and similar technologies (see Section 7 for details)

2.3 Information from Third Parties

We may receive information about you from third-party services:

• Authentication Providers: When you sign in using Google OAuth or other social login services
• Payment Processors: Transaction confirmations and payment status from M-Pesa and other payment providers
• Merchants: Transaction data and customer information from merchants you interact with

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Service Delivery

• Create and manage your account
• Process transactions and manage loyalty program enrollments
• Calculate, track, and manage points and rewards
• Facilitate reward redemptions
• Provide customer support and respond to inquiries
• Send transaction confirmations, account updates, and service notifications

3.2 Communication

• Send you important updates about your account, transactions, and rewards
• Notify you about new merchants, special offers, and promotional campaigns (with your consent)
• Send marketing communications (you can opt-out at any time)
• Respond to your questions, comments, and support requests

3.3 Platform Improvement

• Analyze usage patterns to improve our Platform and services
• Develop new features and functionality
• Personalize your experience and show relevant content
• Conduct research and analytics

3.4 Legal and Security

• Comply with applicable laws, regulations, and legal processes
• Detect, prevent, and address fraud, security issues, and unauthorized access
• Enforce our Terms of Service and other agreements
• Protect the rights, property, and safety of Tuunda, our users, and third parties

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. However, we may share your information in the following circumstances:

4.1 With Merchants

When you enroll in a merchant's loyalty program, we share limited information necessary for the program to function:

• Your name and contact information (as provided)
• Transaction history with that specific merchant
• Points balance and redemption history for that merchant's program
• Tier status and program participation data

Merchants are required to protect your information and use it only for loyalty program purposes.

4.2 With Service Providers

We may share information with trusted third-party service providers who assist us in operating our Platform:

• Payment Processors: M-Pesa and other payment providers to process transactions
• Cloud Hosting: Data storage and hosting services (e.g., Supabase, Vercel, Render)
• Analytics Services: To understand how our Platform is used and improve our services
• Communication Services: Email, SMS, and notification providers
• Customer Support: Tools and platforms for providing customer service

These service providers are contractually obligated to protect your information and use it only for the purposes we specify.

4.3 Legal Requirements

We may disclose your information if required by law or in response to:

• Court orders, subpoenas, or other legal processes
• Government requests or regulatory requirements
• Investigations of fraud, security breaches, or other illegal activities
• Protection of rights, property, or safety

4.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the acquiring entity, subject to the same privacy protections.

5. Data Security

We take the security of your personal information seriously and implement industry-standard security measures to protect it:

• Encryption: Data is encrypted in transit using SSL/TLS and at rest using industry-standard encryption
• Access Controls: Limited access to personal information on a need-to-know basis
• Secure Authentication: Strong password requirements and secure authentication methods
• Regular Security Audits: Ongoing monitoring and assessment of our security practices
• Secure Payment Processing: Payment information is processed through secure, PCI-compliant payment processors (M-Pesa)
• Data Backup: Regular backups to prevent data loss

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.

If you suspect any unauthorized access to your account, please contact us immediately at support@tuunda.co.ke.

6. Your Rights and Choices

You have the following rights regarding your personal information:

6.1 Access and Portability

• Access your personal information and account data through your account dashboard
• Request a copy of your data in a portable format
• View your transaction history, points balance, and reward redemptions

6.2 Correction and Updates

• Update your account information, including name, email, and phone number
• Correct inaccurate or incomplete information
• Manage your profile and preferences

6.3 Deletion

• Request deletion of your account and personal information
• Note: Some information may be retained for legal or legitimate business purposes (e.g., transaction records for accounting)
• You can delete your account through your account settings or by contacting us

6.4 Marketing Communications

• Opt-out of marketing emails through the unsubscribe link in emails
• Manage notification preferences in your account settings
• Continue to receive important service-related communications (transaction confirmations, account updates)

6.5 Data Processing Objections

• Object to certain types of data processing
• Request restriction of processing in certain circumstances
• Withdraw consent where processing is based on consent

To exercise these rights, please contact us at support@tuunda.co.ke or use the features available in your account settings.

7. Cookies and Tracking Technologies

We use cookies, web beacons, and similar tracking technologies to enhance your experience on our Platform:

7.1 Types of Cookies We Use

• Essential Cookies: Required for the Platform to function (authentication, security, session management)
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand how you use our Platform to improve our services
• Marketing Cookies: Used to deliver relevant advertisements (with your consent)

7.2 Managing Cookies

You can control cookies through your browser settings:

• Most browsers allow you to refuse or delete cookies
• You can set your browser to notify you when cookies are being sent
• Note: Disabling certain cookies may affect Platform functionality

7.3 Third-Party Tracking

We may use third-party analytics and advertising services that use cookies and similar technologies. These services have their own privacy policies.

8. Third-Party Services and Links

Our Platform integrates with third-party services that have their own privacy practices:

8.1 Authentication Services

• Google OAuth: When you sign in with Google, Google's privacy policy applies to their services
• We receive basic profile information (name, email) from these services

8.2 Payment Processors

• M-Pesa: Payment processing is handled by Safaricom M-Pesa, subject to their privacy policy
• We do not store your full payment card details; payment information is processed securely by payment providers

8.3 External Links

Our Platform may contain links to external websites operated by merchants or third parties. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.

9. Children's Privacy

Our Platform is not intended for individuals under the age of 18. We do not knowingly collect, use, or disclose personal information from children under 18.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at support@tuunda.co.ke. If we learn that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

10. Data Retention

We retain your personal information for as long as necessary to:

• Provide our services and maintain your account
• Comply with legal obligations and resolve disputes
• Enforce our agreements and protect our rights
• Maintain transaction records for accounting and tax purposes

When you delete your account, we will delete or anonymize your personal information, except where we are required to retain it for legal or legitimate business purposes.

11. International Data Transfers

Your information may be transferred to and processed in countries other than Kenya, including countries that may have different data protection laws. We ensure that appropriate safeguards are in place to protect your information in accordance with this Privacy Policy.

By using our Platform, you consent to the transfer of your information to these countries.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

• Posting the updated Privacy Policy on this page
• Updating the "Last updated" date at the top of this policy
• Sending you an email notification (for significant changes)
• Displaying a notice on our Platform

Your continued use of our Platform after changes become effective constitutes acceptance of the updated Privacy Policy. We encourage you to review this policy periodically.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will respond to your inquiry within a reasonable timeframe and in accordance with applicable data protection laws.