Privacy Policy
Last updated: 23 September 2026
This is a working version of our Privacy Policy, published so you can see exactly how your data is handled. It is pending review by our legal counsel and may be revised.
This policy explains what personal data Amini Afrisource collects, why we collect it, who we share it with, and what rights you have over it. It applies to the Amini Afrisource website and marketplace.
1. Who we are (data controller)
The data controller is Raevin Upsurge Ltd, a company registered in Nairobi, Kenya, operating the Amini Afrisource marketplace.
For any privacy question or request, contact us at contactus@aminiafrisource.com.
2. What we collect and why
Account details
Email address, password (stored only as a cryptographic hash), display name, and — where you provide them — phone number and country. Collected so we can create and secure your account and contact you about it. Lawful basis: performance of our contract with you.
Company information
Company name, country of operation, business description, website and profile picture. Collected so buyers and suppliers can identify and assess each other. Lawful basis: performance of our contract with you. Note that information on your public profile is visible to other users and, where a listing is public, to visitors.
Listing content
Product descriptions, quantities, prices, images and related documents you upload. Collected in order to publish your listings. Lawful basis: performance of our contract with you.
Quote requests and messages
The quantity, message text and contact context of requests you send to suppliers, and community posts and comments you write. Collected so we can deliver your enquiry to the intended supplier and operate the community area. Lawful basis: performance of our contract with you.
Authentication data
Session tokens, sign-in timestamps, email verification and password reset tokens, and — if you choose Google sign-in — the name, email address and profile picture Google returns to us. Google sign-in is optional; you can use email and password instead. Collected to authenticate you and keep accounts secure. Lawful basis: performance of our contract with you, and our legitimate interest in security.
Usage and technical data
IP address, browser and device type, pages viewed and error logs. Collected to keep the service running, diagnose faults, and prevent abuse and fraud. Lawful basis: our legitimate interest in operating a secure and reliable service.
We do not sell personal data, and we do not use it for automated decision-making that produces legal effects for you.
3. Who we share it with
We share personal data only with service providers who process it on our instructions, and only as much as they need:
- Supabase — database hosting, file storage and authentication.
- Resend — sending transactional email such as verification, password reset and notification messages.
- Google — only if you choose to sign in with a Google account, in which case Google processes that sign-in.
We also share data with other users where that is the point of the service: your public profile and listings are visible to other users, and a quote request you send is shared with the supplier you send it to.
We may disclose data where we are legally required to, or where it is necessary to establish, exercise or defend legal claims, or to protect the safety of users.
4. Where your data is stored
Our database, file storage and authentication are hosted on servers located in the European Union. Because Raevin Upsurge Ltd is in Kenya and some providers operate internationally, your data may be transferred across borders. Where that happens we rely on contractual safeguards with our processors and on the conditions for transfer set out in the Kenya Data Protection Act 2019.
5. How long we keep it
We keep account, profile and listing data for as long as your account is open. If you close your account, we delete or anonymise your personal data within 90 days, except where we must keep records longer to comply with a legal obligation, or to resolve a dispute — in which case we keep only what is needed, for no longer than is necessary.
Quote request and community content may remain visible to the counterparty or the community as a record of an exchange, with your identifying details removed where you ask us to and it is practical to do so. Backups are retained on a rolling basis and overwritten in the ordinary course.
6. How we protect it
Traffic is encrypted in transit with TLS. Passwords are hashed and never stored in readable form. Database access is restricted by row-level security rules so that users can read only the records they are entitled to; personal contact details such as phone numbers are not exposed to other users. Uploaded files are held in private storage and served through short-lived signed links. Access by our staff is limited to those who need it.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify you and the Office of the Data Protection Commissioner as required by law.
7. Cookies and local storage
We use cookies and browser local storage only for essential purposes: keeping you signed in, remembering your session between page loads, and protecting against cross-site request forgery. These are strictly necessary for the service to work and cannot be switched off while you are using an account.
We do not use advertising cookies, third-party tracking pixels, or cross-site behavioural profiling. You can clear cookies and local storage in your browser at any time; doing so will sign you out.
8. Your rights under the Kenya Data Protection Act 2019
The Kenya Data Protection Act 2019 gives you the following rights over your personal data:
- Access — to be told whether we hold data about you and to receive a copy of it.
- Correction — to have inaccurate or incomplete data corrected or completed.
- Deletion — to have your data erased where it is no longer needed, or where we have no lawful reason to keep it.
- Objection — to object to our processing of your data, including for direct marketing.
- Portability — to receive the data you gave us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
You can update most of your account and company information yourself in your account settings. For anything else, email contactus@aminiafrisource.com stating which right you wish to exercise and the email address on your account. We respond within 30 days, and will tell you if we need longer or need to verify your identity first. Exercising these rights is free.
If you are unhappy with how we have handled your data or your request, you may complain to the Office of the Data Protection Commissioner of Kenya.
9. Children
Amini Afrisource is a business platform and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.
10. Changes to this policy
We may update this policy as the platform develops or the law changes. The “last updated” date above always reflects the current version, and we will give reasonable notice of material changes by email or through the platform.
11. Contact
Raevin Upsurge Ltd, Nairobi, Kenya.
Email: contactus@aminiafrisource.com
See also our Terms of Service.