Privacy notice

1. Who is responsible

Vuvo Errands is the data controller for the data described here. Contact: hello@vuvo.co.ke. Our registration with the Office of the Data Protection Commissioner will be shown here once complete.

2. What we collect

• Your phone number and name, and email if you give one
• Addresses, contact details of the people at pickup and delivery points, and the description of the errand
• Payment references from M-Pesa and our card processor (we do not store card numbers)
• Photos, receipts and signatures taken as proof of the job
• Messages you send us, ratings and support records
• Basic device and usage data to run and secure the site

3. Why we use it

To provide the errand you booked, take payment, keep you updated by SMS, email and WhatsApp, prove the work was done, handle refunds and complaints, prevent fraud, and meet legal duties. If you opt in, we also send offers; you can stop them at any time by replying STOP.

4. Who sees it

Your runner sees only what is needed for your job. Service providers process data for us: payments (Safaricom M-Pesa and Pesapal), messaging (Africa's Talking, Resend, and WhatsApp if enabled), hosting and database (Vercel and Neon). We share data with authorities where the law requires. We do not sell personal data.

5. Documents and IDs

If an errand needs an ID or official document, runners photograph it only where the service requires it. Those images go to a private store and are deleted after the retention period below.

6. How long we keep it

Booking and payment records are kept for the period needed for tax and accounting law. Proof photos are kept for a limited time after the job and then deleted. The exact periods will be set out here after counsel review.

7. International transfers

Some providers store data outside Kenya. We use providers that apply appropriate safeguards, and we will tell you which countries once the stack is final.

8. Your rights

You can ask to see your data, correct it, have it deleted, object to marketing, and complain to the Office of the Data Protection Commissioner. Email us and we will reply within the time the law allows.

9. Security and breaches

We limit access by role, use encrypted connections and keep a record of who handled what. If a breach is likely to harm you we will tell you and the regulator as the law requires.

10. Children

Our services are for adults. We do not knowingly collect data from children.