Privacy Policy

HarvestHub is operated by Telpen Systems Ltd, a company registered in Kenya. For the purposes of the Kenya Data Protection Act, 2019 we are the data controller for the personal data described here. You can reach us at telpeninfo@gmail.com.

• Phone number — your login and the M-Pesa number used for payments. We confirm it with a one-time 6-digit SMS code.
• Sign-in PIN and trusted devices — if you set a 4-digit PIN we store only a one-way (hashed) form of it, plus a secure cookie that marks your device as trusted, so you can sign in on that device without an SMS. You can remove trusted devices at any time.
• Profile — your name, role (for example farmer, vendor or buyer), the region you choose, and, for organisations, the organisation name and description.
• Listings and posts — produce listings, demand posts, prices, quantities, photos and short videos you upload, reviews and favourites.
• Messages — chat messages and attachments you exchange with other users.
• Location (optional) — only when you tap a "near me" action or add a location to a listing or profile. We use it to show nearby markets, buyers and suppliers. You can decline location access and still use HarvestHub.
• Payment information — for M-Pesa subscription payments we keep the amount, status, date and the transaction reference returned by the payment provider. We never see or store your M-Pesa PIN.
• Reports and safety records — reports you make about content or users, users you block, and moderation decisions.
• Technical data — sign-in session cookies, searches made in the app (used for market insights in aggregate) and basic server logs needed to keep the service secure and working.

• To provide the service you sign up for — your account, listings, chat, matching and subscriptions (performance of a contract).
• To keep the marketplace safe and agriculture-only — screening content, handling reports and preventing fraud (legitimate interest and legal obligation).
• To process payments and keep tax and accounting records (legal obligation).
• To use your location, only when you choose to share it (consent, which you can withdraw in your device settings at any time).

We do not sell your personal data and we do not use it for advertising. Other users see what you choose to publish — your listings, your public profile name and the messages you send them. We use these service providers to run HarvestHub, under contracts that limit them to processing on our instructions:

• Supabase — sign-in sessions and one-time codes.
• Fly.io, Neon and Tigris — application hosting, database and media storage.
• Africa's Talking — delivering sign-in codes by SMS, and with Safaricom M-Pesa, mobile-money payments.
• Pusher — delivering chat messages in real time.
• Anthropic — only if you tap "Enhance with AI" on a listing, the listing text is sent to generate a suggested description.

Some of these providers process data outside Kenya. Where they do, we rely on the safeguards the Data Protection Act requires. We may also disclose data where the law requires it.

All data is encrypted in transit (HTTPS). Access inside HarvestHub is role-based: each person sees only what their role and region allow, and staff tools are restricted to authorised staff.

• Account and profile data — while your account is active.
• Listings — they expire automatically after 40 days unless you renew them.
• Payment and invoice records (amount, date, status, transaction reference and the M-Pesa number used) — kept for up to 7 years where Kenyan tax and accounting law requires it, including after account deletion, and used only for that purpose.
• Moderation and safety records — kept as long as needed to protect users.

You can delete your account at any time from harvesthub.site/account/delete (inside the app or on the web). Deleting removes your login, PIN, trusted devices, phone number, name and profile, takes down your listings and demand posts, and removes your memberships, favourites and notifications. Messages you already sent stay visible to the people you sent them to, without your name. Payment records we must keep by law (see above) are retained only for that purpose.

If you can no longer sign in, email telpeninfo@gmail.com from any address with the phone number on the account, and we will delete it within 30 days.

Under the Kenya Data Protection Act, 2019 you have the right to be informed, to access your data, to object to processing, to correct or delete it, and to data portability. To use any of these rights, email telpeninfo@gmail.com. If you are unhappy with our response you may complain to the Office of the Data Protection Commissioner (ODPC).

HarvestHub is a business tool for adults aged 18 and over. It is not directed at children and we do not knowingly collect children's data.

We will post any changes on this page and update the date below. Significant changes will be shown in the app before they take effect.