Privacy Policy

Galeyr ("we", "us", or "our"), operating at galeyreat.co.ke, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and safeguard your personal data when you use our food and supermarket delivery platform.

This policy complies with the Kenya Data Protection Act, 2019 and applicable international data protection standards. By using Galeyr, you consent to the practices described in this policy.

Account Information

When you create an account, we collect your name, email address, and phone number. This data is necessary to create and maintain your Galeyr account, authenticate your identity, and provide customer support.

Location Data

With your explicit consent, we collect precise location data (GPS coordinates) to enable accurate food and supermarket delivery tracking. This allows us to display nearby restaurants and supermarkets, calculate delivery fees, route drivers efficiently, and provide real-time order tracking.

You may disable location services through your device settings, but this may limit delivery tracking and nearby merchant discovery.

Payment Information

We collect your mobile phone number to process payments through Safaricom M-Pesa (via the Daraja API). We do not store your M-Pesa PIN or full financial credentials. Transaction records, including payment confirmation codes and timestamps, are retained for order verification and dispute resolution.

Order History

We maintain records of your orders, including items purchased, merchant details, delivery addresses, and transaction amounts. This enables order tracking, personalized recommendations, and customer support.

• Service Delivery: Processing orders, coordinating with restaurants/supermarkets, routing drivers, and facilitating deliveries to your specified location.
• Payments: Initiating and verifying M-Pesa STK Push transactions through Safaricom’s secure infrastructure.
• Communication: Sending order confirmations, delivery updates, and customer support messages via SMS, push notification, or email.
• Safety & Fraud Prevention: Verifying accounts, detecting suspicious activity, and complying with legal obligations.
• Platform Improvement: Analyzing usage patterns to improve delivery routes, restaurant recommendations, and app performance.

We do not sell your personal data. We share information only with:

• Merchants: Order details, delivery address, and contact phone number so restaurants/supermarkets can fulfill and coordinate your order.
• Delivery Partners: Your delivery address, phone number, and order contents for fulfillment and contact during delivery.
• Safaricom (M-Pesa): Your phone number and transaction details solely for payment processing via the M-Pesa Daraja API.
• Cloud Infrastructure: Data is hosted on secure cloud infrastructure (Lovable Cloud / Supabase) with industry-standard encryption and access controls.
• Legal Authorities: When required by Kenyan law, court order, or to protect our legal rights.

We implement robust technical and organizational measures to protect your personal data:

• All data transmitted between your device and our servers is encrypted using TLS/SSL (HTTPS).
• Payment data is processed through Safaricom’s secure, PCI-DSS compliant M-Pesa infrastructure.
• Database access is protected by Row-Level Security (RLS) policies and role-based authentication.
• Regular security audits and vulnerability assessments are conducted.

We retain your personal data for as long as your account is active or as needed to provide services. Order and transaction records are retained for seven (7) years to comply with Kenyan tax and accounting laws. Location data used for a specific delivery is retained for 90 days for dispute resolution, then anonymized. If you delete your account, we will securely erase your personal data within 30 days, except where retention is required by law.

Under the Kenya Data Protection Act, 2019, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that we update or correct inaccurate or incomplete data.
• Deletion: Request deletion of your personal data (see Account Deletion below).
• Objection: Object to processing of your data for marketing or profiling purposes.
• Portability: Request your data in a structured, commonly used format.

To exercise any of these rights, contact us using the details in the Contact section below. We will respond within 30 days.

You may delete your Galeyr account and associated personal data at any time. Upon deletion:

• Your profile, saved addresses, and preferences are permanently removed.
• Order history is anonymized (stripped of personal identifiers) for legal and analytical retention.
• Active orders must be completed or cancelled before account deletion can proceed.

To request deletion, contact us via email with the subject line "Account Deletion Request" or use the in-app account settings when available. We will process your request within 30 days.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our Data Protection Officer:

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya if you believe we have violated your data protection rights.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. Material changes will be communicated via email or in-app notification at least 30 days before they take effect. The "Last Updated" date at the top of this page indicates when this policy was last revised.