Biashnet . FOR EVERYONE

Privacy Policy

Last updated: 13 September 2026

This policy explains how BIASHNET LTD ("Biashnet", "we", "us") collects, uses, shares and protects personal data when you use the Biashnet mobile app (com.biashnet.app) and the Biashnet website (together, the "Service"). Biashnet is a marketplace in Kenya where buyers purchase items from sellers, pay with M-PESA, and receive their orders through Biashnet's delivery service.

We process personal data in line with the Kenya Data Protection Act, 2019.

1. Information we collect

Information you give us

Account details: your name, email address, phone number and password, and which accounts you use (buyer, seller, and for staff and investors, work or investor accounts). Passwords are handled by Google Firebase Authentication; we never see or store them in readable form.
Seller shop details: shop or business name, profile photo, description, location and contact phone number.
Orders and delivery: the items you buy, quantities and prices, and the delivery details you enter, such as your location, a landmark, delivery notes and a phone number.
Payments: the M-PESA phone number you pay from, the amount, the M-PESA receipt number and transaction status, and your order's payment reference.
Seller earnings and withdrawals: wallet balances, earnings held until delivery, the M-PESA number you withdraw to, and your withdrawal history.
Messages: chat messages you send to other users through the Service.
Listings and photos: product listings, descriptions and images you upload as a seller.
Work and investor accounts: for Biashnet staff, employment information such as role, payroll, expenses and reports; for investors, investment and payout records.

Information collected when you use the Service

Shopping activity: items you add to your cart (including after you check out), sellers you follow, and your order history. We use this to run the Service and to improve product recommendations.
Push notification token: an identifier for your device, so we can send order and payment notifications to the account that is signed in.
Sign-in session: a session token stored on your device to keep you signed in.
Technical logs: our hosting providers may record technical information, such as IP address, device and browser type, and the time of requests, for security and troubleshooting.

2. What we don't collect

We do not access your device location, contacts, camera, microphone or files, except photos you choose to upload.
We never receive your M-PESA PIN. You enter it on Safaricom's own prompt.
We do not collect card details.
We do not use advertising identifiers, advertising networks, or third-party analytics or tracking tools.
We do not sell your personal data.

3. How we use your information

To create and manage your account, including one-time sign-in codes for protected accounts.
To run the marketplace: show listings, take orders, and let buyers and sellers communicate.
To process M-PESA payments, hold payment safely until delivery, release funds to sellers, and process refunds and withdrawals.
To arrange delivery: sellers drop items off at Biashnet, and our team delivers them to buyers.
To send notifications about your orders, payments, deliveries and earnings.
To provide customer support and resolve disputes.
To keep the Service secure and prevent fraud and misuse.
To improve the Service, including product recommendations based on your shopping activity.
To meet legal, accounting and tax obligations.

We rely on performing our contract with you, our legitimate interests in running a safe marketplace, your consent (for example, for push notifications), and our legal obligations.

Other users

Sellers see only the items you ordered from them and the order number, not items from other sellers on the same order. They do not see your name, phone number, email or delivery details: sellers bring items to Biashnet, and Biashnet delivers them to you.
Buyers and other visitors can see a seller's public shop profile: shop name, photo, description, location, listings, ratings and follower count.
People you chat with see the messages you send them.

Biashnet staff

Authorised Biashnet staff, such as our logistics and support teams, access the order, delivery and payment information needed to do their jobs. Your delivery details are shared only with Biashnet's own delivery team.

Service providers

We use trusted providers who process data on our behalf, only for the purposes below:

Provider	What they do for us
Google Firebase	Sign-in, secure data storage, and push notifications
Safaricom (M-PESA)	Processing payments, refunds and seller withdrawals
Cloudinary	Storing and displaying uploaded images
Brevo	Sending emails, such as sign-in codes
Render and Vercel	Hosting our servers and website

Some of these providers may store data outside Kenya. Where they do, we rely on the safeguards they provide for international transfers.

Legal reasons

We may disclose information where required by law, court order or a lawful request from a public authority, or to protect the rights, property or safety of Biashnet, our users or the public.

5. Payments and delivery codes

When you pay, your money is held until your order is delivered. Each paid order has a payment reference, for example 45682/08/26. It appears as the account number in your M-PESA payment message and on your order page, and it is your delivery code: giving it to the Biashnet rider confirms you've received your order and releases payment to the seller.

Treat your delivery code like a PIN. Only give it to the rider after you've received and checked your order. Because it is part of the M-PESA transaction, it also appears in Biashnet's M-PESA business records.

We store delivery codes in encrypted form and limit the number of wrong attempts.

6. Notifications

With your permission, we send push notifications about your orders, payments, deliveries and earnings. Notifications go only to the account currently signed in on your device; when you sign out, we stop sending them to that device. You can turn notifications off at any time in your device settings.

7. How we protect your data

All data is sent over encrypted connections (HTTPS).
Access to data is limited by role. For example, sellers see only their own items on an order and never the buyer's details, and staff see only what their job requires.
Protected accounts require a one-time code sent by email to sign in.
Delivery codes are stored encrypted, and passwords are handled by Firebase Authentication.

No system is completely secure, but we work to protect your information and will notify you and the relevant authorities of a breach where the law requires.

8. How long we keep it

We keep your account information while your account is active.
We keep records of completed payments, refunds and seller withdrawals, including the order they belong to, for 5 years from the end of the year of the transaction, as required under Kenya's Tax Procedures Act, even after an account is deleted. We then delete them.
Push notification tokens are removed when you sign out or when they stop being valid.
When information is no longer needed, we delete it or make it anonymous.

9. Deleting your account

You can ask us to delete your Biashnet account and personal data at any time. Full details are on our account deletion page. In summary:

Email biashnetltd@gmail.com from the email address on your account, with the subject "Delete my Biashnet account".
Include the phone number on your account so we can confirm it's you.
We will confirm your request and complete the deletion within 30 days.

What we delete: your profile, contact details, delivery addresses, messages, cart and shopping activity, listings and photos, and notification tokens.

What we keep: records of completed payments, refunds and seller withdrawals, which Kenyan law requires us to keep for 5 years from the end of the year of the transaction. They are used only for legal, tax and accounting purposes, then deleted.

If you have an order in progress or money in your seller wallet, we'll help you complete the order or withdraw your balance before deleting your account.

10. Your rights

Under the Kenya Data Protection Act, 2019, you have the right to:

be told how your personal data is used;
access the personal data we hold about you;
correct inaccurate or incomplete data;
have your data deleted, subject to legal record-keeping duties;
object to or restrict how we use your data;
receive your data in a portable format; and
withdraw your consent, for example to notifications, at any time.

To use any of these rights, contact us using the details below. If you're unhappy with how we handle your data, you can complain to the Office of the Data Protection Commissioner.

11. Children

The Service is not intended for anyone under 15, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date above and, for significant changes, let you know through the app or by email.

13. Contact us

BIASHNET LTD
Email: biashnetltd@gmail.com
Kenya