Privacy Policy

• Account info: name, email, phone number, and password (stored securely hashed. We never see or store your raw password).
• Location: only if you grant permission, to show nearby deals and giveaways and to sort by distance. You can deny or revoke this at any time in your device settings.
• Listings & orders: Store Deal reservations, pickup codes, order status, and Giveaway listings/claims you create.
• Photos: images you upload for a listing or giveaway (or a stock photo you pick instead), and images you send in a chat.
• Messages, reviews & reports: chats with a shop or with the other person in a giveaway, reviews you leave, and problems you report.
• Business info: for shop accounts, the business name, address and phone, the mobile money number we pay your earnings to, and documents you submit to get verified.
• Payment metadata: for online payments, the transaction reference, status and amount. Kupa does not collect or store your card number, mobile money PIN, or similar credentials. You enter those directly into our payment processor's checkout.
• Device & app info: if you use the Android app, the app version and a push-notification token (if you allow notifications).
• Usage data: pages visited and actions taken on Kupa, used to keep the service working and improve it.

• Operate core features. Reservations, pickup codes, listings, payments, favourites, notifications.
• Show you relevant nearby deals and giveaways.
• Prevent fraud and abuse (e.g. tracking no-show strikes).
• Send you order updates and, if you opt in, push notifications about deals near you.
• Improve the Platform and fix problems.

We do not sell your personal information to third parties.

• Supabase. Hosts our database, sign-in, file storage and the app's server functions.
• Payonify. Processes online payments and sends payouts. When you pay online, you pay Kupa; Kupa then pays the business its share, less our commission, to the payout number the business gave us. Pesepay may process some payments instead, on the same terms.
• Vercel. Hosts the website.
• Firebase / Google. Delivers push notifications on Android, if you allow them.
• Resend. Sends our emails, such as receipts, pickup codes and password resets.
• Anthropic. Only when a shop uses “Write my listing”: the listing title it typed is sent to Anthropic's AI to draft a description.
• The other party to a transaction. A business sees your name and pickup code for a Store Deal; a Giveaway giver and claimant see each other's name so they can arrange pickup.

We may also disclose information if required by law, or to protect the safety of users or the public.

We use essential cookies/local storage to keep you signed in and remember preferences (like a floating widget's position). We don't use third-party advertising trackers.

We also count visits to the website ourselves, to see which pages and deals people look at and what kinds of phone they use. For each page opened we record the page address (without anything after a question mark), the time, your time zone, the country your connection reports, the website that linked you here, the type of device and browser, and a random number stored in your browser so that two visits from the same browser count as one visitor. If you are signed in, the visit is linked to your account. We do not record your IP address, your precise location or anything you type. These records are deleted after 13 months. If your browser sends a “Do Not Track” or “Global Privacy Control” signal, we do not count your visits at all.

We keep your account data for as long as your account is active. When you delete your account, your personal details are removed straight away. Records of past orders and payments are kept, without your name on them, because shops need them for their accounts and tax and we need them for refunds, disputes and fraud prevention.

You can see and correct your information in your account settings, and you can delete your account yourself in the app or on the website. How to delete your account explains the steps and exactly what is removed. To ask for a copy of your data, or for deletion if you can't sign in, email privacy@kupa.co.zw.

Kupa is not directed at children, and account holders must be old enough to form a binding contract under Zimbabwean law.

We use industry-standard practices (encrypted connections, hashed passwords, access controls) to protect your information, but no system is 100% secure. Please use a strong, unique password.

We may update this policy from time to time; we'll update the "Last updated" date above when we do.

Questions about this policy? Email privacy@kupa.co.zw or use Report a problem.