Privacy Policy

JabaGraba is owned and operated by MintGen Labs & Infusion Jaba ("we", "us", "our"), based in Nairobi, Kenya. We are the Data Controller for the personal data you provide when using our website, customer app, partner app or rider app.

Contact for privacy matters: help@jabagrabba.com.

• Account data: name, phone number, email, password (hashed).
• Order data: items ordered, delivery address, order history, notes.
• Payment data: M-Pesa transaction reference, card token (handled by our licensed payment processor — we never store full card numbers).
• Location data: delivery address and, where you allow it, live location during an active delivery.
• Device & usage data: device model, OS version, app version, IP address, crash logs, and interaction analytics.
• Communications: messages you send to support or ratings you leave for riders and partner stores.

• To perform the contract — take and deliver your JabaJuice order, process payment, issue receipts.
• Legitimate interests — fraud prevention, service improvement, security monitoring.
• Legal obligation — tax records, KRA compliance, ODPC reporting.
• Your consent — marketing messages, push notifications, non-essential cookies.

• Riders — your name, phone and delivery address for the duration of the delivery.
• Partner stores — your order details so they can prepare it.
• Payment processors — Safaricom (M-Pesa) and our card acquirer.
• Cloud & infrastructure providers — hosting, SMS, email and analytics vendors bound by data processing agreements.
• Authorities — where required by Kenyan law or a valid court order.

We never sell your personal data.

Some of our infrastructure providers process data outside Kenya. Where that happens we rely on adequate safeguards (standard contractual clauses or equivalent) as required by the Kenya Data Protection Act, 2019.

Account and order data are kept for as long as your account is active plus up to 7 years afterwards to meet tax and accounting obligations. Marketing preferences are kept until you withdraw consent. Support tickets are kept for up to 3 years.

• Access — request a copy of your data.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data (see our Data Deletion page).
• Restriction & objection — limit or object to certain processing.
• Portability — receive your data in a portable format.
• Withdraw consent — at any time, for anything based on consent.
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.

Email us at help@jabagrabba.com to exercise any of these rights. We respond within 30 days.

We use encryption in transit (HTTPS/TLS), encrypted storage at rest, role-based access controls and regular security reviews. No system is perfectly secure, but we take reasonable steps aligned with industry practice.

JabaGraba is intended for customers aged 16 and over. We do not knowingly collect data from children under 16. If you believe a child has given us data, contact us and we will delete it.

We may update this policy from time to time. Material changes will be notified in-app or by email. The "Last updated" date above always reflects the current version.