Vouch — Privacy Policy
Last updated: 5 July 2026
This Privacy Policy explains how Vouch collects, uses, shares, and protects personal data. It is written to comply with the Data Protection Act, 2019 (Kenya) and its Regulations.
1. Who we are
Vouch is operated by Kerry Lotee, trading as Vouch, a sole proprietorship based in Nairobi, Kenya (the “Operator”, “we”, “us”, “our”). We provide a hosted storefront and commerce platform that lets sellers (“Merchants”) take orders and payments and collect verified reviews from their customers (“Buyers”).
Contact for any privacy question, request, or complaint:
Email: hello@vouche.co.ke
Note: This Policy will be updated to reflect our registered business name and details once registration is completed.
2. Our two roles — please read this
Vouch handles personal data in two different capacities, and your rights depend on which applies:
- As a data controller — for the personal data of Merchants (the people and businesses who open a Vouch account). We decide how and why this data is used, and this Policy governs it directly.
- As a data processor — for the personal data of Buyers (a Merchant’s own customers). Here, the Merchant is the data controller and decides why the data is collected; Vouch only processes it on the Merchant’s behalf, to run the storefront, process the order, deliver transactional emails, and collect reviews. If you are a Buyer and wish to exercise your rights over your data, you may contact us and we will act on the Merchant’s instructions, or you may contact the Merchant directly.
The terms on which we process Buyer data for Merchants are set out in our Data Processing Addendum, which forms part of our agreement with each Merchant.
3. What personal data we collect
3.1 Merchant data (Vouch is controller)
- Name and contact details (email, phone/WhatsApp number)
- Account login credentials
- Store details (store name, description, product information, images)
- Payment configuration details connected through our payment provider
- Records of your use of the service
3.2 Buyer data (Vouch is processor; the Merchant is controller)
- Name
- WhatsApp number
- Email address
- Delivery or pickup preference
- Order details (items ordered, amount, date and time)
- Review content — rating, written review, and chosen attribution name
- Timestamps associated with the above
3.3 Technical data
When you use our service, our infrastructure providers automatically process limited technical data such as IP address and request logs. This is used only to operate the service securely (for example, to prevent abuse and rate-limit requests) and to keep the service running.
We do not run advertising or analytics cookies. We use only strictly necessary cookies required for the service to function (such as keeping you logged in).
4. Why we use personal data, and our lawful basis
We use personal data only for the following purposes:
| Purpose | Whose data | Lawful basis (DPA 2019) |
|---|---|---|
| Creating and running Merchant accounts | Merchant | Performance of a contract |
| Processing orders and payments | Buyer | The Merchant’s contract with the Buyer; consent captured at checkout |
| Sending transactional emails (order confirmation, shipping updates, review request) | Buyer | The Merchant’s contract with the Buyer |
| Collecting and publishing verified reviews | Buyer | Consent given by the Buyer at the point of submission |
| Keeping financial and transaction records | Buyer / Merchant | Legal obligation (tax and records-keeping law) |
| Securing the service and preventing abuse | All | Legitimate interest |
We do not use personal data for marketing. We do not sell personal data to anyone.
5. Reviews are published publicly
When a Buyer submits a review, that review is published publicly on the Merchant’s storefront. At the point of submission, the Buyer chooses how they are shown:
- Their first name and last initial (e.g. “Wanjiku K.”), or
- Anonymously, with no name shown.
In all cases, the review displays a verified-purchase status confirming it is tied to a real, completed order. The Buyer’s WhatsApp number, email, and full name are never shown publicly. Buyers may edit their chosen attribution at the point of submission, and may request removal of a published review at any time by contacting us or the Merchant.
6. Who we share data with (sub-processors)
We rely on trusted third-party providers to deliver the service. Each processes personal data only as needed to perform their function, under their own security and data-protection commitments:
| Provider | Purpose |
|---|---|
| Paystack | Payment processing |
| Supabase | Database and account storage |
| Vercel | Application hosting |
| Render | Payment webhook processing |
| Resend | Sending transactional emails |
| Upstash | Rate limiting and abuse prevention |
| Cloudinary | Hosting of images uploaded to storefronts |
Some of these providers process data on servers outside Kenya. Kenyan law permits this where appropriate safeguards are in place; we rely on the providers’ contractual and technical safeguards. We do not otherwise transfer your data abroad.
We may also disclose personal data where required by law, court order, or a lawful request from a competent authority.
7. How long we keep data
| Data | Retention period |
|---|---|
| Transaction and financial records (order amounts, dates) | 5 years, to meet tax and records-keeping obligations under Kenyan law |
| Buyer contact details and preferences (name, WhatsApp, email, delivery preference) | For the life of the Merchant’s account, then deleted or returned within 90 days of the account closing |
| Published reviews | For as long as the Merchant’s storefront is live, or until the Buyer requests removal |
| Merchant account data | For the life of the account, then deleted within a reasonable period after closure, except records we must keep by law |
8. Your rights
Under the Data Protection Act, 2019, you have the right to:
- be informed of how your data is used;
- access the personal data we hold about you;
- request correction of inaccurate or incomplete data;
- request deletion of your data (subject to records we are legally required to keep);
- object to or request restriction of processing in certain circumstances;
- request that we stop processing your data for a specific purpose.
To exercise any of these rights, contact hello@vouche.co.ke. We will respond within the timeframes required by law. If you are a Buyer, some requests may need to be directed to, or confirmed with, the Merchant as the controller of your data — we will help route these.
If you believe we have not handled your data lawfully, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya.
9. How we protect data
We apply reasonable technical and organisational measures to protect personal data, including access controls, encryption in transit, and restricting data access to what each provider needs to function. In the event of a personal-data breach that poses a risk to affected individuals, we will log the event and notify the relevant parties and, where required, the ODPC, in line with our legal obligations.
No system is perfectly secure, and we cannot guarantee absolute security, but we take these obligations seriously.
10. Children
Our service is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child’s data has been provided to us, contact us and we will delete it.
11. Changes to this Policy
We may update this Policy from time to time. The “Last updated” date at the top shows when it was last changed. Material changes will be communicated through the service where appropriate.
12. Contact
For any question or request about this Policy or your personal data:
Kerry Lotee, trading as Vouch
Nairobi, Kenya
Email: hello@vouche.co.ke