Privacy Policy

1. Who we are

Qaribuhub Solutions LTD ("Qaribuhub", "QaribuBot", "we", "us") is the data controller for the personal data described in this Privacy Policy, in relation to our website (qaribubot.com), dashboard, and chat widget (together, the "Service"). We aim to handle personal data in line with Kenya's Data Protection Act, 2019, and to apply similar standards to visitors from other jurisdictions.

This policy describes two different groups of people whose data we process: (a) Merchants — the businesses that sign up for QaribuBot, and (b) Visitors/End-users — the people who chat with a merchant's widget on the merchant's website. We say clearly below which section applies to which group.

2. Data we collect from Merchants

Account data: name, email address, company name, and authentication data (including, if you sign in with Google, the profile information Google shares with us — typically your name, email, and profile photo).

Domain and configuration data: the domain(s) you register, your widget configuration (bot name, greeting, colours, tone), and the FAQ text you add.

Website content: pages and text we crawl from your website (and any sitemap you register) so the AI can answer questions about it.

Payment data: we do not collect or store your mobile money PIN or full card number. When you pay, your phone or the card checkout collects that information directly; we receive and store a transaction reference, the amount, timestamp, phone number (for mobile money) or billing email (for card payments), and status (pending/completed/failed).

Usage data: request counts, timestamps, and technical logs needed to enforce plan limits, secure the Service, and debug issues.

Support communications: anything you send us by email, WhatsApp, or phone for support purposes.

3. Data we collect from website Visitors (via the chat widget)

When someone chats with a merchant's QaribuBot widget, we process and store: the messages they type, the AI's replies, a conversation identifier, and basic details such as the time. We do this on behalf of the merchant whose website the visitor is chatting on — the merchant controls what the widget is used for, and can review these conversations in their dashboard.

We do not require visitors to log in to chat, and the widget does not intentionally collect precise location, device fingerprints, or advertising identifiers. If a visitor voluntarily types personal information into the chat (for example their name, phone number, or email, to get help with an order), that text is stored as part of the conversation.

4. Why we process this data (legal basis)

To provide the Service you (as a Merchant) signed up for and to perform our contract with you (Terms of Service).

To process payments and comply with our legal and tax obligations.

For our legitimate interests in keeping the Service secure, preventing abuse, and improving reliability — balanced against your rights.

Where you've given consent — for example, if we ever ask to use your logo or story as a case study, or to send you optional marketing updates you can opt out of at any time.

5. Who we share data with

Infrastructure providers: Google Cloud, which hosts the Service and sign-in.

Payment processors: the card processor and, for Kenyan mobile money, Safaricom PLC, receive only the information needed to complete the transaction you start. Card payments are currently processed by Paddle.com Market Limited as merchant of record.

AI providers: a third-party large language model provider processes the visitor's question and relevant website content in order to generate a chat reply. We do not sell this data, and we contractually limit these providers' use of it to providing the service to us.

Legal and safety: we may disclose data if required by law, court order, or a lawful request from a Kenyan regulator, or where necessary to protect the rights, property, or safety of Qaribuhub, our merchants, or the public.

Business transfers: if Qaribuhub is involved in a merger, acquisition, or asset sale, personal data may be transferred as part of that transaction, subject to this Privacy Policy (or a policy offering at least equivalent protection).

We do not sell personal data to third parties, and we do not permit advertisers to target merchants or visitors based on their QaribuBot data.

6. International data transfers

Some of the providers listed above (for example, Google Cloud and our AI provider) may process data outside Kenya. Where we transfer personal data outside Kenya, we take steps intended to ensure it receives a comparable level of protection, such as relying on providers with recognised security and privacy certifications and, where applicable, contractual safeguards.

7. How long we keep data

Merchant account data: for as long as your account is active. If you request deletion from Profile, we keep the account fully usable for three (3) days so you can cancel. After that we permanently delete the account, profile photo, websites, knowledge, conversations, widget settings, team access, and login. We do not keep a copy for later reactivation. If you never accept the Terms of Service, we delete the incomplete account immediately when you decline, or within 24 hours if you leave without accepting.

Visitor conversations: retained while the merchant's account is active so the merchant can review them, and deleted with the merchant's account once the three-day deletion window completes, unless the merchant deletes individual conversations sooner.

Payment records we store: after deletion we unlink them from you. Amounts, currency, plan, and dates stay in anonymized form so our revenue reporting remains accurate. Name, email, phone, and account identifiers are removed. Card and mobile-money processors may keep their own transaction records as required by tax or financial law (often several years); we cannot delete copies they hold.

Deletion requests: we keep the date and the reason you gave. After deletion we do not keep your name or email with that record, in line with data minimisation under Kenya's Data Protection Act, 2019.

Knowledge: kept up to date by periodic re-reads and can be deleted per-item by the merchant, in bulk when a website is removed, or in full when the account is deleted after the three-day window.

8. Your rights

Subject to applicable law (including the Data Protection Act, 2019 in Kenya), you have the right to: access the personal data we hold about you; request correction of inaccurate data; request deletion of your data; object to or restrict certain processing; and request a copy of your data in a portable format.

How to download your data: sign in to the dashboard, open Profile (your name in the sidebar), and click "Download all my data". That download includes your profile and photo, websites, widget settings, knowledge, conversations, team, plan, usage, and payment amounts we store. It does not include install keys or other internal details. Only the account owner can download it.

How to delete your account: sign in as the owner, open Profile, choose a reason (or Other with a short explanation), type DELETE, and confirm. We email you to confirm the request; deletion is completed within three days. That email has a "Cancel deletion" button, and Profile will show "Deletion in {x} hours, press here to cancel" until deletion completes. After three days we permanently delete the account listed in Section 7, including your profile photo, and cancel any paid subscription immediately. For anything else, or if you are a website Visitor who chatted with a QaribuBot widget and want to exercise these rights, contact us at info@qaribuhub.co.ke — if your request concerns a conversation on a specific merchant's website, we may need to involve that merchant.

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya, or your local data protection authority if you are outside Kenya.

9. Cookies and similar technologies

Essential storage keeps you signed in, remembers your theme, and stores your cookie choice. The chat widget may remember a conversation on the visitor's browser so it can continue if they reload the page.

If you choose Accept on our cookie banner, we load Google Analytics to understand how the marketing site is used (pages viewed, approximate region, device type). Analytics cookies are off until you accept. Choose Accept essential only to keep analytics off. You can change this anytime on our Cookie Policy page.

We do not use advertising or remarketing cookies. Details, including how to change your choice, are at qaribubot.com/cookies.

10. Children's privacy

QaribuBot is intended for use by businesses and their adult representatives. We do not knowingly collect personal data from children through our merchant sign-up. If a merchant's own website is directed at children and its visitors chat with the widget, the merchant is responsible for ensuring that use complies with applicable child-privacy law; contact us if you believe a child has submitted personal data through a widget and you'd like it removed.

11. Security

We use industry-standard measures to protect data, including encryption in transit, secure sign-in, keys that only work on your website, and access controls limiting which staff can view merchant or visitor data and for what purpose. No system is 100% secure, and we encourage you to use a strong, unique password (or Google Sign-In) and to keep your install keys confidential.

If we become aware of a data breach that poses a risk to your rights, we will notify affected merchants and, where required, the ODPC, without undue delay.

12. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or an in-product notice before they take effect.

13. Contact us

Qaribuhub Solutions LTD, Ring Road, Westlands, Nairobi, Kenya. Email: info@qaribuhub.co.ke · Phone/WhatsApp: +254 787 582 581.