Your data, in plain terms

• From bidders: name, phone number, bid amounts, county, and an optional email for receipts.
• From sellers: the above, plus national ID details, SACCO membership number, and whatever proof of shareholding you provide.
• From the verification call: our notes on your answers, the rung we assigned, and the reviewer's name.
• Technical: IP address and user-agent on sign-in and every audit event; delivery logs for SMS and WhatsApp so we can tell whether a message reached you.
• Campaign links: if you arrive through a SaccoBid link someone shared, a cookie remembers which link for 30 days. We record the pages viewed on that visit against the link, not against you, and note the link on anything you then submit (a bid, a listing, a message) so we know which link brought you.
• Google Analytics: we use it, through Google Tag Manager, to see how the site is used. Google sets cookies and receives the pages you visit (with private links shortened, so a bid link's code never reaches it), your device and browser, an approximate location, and what you do here, such as placing a bid or joining a waiting list, with its amount and SACCO. It never receives your name, phone number or email. If you sign in as a seller it also receives a coded ID that only we can link back to your account. We do not use it for advertising.

• Your M-Pesa PIN, or any PIN or password. We will never ask, on any channel.
• Your SACCO login credentials. A screenshot of a balance is fine; your password is not.
• Payments between buyer and seller — that money never touches us, so we hold no record of it beyond what you tell us.

Bid amounts are public on the listing. Names are partially masked until the seller pays the platform fee, at which point buyer and seller each receive the other's name and phone number — that exchange is the service.

Your verification documents are seen only by the reviewer handling your case and are never shown to bidders. What bidders see is our short written summary of what we checked.

• Verification documents: 90 days after your verification is resolved, then deleted from the private bucket.
• Completed deal records: 7 years, because they may be needed to resolve a dispute or satisfy a regulator.
• Unsuccessful bids: 12 months.
• Notification logs (SMS/WhatsApp delivery records): 12 months.
• Campaign link visits (pages viewed after clicking a shared link): 12 months.
• Waiting list entries: until you stop them, and every message carries a stop link.

You can ask what we hold on you, correct it, or have it deleted, and you do not need a reason. Message us on WhatsApp with the number you used and we will respond within 30 days.

Deletion cannot remove records we are legally required to keep, such as a completed deal. We will tell you specifically what was kept and why.