Privacy Policy

MarketHub Africa Inc. ("MarketHub", "we", "us") respects your privacy. This policy explains what personal information we collect, why we collect it, how we use and protect it, and the choices you have. It applies to markethubafrica.com, our mobile applications, and related services (the "Service").

1. What we collect

We collect three categories of information:

Account information — name, email address, phone number, country, profile photo, and password (stored as a salted bcrypt hash, never in plain text).
Content you post — listing titles, descriptions, photos, prices, locations, messages exchanged with other users, reviews, follows, and reports.
Technical data — IP address, device type, browser, operating system, approximate geolocation derived from IP, referring URL, pages viewed, and timestamps. This data is collected automatically when you use the Service.

2. How we use it

To operate the marketplace — show listings, deliver messages, process boosts.
To authenticate you and keep your account secure (rate-limiting, fraud signals).
To send transactional notifications about your listings, messages, and account.
To enforce our Terms and respond to reports of abuse.
To improve the Service — aggregate analytics, performance monitoring, and (with your consent where required) marketing.
To comply with legal obligations and respond to lawful requests from authorities.

3. Legal bases (GDPR / POPIA)

Where applicable law requires, we rely on the following bases: contract (to provide the Service you signed up for), legitimate interests (to keep the platform safe and improve it), consent (for optional cookies and marketing), and legal obligation (tax, fraud, lawful disclosure).

4. Sharing

We do not sell your personal information. We share it with:

Other users — your public listings, display name, location, and reviews are visible to anyone using the Service. Direct messages are visible only to participants.
Service providers — Cloudinary (image hosting), Google Cloud / AWS (infrastructure), Sentry (error monitoring), and email providers. They process data only on our instructions.
Authorities — when required by law, court order, or to protect rights, property, or safety.

5. Cookies & similar technologies

We use cookies for:

Authentication — short-lived access tokens and a 7-day refresh token, both HttpOnly, Secure, and SameSite=Strict.
Preferences — selected country, theme, wishlist (stored locally where possible).
Analytics — aggregated usage data via first-party tooling.

You can clear cookies in your browser at any time; doing so will sign you out and reset preferences.

6. Retention

Account data is kept while your account is active. After you delete or deactivate your account, we remove personal identifiers within 30 days, except where law requires longer retention (for example, fraud investigation or tax records — typically 5 years). Listings and messages may be retained in aggregate, anonymised form for safety and analytics.

7. Security

We use industry-standard safeguards: TLS in transit, bcrypt for passwords, JWT rotation with token versioning, rate-limiting on authentication endpoints, strict Content-Security-Policy and HSTS headers, and a least-privilege deployment model. No method of transmission or storage is 100% secure; please use a strong, unique password and enable any additional protections your device offers.

8. Your rights

Depending on where you live, you may have rights under the GDPR (EU/UK), POPIA (South Africa), the Kenyan Data Protection Act 2019, the Nigeria Data Protection Act 2023, or other local laws. These typically include the right to:

Access the personal information we hold about you.
Correct inaccurate data or complete incomplete data.
Delete your data ("right to be forgotten").
Restrict or object to certain processing.
Receive a portable copy of your data.
Withdraw consent for any processing based on consent.

To exercise these rights email privacy@markethubafrica.com. We respond within 30 days.

9. International transfers

We operate primarily on infrastructure hosted in the European Union and South Africa. Where data crosses borders we rely on Standard Contractual Clauses or equivalent safeguards as required by applicable law.

10. Children

The Service is not directed to people under 18. We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us so we can delete it.

11. Changes

We may update this policy from time to time. Material changes will be communicated by email or in-app notice at least 14 days before they take effect. The "Last updated" date at the top reflects the current version.

12. Delete your account & data

You can delete your MarketHub account at any time and we'll remove the personal information tied to it within 30 days, except where law requires longer retention (see Retention above).

From inside MarketHub:

Sign in and open Dashboard → Settings.
Scroll to Danger Zone → Delete account.
Confirm with your password (or, for Google/Facebook-only accounts, follow the email confirmation link we send you).

Don't have access to your account?

Email privacy@markethubafrica.com from the address on file (or, for social sign-ins, the email tied to your Google or Facebook account). Tell us your full name and the country you registered in. We verify the request, then remove your account within 30 days and email you a confirmation when the deletion is complete.

What gets deleted: profile, listings, photos, messages, follows, wishlist, and session/login records. What we keep (and why): anonymised aggregates for fraud and safety analytics, and any records we're legally required to retain (e.g. tax, payment-dispute history) — typically up to 5 years.

13. Contact

MarketHub Africa Inc. — Data Protection Officer. privacy@markethubafrica.com. See also our Terms of Service.