Privacy Policy

Javen ("we", "us", "our", or "the Platform") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share your information when you use our escrow, reputation, and dispute resolution services.

We comply with the Kenya Data Protection Act, 2019 (DPA) and the regulations issued by the Office of the Data Protection Commissioner (ODPC). By using Javen, you consent to the practices described in this policy.

Javen is the data controller for personal information collected through the Platform. Our Data Protection Officer can be reached via our Contact page.

3.1 Information You Provide

• Mobile phone number (required for OTP authentication).
• Username (chosen during registration, publicly visible).
• National ID number and ID photo (for KYC verification, optional but required for higher transaction limits).
• Witness information (name, phone) for identity verification through our witness confirmation system.
• Transaction details (item titles, descriptions, amounts, shipping information).
• Dispute evidence (photos, chat logs, documentation).
• Communication content (escrow chat messages, dispute negotiation messages).
• Courier phone numbers and delivery confirmation data.
• Parcel photos with optional geolocation data (latitude/longitude).
• Item fingerprint photos and SHA-256 hashes for high-value transactions.

3.2 Information We Collect Automatically

• IP address and approximate geographic location.
• Device information (browser type, operating system, device identifiers).
• Usage data (pages visited, features used, session duration).
• Transaction metadata (timestamps, status changes, payment receipts).
• M-Pesa transaction references and checkout request IDs.
• Cookies and similar tracking technologies (see Section 10).

3.3 Information from Third Parties

• M-Pesa/Airtel Money payment confirmation data from Safaricom/Airtel.
• Courier confirmation data from delivery personnel.
• Witness confirmation responses.
• Platform partner data (if you access Javen through an integrated marketplace).

We use your personal data for the following purposes:

• Account Management: Creating and managing your account, OTP authentication, username registration.
• Escrow Services: Processing transactions, holding funds, generating DC-OTPs, tracking delivery, releasing payments.
• Reputation System: Calculating and maintaining your J-Score, tier status, and public trust profile.
• Dispute Resolution: Managing disputes, evidence collection, mediator panel assignment, and resolution enforcement.
• KYC Verification: Verifying your identity through National ID and witness confirmation.
• Communications: Sending SMS notifications, in-app notifications, and transactional messages.
• Security: Fraud detection, prevention of unauthorized access, encryption of sensitive data.
• Analytics: Improving Platform features, understanding usage patterns, and optimizing performance.
• Legal Compliance: Meeting regulatory obligations, responding to lawful requests, and enforcing our Terms.

Under the Kenya DPA 2019, we process your personal data based on:

• Consent: You provide consent when registering and using the Platform.
• Contractual Necessity: Processing is necessary to perform the escrow services you request.
• Legitimate Interests: Fraud prevention, Platform security, and service improvement.
• Legal Obligation: Compliance with Kenyan financial regulations and the Data Protection Act.

We do not sell your personal data. We may share your information with:

• Transaction Counterparties: Your username, J-Score, and tier are visible to users you transact with. Transaction details are shared between buyer and seller.
• Public Trust Profile: Your username, J-Score, tier, and selected profile fields are publicly visible (configurable in privacy settings).
• Mediators: Dispute evidence and transaction details are shared with assigned mediators for resolution purposes.
• Payment Providers: M-Pesa (Safaricom) and Airtel Money receive your phone number and transaction amounts for payment processing.
• Couriers: Delivery personnel receive parcel IDs and confirmation links for delivery verification.
• Platform Partners: If you access Javen through an integrated marketplace, relevant transaction data may be shared per the partner's agreement.
• Law Enforcement: We may disclose data when required by law, court order, or to protect the rights and safety of users.
• Service Providers: Cloud hosting (AWS/R2), SMS providers, and analytics services under data processing agreements.

We implement industry-standard security measures to protect your data:

• AES-256 encryption for phone numbers and sensitive personal data at rest.
• TLS 1.3 encryption for all data in transit.
• SHA-256 hashing for parcel photos and item fingerprints.
• JWT-based authentication with short-lived tokens.
• Rate limiting and brute-force protection on OTP and DC-OTP endpoints.
• DC-OTP brute-force lockout after maximum failed attempts.
• Idempotency keys to prevent duplicate payment processing.
• Security audit logging for all administrative actions.
• Two-admin override for destructive administrative actions.
• Regular security assessments and penetration testing.

We retain your personal data for as long as necessary:

• Active Accounts: Data is retained while your account is active.
• Transaction Records: Escrow transaction data is retained for a minimum of 7 years for compliance and audit purposes.
• Deleted Accounts: Upon account deletion, personal data is anonymized or deleted, except for transaction records required by law.
• J-Score History: Reputation data is retained to maintain the integrity of the reputation system, even after account deletion.
• Dispute Records: Dispute evidence and resolutions are retained for 7 years.

Under the Kenya DPA 2019, you have the following rights:

• Right to Access: Request a copy of your personal data we hold.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data (subject to legal retention requirements).
• Right to Restrict Processing: Request that we limit how we use your data.
• Right to Data Portability: Request your data in a machine-readable format.
• Right to Object: Object to processing based on legitimate interests.
• Right to Withdraw Consent: Withdraw consent at any time (may affect Platform functionality).

To exercise any of these rights, contact us via our Contact page. We will respond within 21 days as required by the ODPC.

Javen uses cookies and similar technologies for:

• Authentication: Maintaining your logged-in session.
• Preferences: Remembering your language preference (English/Swahili).
• Analytics: Understanding how users interact with the Platform to improve experience.

You can manage cookies through your browser settings. Disabling cookies may affect Platform functionality.

Javen is not intended for users under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

Your data is primarily stored and processed within Kenya. In cases where data is processed outside Kenya (e.g., cloud infrastructure), we ensure adequate protection through standard contractual clauses and compliance with the Kenya DPA 2019 cross-border transfer requirements.

We may update this Privacy Policy from time to time. Significant changes will be communicated via in-app notification or email. Your continued use of the Platform after changes constitutes acceptance of the updated policy.

If you have a complaint about how we handle your personal data, you may:

1. Contact us via our Contact page for internal resolution.
2. Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.

For privacy-related inquiries, contact us via our Contact page.