Privacy Policy

Data controller

Karibu, operated by Provecta Group, is the data controller responsible for your personal data. We process personal data in line with the Data Protection Act, 2019 of Kenya. You can reach our data protection contact at privacy@karibu.africa.

What we collect

When you register we collect your name, email address, the role you choose, and your account password (stored only as a secure hash). As you use Karibu we may also collect property searches, saved listings, enquiries you send, and basic technical information such as device and usage data. To run our free AI tier fairly we also create a device identifier (see “Device identifiers and the bRRAIn free tier” below).

Why we use it (purposes)

• To create and operate your account.
• To provide property search, listings and related services you ask for.
• Where you ask us to, to help with title searches or to share a lead with a lender — each with your specific consent.
• To send you marketing updates — only if you opt in, and you can unsubscribe at any time.
• To keep the platform secure and meet legal obligations.

Lawful basis and consent

We rely on your consent for processing tied to your account and for optional purposes such as marketing. We keep a record of the consents you give and when you give them, so you can see and withdraw them. Withdrawing consent does not affect processing that already happened.

Device identifiers and the bRRAIn free tier

Karibu bRRAIn, our AI assistant, is free for a limited number of questions. To apply that allowance fairly and to prevent abuse, we identify the device you use — separately from any account — so the free allowance cannot be reset simply by creating new accounts. Specifically, we:

• store a first-party cookie (kbv) containing a random device identifier;
• derive a non-reversible “fingerprint” by hashing that identifier together with coarse, low-detail browser signals (your browser’s user-agent and preferred language);
• store your IP address only as a salted, non-reversible hash, used for abuse review.

This is a first-party measure: the data stays within Karibu and is not shared with any third-party tracking, advertising or device-intelligence service. Our lawful basis is our legitimate interest in keeping a free service available and preventing fraud and abuse, balanced against your privacy. We use this data only to count free usage, enforce the fair-use limit, and flag accounts that try to circumvent it — not to build advertising profiles. We keep device records for up to 24 months, after which they are deleted or anonymised. You can clear the kbv cookie in your browser at any time; doing so may reset how the free allowance is counted on that device.

Sharing

We do not sell your personal data. We share it only with service providers who help us run Karibu (such as email and hosting), and with third parties like lenders or title-search providers when you specifically ask us to.

Your rights

Under the Data Protection Act, 2019 you have the right to be informed, to access your data, to ask us to correct or delete it, to object to or restrict certain processing, and to data portability. You may also lodge a complaint with the Office of the Data Protection Commissioner. To exercise any of these, contact privacy@karibu.africa.

Retention

We keep your personal data for as long as your account is active and as needed to provide the service, then for any period required to meet legal, tax or dispute-resolution obligations, after which it is deleted or anonymised.

Changes

We may update this policy and will note the date of the latest version above. Significant changes will be communicated through the platform.