Privacy notice

This notice covers two groups: shoppers who send us a code on WhatsApp, and the brands — and their staff — who use the Jireward dashboard.

Jireward is a service run from Nairobi, Kenya. We are the data controller for the personal data described here, and we handle it under Kenya’s Data Protection Act, 2019.

• Your WhatsApp number. We do not keep your name.
• The codes you send, which product and campaign each belonged to, and when.
• Your survey answers, if you take part in a survey.
• The number and network you ask to be paid on, which we remember so you don’t have to type it again, and a record of each payment.
• What you write to us when you ask for help, and our replies.
• A count of the messages we send you and whether they were delivered — not what they said. The message reference, which contains your number, is deleted after three days.

We do not collect your location, your contacts, or anything else from your phone.

To check your code is genuine, pay your reward, remember where to send the next one, answer you when you ask for help, and keep the service working and free of fraud — for example by limiting how many wrong codes one number can try.

We do not send you marketing, and we do not message you except in reply to you or about a reward or help request you started.

The brand whose pack you bought never sees your name or your phone number, and cannot contact you through us. They see that a code was claimed, which product and print run it came from, when, and what was paid — with you shown only as an anonymous reference.

If you answer a survey, they see your answers, not who gave them.

For each person on a brand’s account: their name, work email, phone number where given, role, and a record of what they do in the dashboard — campaigns, print runs, payments, exports and changes to the team.

For the brand: its company details, and its wallet — funding, reservations, payouts and withdrawals — together with the references our payments provider gives us.

If you contact us through the website’s form, we keep your message and the details you gave us so we can reply.

To run your account and campaigns, take and reconcile payments, keep the financial records the law requires, secure the service, and support you. We may email account contacts about their account and, where they have agreed, about our service — you can opt out of the second at any time.

Under the Data Protection Act, 2019, we rely on:

• Contract: paying a reward you claimed, or providing the service your company signed up for.
• Legitimate interests: keeping the service working, preventing fraud and copied packs, and improving it.
• Legal obligation: keeping financial and tax records.
• Consent: where we ask for it, such as marketing email to a brand contact. You can withdraw it at any time.

We use a small number of providers, and give each only what it needs:

• IntaSend, our payments provider, to hold brand funds and send rewards to M-Pesa.
• Meta (WhatsApp), to carry our conversation with shoppers.
• Safaricom and Airtel, to deliver airtime to the number chosen.
• Supabase, which hosts our database and service.
• ZeptoMail, to send email such as team invitations and replies to enquiries.

We do not sell personal data, and we never give a brand its shoppers’ contact details. We share data with authorities only where the law requires it.

Some of these providers store or process data outside Kenya. Where they do, they are bound by contract to protect it to the standard the Act requires.

• Readable codes: destroyed 30 days after a print run is created. After that we hold only a fingerprint, which can recognise a code but cannot reproduce one.
• WhatsApp message references: deleted after three days.
• Scans, rewards, payments and wallet records: kept for as long as financial and tax law requires — at least seven years.
• Help conversations: kept for 12 months after the request is closed.
• Dashboard accounts: kept while the account is open, and then only what the financial record needs.

Access is limited by role, and each brand can reach only its own data — enforced by the database itself, not just by the screens. Staff who handle help requests see only what they need to answer them. If a breach puts your data at risk, we will tell you and the Data Protection Commissioner as the Act requires.

You can ask us for a copy of your data, ask us to correct or delete it, object to how we use it, or ask us to restrict that use. A shopper can do this by typing “help” in the chat; anyone can write to us at the address below. We will answer within 30 days. Our Deleting your data page (/legal/data-deletion) explains exactly how deletion works.

Deleting your number does not undo payments already made: those stay on the financial record, without anything that identifies you beyond what the law requires.

If we cannot resolve something, you can complain to the Office of the Data Protection Commissioner (odpc.go.ke).

This website sets no tracking or advertising cookies and runs no analytics. The dashboard uses only the cookies it needs to keep you signed in.

Jireward is for people aged 18 and over. We do not knowingly keep data about anyone younger; if you think we have, tell us and we will delete it.

If we change how we handle personal data, we will update this page and the date at the top, and tell brand account holders by email where the change matters.