Privacy policy
Last updated 11 November 2026
Draft, under advocate review. The version in force at launch will be shown here with its date.
This policy explains how Narua App collects, uses and protects personal information, in line with the Kenya Data Protection Act, 2019. Narua App is operated by Narua Kenya, Murang'a Town, Kenya, who is responsible for your data. Contact: hello@droplix.ke · +254700000000 (phone/WhatsApp).
1. What we collect
| From | Information |
|---|---|
| Website visitors | Phone number and, if given, name, email address and area, stage or business name when you join the waitlist or apply; where you came from (for example a campaign link); your consent and its date; aggregate, cookie-free page statistics |
| Customers | Name, phone number, delivery locations, order history, M-Pesa payment confirmations |
| Riders | Name, ID number, phone, licence and motorbike details, live location while online, earnings |
| Restaurants | Business and owner details, menu, payout number, order records |
| Everyone | Device and app usage information needed to keep the service working and secure |
2. Why we use it
- To take, prepare, pay for and deliver orders.
- To show riders and customers where an order is.
- To send order updates and login codes by SMS, and, if you joined the waitlist, one welcome message (SMS, and email if you gave an address) and one notice when the app is ready. Every message tells you how to opt out.
- To pay riders and restaurants and keep financial records.
- To handle complaints, prevent fraud and improve Narua App.
- To send offers, only if you agree. You can opt out at any time.
3. Who we share it with
- The restaurant gets your order details. The rider gets your name, phone number and delivery location for that order only.
- Service providers who help run Narua App: Safaricom M-Pesa (payments), our SMS provider, our email provider, our bot-protection provider on web forms, and our secure cloud hosting and database provider.
- Authorities, only where the law requires it.
- We never sell your personal information.
4. How we protect it
- Encrypted connections and a secure, access-controlled database.
- Staff, riders and restaurants see only what they need for an order.
- Regular backups and activity logs.
5. How long we keep it
We keep personal information only as long as we need it for the purpose it was collected, or as long as the law requires us to keep records. The table shows the main periods. When a period ends the information is deleted or can no longer be linked to you. Your delivery addresses, saved places, notification settings, devices and push tokens are deleted when you delete your account.
| Information | How long |
|---|---|
| Orders, payments, refunds, invoices and tips | 7 years (tax and dispute records) |
| Money ledger entries | 10 years (financial records) |
| Staff and money action log | 7 years |
| Incident and safety reports | 7 years (insurance and legal defence) |
| Order ratings and trust records | 3 years |
| Support tickets and order complaints | 2 years |
| Order chat messages | 1 year |
| Rider and shop identity documents and verification results | 1 year after the account closes or the application is rejected, then deleted |
| Raw M-Pesa payment messages | 1 year |
| Rider location history | 30 days |
| Delivery, receipt and dispute photos | 90 days |
| In-app notifications | 90 days |
| Parcel recipient name and phone number | 90 days after the order closes |
| Waitlist sign-ups and the record of messages we sent them | Deleted within 90 days of launch, or sooner on request |
| A scrambled record that you opted out of messages | Kept so we never message you again; it cannot be turned back into your number or email |
| Other marketing sign-ups | 2 years at most, and deleted on request |
| Login codes, rate-limit and retry data | Days or less |
6. Your rights
Under the Data Protection Act you can ask to see the information we hold about you, correct it, delete it, or object to how it is used. You can delete your account yourself in the app (see our account deletion page), or contact us using the details above and we will respond within 30 days. You can also complain to the Office of the Data Protection Commissioner (ODPC).
7. Children
Narua App is not intended for children under 18 without a parent or guardian's permission.
8. Changes
We may update this policy and will show the latest version here and in the app with its date.