This policy explains what personal information Leo Kipuso Limited ("Leo", "we", "us") collects when you use the Leo mobile app and leokipuso.com, why we collect it, and the choices you have. We do not sell your personal information.
1. Who we are
Leo Kipuso Limited is a company registered in the United Republic of Tanzania, with its registered office in Dar es Salaam. We are responsible for the personal information described in this policy. You can contact us at support@leokipuso.com.
2. Information we collect
Information you give us
- Account details: your name, username, phone number, email address, password (stored only in encrypted form) and, if you add one, a profile photo.
- Listings and activity: photos, titles, descriptions, prices, condition, category and the city or region you enter for items you list; your comments, likes, favourites, reviews and auction bids.
- Seller verification: if you choose to become a verified seller, your National ID (NIDA) number, a selfie and any documents you submit, which we use only to confirm your identity.
- Payments: when you pay for paid features such as boosts, auction slots or subscriptions, we record the amount, the item purchased, the payment status and the phone number used for mobile money. We do not receive or store your mobile money PIN or full card details.
- Messages to us: anything you send when you contact support.
Information from Google and Apple sign-in
If you sign in with Google (or Apple on iOS), we receive your name, email address and profile picture from that account, and a unique account identifier. We use this only to create and sign you in to your Leo account and to show your name and photo on your profile. We do not access your contacts, Gmail, Drive or any other Google data, and we do not use Google data for advertising.
Information collected automatically
- Device and app data: device type, operating system, app version and a push notification token so we can send you notifications.
- Usage data: which listings you view and basic logs that help us keep the service secure and working.
The Leo app does not collect your precise GPS location, your contacts, or your call or SMS history.
3. How we use your information
- To create and manage your account, and to keep you signed in.
- To send one-time codes by SMS or email to verify your phone number or email address.
- To publish your listings, comments, reviews and bids, and to show your public profile to other users.
- To run auctions, flash sales and paid features, and to process payments.
- To verify sellers and help keep the marketplace safe.
- To send notifications about your listings, bids, favourites and account (you can turn these off in your phone's settings).
- To provide support, prevent fraud and abuse, and enforce our Terms of Service.
- To improve and fix the app.
- To meet our legal obligations.
4. Use of Google user data
Leo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only request your basic profile (name, email address and profile picture), we use it only to provide sign-in and your Leo profile, and we never sell it or use it for advertising.
5. How we share information
With other users. Your public profile (name, username, profile photo, verified badge), your listings, comments, reviews and bids are visible to other Leo users. If you choose to show a phone number for buyers to contact you, it will be visible to them.
With service providers who process information for us under contract and only to provide their service:
| Provider | Purpose |
|---|---|
| Supabase | Database, file storage and account sign-in |
| SMS and email providers | Sending one-time verification codes |
| Google and Apple | Sign in with Google or Apple; app distribution and in-app subscriptions |
| OneSignal | Push notifications |
| RevenueCat | Managing subscriptions |
| Mobile money payment partners | Processing M-Pesa, Mixx by Yas and Airtel Money payments |
For legal reasons. We may disclose information if required by law, court order or a competent authority in Tanzania, or to protect the rights, safety and property of our users, the public or Leo Kipuso Limited.
Business changes. If our business is merged or sold, your information may transfer to the new owner, who must keep protecting it as described here.
We do not sell or rent your personal information.
6. International transfers
Some of our service providers store or process information on servers outside Tanzania. When this happens we use providers that apply appropriate security safeguards, in line with the Personal Data Protection Act, 2022 of Tanzania.
7. How long we keep information
We keep your information while your account is active. When you delete your account, we delete or anonymise your personal information within 30 days, except where we must keep certain records (for example payment records) for longer to meet legal, tax or accounting obligations, resolve disputes or prevent fraud. Seller verification documents are kept only as long as needed to verify you and meet legal requirements.
8. Your rights and choices
- Access and correction: you can view and edit most of your information in the app, or ask us for a copy.
- Deletion: you can ask us to delete your account and personal information. See Delete your account.
- Objection and withdrawal of consent: you can object to certain uses or withdraw consent where we rely on it.
- Notifications: you can turn off push notifications at any time in your device settings.
- Google access: you can remove Leo's access to your Google account at myaccount.google.com/permissions.
To exercise these rights, email support@leokipuso.com. You may also complain to the Personal Data Protection Commission of Tanzania.
9. Security
We protect your information with encryption in transit, access controls on our database, encrypted storage of passwords and keys, and limited staff access. No method of transmission or storage is completely secure, so please keep your password and one-time codes private.
10. Children
Leo is intended for people aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.
11. Changes to this policy
We may update this policy from time to time. We will post the new version on this page with a new effective date, and tell you in the app if the changes are significant.
12. Contact us
Leo Kipuso Limited
Dar es Salaam, United Republic of Tanzania
Email: support@leokipuso.com