Privacy Policy

Last updated: 19 October 2026

Plugg ("Plugg", "we", "us") gives Kenyan businesses an online storefront and helps customers find and contact them. This policy explains what personal data we collect, why, how long we keep it, and the choices you have — under the Kenya Data Protection Act, 2019.

1. Data we collect

Account data

• Phone number — required for sign-in; verified by a one-time SMS code.
• Name — shown on your profile, reviews and enquiries.
• Google account — if you sign in with Google we receive your name, email and profile picture from Google.

Merchant data (business owners)

• Business profile: name, description, category, contacts, location (including map coordinates if you pin them), opening hours, delivery and payment options, M-Pesa till/paybill.
• Listing content: products, services, portfolio items, prices, photos and videos you upload.
• Team members you add to a shop.

Shopper activity

• Enquiries — your name, contact (phone or email), message, preferred contact channel and requested time slot.
• Reviews — your rating, name and review text.
• Follows, chats and reports — shops you follow, messages sent to merchants, and shops or listings you report.

On-device data (never sent to us)

• Your cart, favorite items and saved shops are stored in your browser's local storage on your own device. They are not transmitted to our servers and are cleared if you clear browser data.

Automatic data

• Usage analytics — page views, searches, clicks and similar events, linked to an anonymised session identifier.
• IP address and device — used for security, rate limiting and abuse prevention.
• Location (optional) — if you tap "Near me" on Discover, your browser asks for your location. It is used once to sort results by distance and is not stored.

2. How we use it

• Run the service: sign you in, host storefronts, deliver enquiries to merchants, show reviews.
• Notify merchants of new enquiries and orders (including by SMS).
• Keep the platform safe: spam and abuse detection, rate limiting, moderation.
• Understand and improve the product through aggregated analytics.
• Send essential service messages (sign-in codes, receipts, account notices).

We do not sell your personal data, and we do not use it for advertising profiles.

3. What is public

Merchant storefronts are public by design. Business names, listings, photos, prices, contact details, location and reviews you publish are visible to anyone and may be indexed by search engines. Your reviews and name appear publicly next to the shops you review.

4. Who we share it with

• The merchant you contact — when you send an enquiry or start a chat, that merchant sees your name, contact and message.
• Africa's Talking — delivers your sign-in codes and merchant notifications by SMS.
• Google — only if you choose Google sign-in.
• WhatsApp/Meta — "Order on WhatsApp" links open WhatsApp; that conversation is governed by WhatsApp's own privacy policy, not ours.
• Infrastructure providers — our hosting (Hetzner) and edge security (Cloudflare) process data to serve the site.
• Authorities — where the law requires it.

5. Cookies

We use one session cookie to keep you signed in. We do not use advertising or cross-site tracking cookies. Service-worker caches support offline use and can be cleared from your browser settings.

6. Retention

Account and shop data is kept while the account or shop is active. Enquiries, reviews and analytics are retained for as long as they are useful to merchants and for safety audits. When you delete your account we delete or anonymise your personal data, except where the law requires us to keep it (for example, transaction records).

7. Your rights

Under the Kenya Data Protection Act you may ask us to access, correct or delete your personal data, object to or restrict processing, or withdraw consent. You can also complain to the Office of the Data Protection Commissioner (odpc.go.ke). To exercise a right, email [email protected] — we respond within 30 days.

8. Security

Passwords do not exist on Plugg — sign-in is by one-time code or Google, so there is no password database to breach. Sessions expire, rate limits slow abuse, uploads are scanned and moderated, and administrative actions are audit-logged. No system is perfect, but we treat your data as carefully as we expect our own to be treated.

9. Children

Shops must be run by adults. Customers of any age may browse, but accounts are intended for users aged 18 and above.

10. Changes and contact

We will post policy changes on this page and, for material changes, notify account holders. Questions or requests: [email protected].