Privacy Policy

1. Introduction

Welcome to Spiritbulb. This Privacy Policy explains how Spiritbulb LTD ("Spiritbulb", "we", "our", or "us"), a company registered in Kenya, collects, uses, stores, and protects your personal information when you use any of our platforms and services, including:

• Nuru — our student community network
• Reach — our local e-commerce marketplace
• Menengai Cloud (MCloud) — our store and creator tools platform
• Tufike — our in-person events platform

By accessing or using any Spiritbulb service, you agree to the terms of this Privacy Policy. If you do not agree, please do not use our services.

2. Who We Are

Spiritbulb LTD is a Kenyan technology company building digital tools for commerce, community, and education. Our registered office is in Kenya.

For questions or concerns about your data, contact us at: privacy@spiritbulb.org

3. Information We Collect

We collect information you provide directly, information generated by your use of our services, and in some cases, information from third parties.

3.1 Information You Provide

• Account information: name, email address, phone number, and password when you register.
• Profile information: campus, course, business name, location, profile photo, and any other details you choose to add.
• Payment information: when you make or receive payments via M-Pesa, card, or other supported payment methods. We collect transaction identifiers and amounts. Full card details are processed by our payment partners and are not stored on our servers.
• Content you create: product listings, posts, messages, event registrations, and any other content you upload or submit.
• Communications: messages you send to us via email, support forms, or chat.

3.2 Information Generated Automatically

• Usage data: pages visited, features used, time spent, clicks, and search queries.
• Device information: IP address, browser type, operating system, and device identifiers.
• Location data: general location inferred from your IP address. We do not collect precise GPS location without your explicit consent.
• Cookies and similar technologies: session cookies for keeping you logged in, analytics cookies for understanding usage patterns, and preference cookies for remembering your settings. See Section 9 for more.

3.3 Information from Third Parties

• Payment processors (e.g. M-Pesa, card processors) may share transaction confirmation data with us.
• If you connect a third-party account, we may receive limited profile information as permitted by that service.

4. How We Use Your Information

We use your information to:

• Create and manage your account and provide our services.
• Process transactions and send payment confirmations.
• Enable merchants and buyers to connect on Reach.
• Power community features on Nuru, including campus-based spaces and group coordination.
• Provide store and creator tools on Menengai Cloud.
• Organise and facilitate events on Tufike.
• Respond to your support requests and communications.
• Send you service-related notifications (e.g. order updates, event reminders).
• Send you marketing communications, where you have opted in or where permitted by law. You may opt out at any time.
• Detect and prevent fraud, abuse, and security incidents.
• Comply with our legal obligations under Kenyan law and other applicable regulations.
• Improve our products through analytics and user research.

We do not sell your personal information to third parties.

5. Legal Basis for Processing

We process your data on the following grounds:

• Performance of a contract: to deliver the services you signed up for.
• Legitimate interests: to improve our services, ensure security, and detect fraud, where these interests are not overridden by your rights.
• Legal obligation: where we are required to process your data by law.
• Consent: for marketing communications and any processing for which we have specifically asked your consent. You may withdraw consent at any time.

6. How We Share Your Information

We share your information only in the following circumstances:

6.1 With Other Users

• On Reach, your business name, listed products, prices, and general location are visible to buyers on the platform.
• On Nuru, your profile and content within shared spaces are visible to other members of those spaces.
• On Tufike, your event registration details may be visible to event organisers.

6.2 With Service Providers

We work with trusted third-party companies to help us operate our services — for example, hosting providers, payment processors, and analytics services. These providers are contractually required to use your data only to perform services on our behalf.

6.3 For Legal Reasons

We may disclose your information if required to do so by law, court order, or government authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Spiritbulb, our users, or the public.

6.4 Business Transfers

If Spiritbulb is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on our platforms before your data is transferred and becomes subject to a different privacy policy.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide our services. If you delete your account, we will delete or anonymise your personal data within 90 days, except where we are required to retain it for legal or regulatory purposes (e.g. financial records related to transactions).

8. Your Rights

You have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: request that we correct inaccurate or incomplete data.
• Deletion: request that we delete your personal data, subject to legal obligations.
• Restriction: request that we restrict processing of your data in certain circumstances.
• Objection: object to processing based on legitimate interests, including for direct marketing.
• Portability: receive your data in a structured, machine-readable format.
• Withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at privacy@spiritbulb.org. We will respond within 30 days.

9. Cookies

We use cookies and similar technologies to operate our services and understand how they are used. You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of our platforms.

10. Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, or misuse. These include encrypted data transmission (HTTPS), access controls, and regular security reviews.

No system is completely secure. If you believe your account has been compromised, contact us immediately at privacy@spiritbulb.org.

11. Children and Minors

Our services are intended for users who are 18 years of age or older. We do not knowingly collect personal data from individuals under 18. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly. If you believe a minor has registered on our platform, please notify us at privacy@spiritbulb.org.

12. International Data Transfers

Spiritbulb is based in Kenya. If you access our services from outside Kenya, your information may be transferred to and processed in Kenya. We take appropriate steps to ensure that any such transfers are handled in accordance with applicable data protection law.

13. Third-Party Links

Our platforms may contain links to third-party websites or services. This Privacy Policy applies only to Spiritbulb's services. We are not responsible for the privacy practices of third-party sites and encourage you to review their policies.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you via email or a prominent notice on our platforms at least 14 days before the changes take effect. The "Last updated" date at the top of this page will always reflect the most recent revision.

Your continued use of our services after changes take effect constitutes your acceptance of the revised policy.

15. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy, please contact:

Spiritbulb LTD Email: privacy@spiritbulb.org Website: spiritbulb.org