Your data on Pregota

What we collect, why we need it, who sees it, and how you can see, correct or delete it. Written in plain words, under Kenya's Data Protection Act, 2019.

Last updated: 28 October 2026

The short version

Your phone number is your account. We keep it encrypted, and we never see your M-Pesa PIN — you type it on Safaricom's own screen.
We keep the records of what you do on Pregota — payments, orders, deliveries, deni — because keeping that record is the service.
Shops' names, products and prices are public. Your phone number, wallet, debts and school fees are never public.
We do not sell your data, and we do not share it for advertising.
Nothing moves money or places an order without your own tap — not the assistant, not any app.
You can ask to see, correct or delete your data at any time.

1. Who we are

Pregota is run by Icon Pages Limited under its registered business name Pregota Pay ("Pregota", "we"). It covers pregota.com, the Pregota app, and Pregota on WhatsApp. For the data described here, Icon Pages Limited is the data controller under the Data Protection Act, 2019 of Kenya.

2. What we collect

📱 Your number and nameYour phone number is your login. It is stored encrypted and looked up by a one-way code. Plus the name you give us.

👛 MoneyYour Pregota wallet balance and every movement in and out; M-Pesa payment details (amount, transaction code, time). Safaricom handles your PIN — we never receive it.

🧾 What you do on PregotaOrders, bookings, receipts, deliveries, rides, tickets, deni (who owes whom), sales you record, the products and prices you list, reviews, reels and photos you post.

💬 MessagesWhat you send Pregota on WhatsApp and in Pregota chats, including messages to the Pregota assistant, kept as your chat history.

📍 Location — only when you share itA shop's pin, a delivery drop-off, a ride pickup; a rider's location while on duty or on a job, so customers can track it.

🎙📷 Voice notes and photosA voice note is turned into words; a photo sent while shopping is named so we can search for it. We keep the words in your chat, not the recording or the picture. Photos you put on your products or reels are kept and shown.

📇 Contacts — only the ones you pickWhen you invite someone, we receive only the names and numbers you choose to share.

🪪 Verification documentsDocuments a business sends to be verified, or an ID a hotel needs for a booking — kept encrypted and seen only by the people who must check them.

🔍 SearchesWhat is searched for and the area. Shops are shown what people asked for and nobody had — never who asked.

🖥 TechnicalCookies that keep you signed in, and basic logs (such as IP address and browser) used to keep the service secure.

3. Why we use it

To run the service — your wallet, payments, orders, bookings, deliveries, rides, receipts and records.
To reach you — receipts, order updates and replies on WhatsApp and in the app.
To keep money safe — checking that a number is really yours, preventing fraud, and restricting accounts that are being misused.
To help shops serve their area — showing them what people nearby searched for and could not find, without saying who.
To make search work — understanding Swahili and English, spelling and meaning, so you find what is on real shelves.
To meet the law — keeping financial records and answering lawful requests from authorities.

4. The Pregota assistant and AI

When you write to the Pregota assistant, it reads your message to answer you. To do that, we send what is needed — your message, and the shop and product details it found — to AI providers that we use (such as OpenAI, and for some users Meta). Voice notes you send are transcribed, and a photo you send while shopping is named, by these providers. The public words of shop listings are also processed so search can find things by meaning.

The assistant can find, compare and prepare — it cannot move money, place an order or change a price on its own. Every one of those needs your own tap, and every payment needs your M-Pesa PIN. We count each AI request (which model, how long, how many words it used) without storing what was said in that count.

5. What is public

A business on Pregota is a shop front: its name, area and town, its products, services and prices, whether something is in stock or sold out, its reviews and reels are public. They can be found on pregota.com, by search engines, and by other apps and AI assistants through Pregota's public Search API.

Never public: phone numbers, wallet balances, payments, debts (deni), school fees, stock counts, costs and margins, personal profiles' details, and the content of your chats.

6. Who we share it with

The other side of what you do

A shop sees your order, your name and what it needs to deliver it; a rider sees the pickup and drop-off for the job; a school sees the payments made for its pupils; the person in a deni sees that record.

The services that make Pregota work

Safaricom (M-Pesa) — payments, top-ups and withdrawals.
Meta (WhatsApp) — carrying messages between you and Pregota.
AI providers (such as OpenAI and Meta) — the assistant, voice notes, photo search and search by meaning.
Cloudflare — storing and playing reels and live streams.
Our hosting provider — the servers Pregota runs on.
Any card payment processor we use, where card payment is offered.

When the law requires it

We share data with authorities only when Kenyan law requires it, or to protect people from fraud or harm.

We do not sell personal data, and we do not share it with advertisers.

7. Data outside Kenya

Some of the services above (such as Meta, OpenAI and Cloudflare) process data outside Kenya. We send them only what is needed for the job, and we use them under their terms of service and the safeguards the Data Protection Act requires for transfers outside Kenya.

8. How long we keep it

We keep your data while your account is active. Financial records — payments, receipts, wallet movements — are kept for as long as Kenyan law requires, even after an account is closed. Voice notes and photos used only for search are not kept after they are turned into words or a search. When something is no longer needed, we delete it or make it anonymous.

9. How we protect it

Phone numbers are stored encrypted; your M-Pesa PIN never reaches us.
Messages from M-Pesa and WhatsApp are checked to be genuine before we act on them.
Only people who need data to do their job can see it, and money moves only to numbers that have proved they are real.

No system is perfect. If a breach puts your data at risk, we will tell you and the Data Protection Commissioner as the law requires.

10. Your rights

Under the Data Protection Act, 2019 you have the right to:

Know what we hold about you and how it is used;
Get a copy of your data;
Correct anything that is wrong;
Delete your data — except records the law makes us keep;
Object to how we use it, or ask us to limit it;
Move your data to another service.

Ask us using the contact below. We may ask you to confirm the request from your own number. If you are not happy with our answer, you can complain to the Office of the Data Protection Commissioner at www.odpc.go.ke.

11. Children

Pregota accounts are for people aged 18 and over. Schools may record pupils' names to collect their fees; we use those records only for that school's collections, and only the parents or guardians on a pupil's record are asked to pay.

12. Changes to this policy

When this policy changes, we update the date at the top. If a change matters to how your data is used, we will tell you on WhatsApp or on pregota.com first.

13. Contact us

For anything about your data — a copy, a correction, a deletion, or a question:

Message Pregota on WhatsApp