Privacy Policy

The Services are owned and operated by Rebu Technology, a business registered in Tanzania. Rebu Mall is the consumer marketplace product of Rebu Technology, connecting buyers and sellers, primarily within university student communities in Tanzania. Rebu Technology acts as the controller of personal data described in this Policy.

Legal entity: Rebu Technology
Product / brand: Rebu Mall
Website: https://rebumall.co.tz

Contact: rebutanzania@gmail.com. Support phone (where published in the app): +255 625 358 254.

Depending on how you use the Services, we may collect:

Account and identity

• Name and email address (including via Google or Apple Sign-In)
• Google / Apple account identifiers and authentication method
• Phone number and phone verification status (OTP via SMS)
• Profile details you provide (including seller business name, description, and profile image)

Orders, delivery, and payments

• Buyer name, contact phone, and delivery address
• GPS coordinates and geocoded address for delivery options that require location (for example Bolt)
• Saved addresses (name, phone, address, coordinates)
• Order history, product selections, delivery option, payment channel (mobile money or cash on delivery), payment references, and settlement / escrow status
• Payment processing is handled by our payment provider (PayMe Africa). We do not store your mobile money PIN

Seller application and operations

• Business phone, business address, pickup location (including coordinates), whether you offer your own delivery, and agreement acceptance records
• We do not currently collect government ID documents as part of standard seller onboarding

Device, notifications, and usage

• Push notification tokens (Expo) so we can send order and account notifications
• First-party usage analytics such as home visits, product views/clicks, search activity, and checkout funnel events used to operate and improve the Services
• Technical logs needed for security, debugging, and fraud prevention

Communications

• Messages you send to support, feedback you submit, and SMS we send for OTP or operational alerts

Sellers may optionally connect an Instagram Business or Creator account to Rebu Mall using Instagram Login. With the seller's authorization, we request these Instagram permissions:

• instagram_business_basic — basic profile (Instagram user id, username) and media needed to link posts to products
• instagram_business_manage_comments — detect purchase-intent comments (for example price inquiries) and reply publicly where enabled
• instagram_business_manage_messages — send private replies / Direct Messages with product information, secure checkout links, payment links, and order status updates

What we store for Instagram sellers

• Instagram business user id and username
• Encrypted long-lived access token and token expiry (tokens are encrypted at rest)
• Connection timestamp and public-reply preferences
• Post-to-product links (media id, optional cached media metadata such as type, URL, permalink, caption, and the linked Rebu Mall product)
• Conversation state used for inbox / handoff (for example last message preview), not a full permanent archive of every Instagram message

What we store for Instagram buyers

• Instagram-scoped user id (ASUID) from messaging / webhook events
• Name, phone, delivery address / location entered during Instagram checkout
• Order records sourced from Instagram (DM, comment-to-DM, storefront, or manual link), including related media / referral identifiers where applicable

How Instagram data is used

• Map Instagram posts to catalog products
• Receive comment and message webhooks to detect purchase intent
• Reply on the seller's behalf with product and checkout information
• Complete orders and send order / payment / delivery updates in Instagram Direct
• Refresh tokens so the connection remains functional

We do not sell Instagram or Meta user data. We use it only to operate Social Commerce, fulfill orders, prevent abuse, and comply with law.

Sellers can disconnect Instagram in the Rebu Mall app, which removes stored access tokens from our systems. Disconnecting in Rebu Mall does not by itself remove Rebu Mall from the Instagram Accounts Center; sellers should also revoke access there for a full Apps and websites reset. Buyers and users may request deletion as described in Section 10.

• Create and manage accounts; verify phone numbers
• Process orders, payments, escrow / settlement, refunds where applicable, and seller payouts (including the platform commission on product price)
• Coordinate delivery with partners (including Bolt) and sellers who deliver themselves
• Operate Instagram Social Commerce as described above
• Send transactional notifications (push / SMS / in-app / Instagram DM where connected)
• Provide customer support and dispute assistance
• Improve product discovery, reliability, and safety; detect fraud and abuse
• Comply with legal obligations and enforce our Terms and Seller Agreement

We share personal data only as needed to run the Services:

• Sellers and buyers: limited order and contact details needed to fulfill and communicate about an order
• PayMe Africa: payment initiation and confirmation for mobile money
• Bolt: pickup / drop-off locations and related delivery details when Bolt delivery is selected
• Textify (or equivalent SMS provider): phone OTP and operational SMS
• Cloudinary: image hosting for product and profile media
• Meta / Instagram: API calls using seller-authorized tokens to read permitted media and send allowed replies / messages
• OpenStreetMap Nominatim: reverse / forward geocoding of addresses
• Hosting, database, and queue providers (for example cloud hosting, MongoDB, Redis) that process data on our instructions
• Authorized Rebu Mall staff (admin tools): support, fraud, fulfillment, seller approval, and payouts
• Authorities: when required by law or to protect rights and safety

We do not sell personal data to third parties for their independent marketing.

On our website we use:

• Authentication cookies (access / refresh tokens) to keep you signed in
• Referral cookie (rebu_ref) to attribute referrals for a limited period

These are necessary for core website features. You can control cookies in your browser; disabling them may prevent login or other functions. We do not currently operate third-party advertising pixels on the website.

We retain personal data only as long as needed for the purposes above, including order history for accounting, dispute resolution, and legal compliance; seller Instagram tokens until disconnect or expiry; and deletion requests until processed. When you delete your account, we anonymize or remove personal fields where feasible, though some order records may be retained in anonymized or limited form for legitimate business and legal needs.

• TLS encryption in transit
• Encrypted storage of Instagram access tokens
• Access controls for admin tools and APIs
• Webhook signature verification for Meta events
• Secure payment handling via our payment provider

No method of transmission or storage is 100% secure. Please protect your devices and accounts.

Subject to applicable Tanzanian law, you may request to:

• Access or correct personal data we hold about you
• Delete your account / request erasure
• Disconnect Instagram (sellers) in the app
• Opt out of non-essential promotional notifications where offered
• Request a copy of key account data via support (portability on request)

Contact rebutanzania@gmail.com. You may also delete your account in the mobile app (Profile / My Account) where available.

You can request deletion in any of these ways:

• In the Rebu Mall mobile app: delete account from Profile / My Account
• Public request form on our API host: Data Deletion Request (hosted on our API server at /delete)
• Email: rebutanzania@gmail.com
• Meta / Instagram users: when Meta sends a User Data Deletion request to our callback at https://fivestars-express-server.onrender.com/meta/data-deletion, we verify the signed request, remove or anonymize associated Instagram-linked data where applicable, and return a confirmation code plus status URL as required by Meta

Deletion requests are typically processed within a reasonable period. We may retain limited information where required by law or for fraud prevention.

The Services are intended for users who are at least 18 years old. We do not knowingly collect personal data from children under 18. If you believe we have collected such data, contact us and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time. The "Last updated" date will change when we do. Continued use of the Services after an update means you accept the revised Policy. Material changes may also be communicated in-app or by email where appropriate.

Privacy and data protection inquiries: rebutanzania@gmail.com

Related documents: Terms of Service · Seller Agreement