Privacy Policy

AfroRow (“AfroRow”, “we”, “us”, or “our”) runs an online marketplace where event organizers (“sellers”) list events and attendees (“buyers”) discover, buy, reserve, transfer, and resell tickets. This Privacy Policy explains what personal data we collect, why, who we share it with, how long we keep it, and your rights. It applies to our website and services (the “Platform”) and should be read with our Terms and Conditions.

AfroRow is the data controller for the personal data described here, and we process it in line with the Kenya Data Protection Act, 2019 and its regulations. Organizers who receive attendee data for their own events are responsible for how they use it.

• Account information. When you sign up, our sign-in provider (Clerk) creates your account with your name, email address, and sign-in details (such as a password or a linked Google or other account). We keep your name, email, and your role on the Platform (buyer, seller, door staff, or admin).
• Guest checkout details. If you buy or reserve without an account, we create a guest profile from the name and email you enter. If you later sign in with a verified account using the same email, your guest tickets move to that account and the guest profile is deleted.
• Ticket holder details. For each purchase or reservation we collect the holder’s name, email address, and phone number, so we can issue the tickets, email them, and check them at entry.
• Payment information. For paid tickets, resell purchases, and upgrades we collect the M-Pesa phone number you pay from, the amount, Safaricom’s transaction references and M-Pesa receipt number, and the result of each payment attempt. We never see or store your M-Pesa PIN.
• Seller verification (KYC). If you apply to sell, we collect your full legal name, ID type and national ID or passport number, phone number, physical address, and business name if you give one.
• Payout information. The M-Pesa number you ask to be paid on (as a seller or a reseller), your balances, payout requests, and the M-Pesa references of payouts we send.
• Transfers and reselling. When you transfer a ticket we record the recipient’s email address and a scrambled (hashed) copy of the access code, never the code itself. When you list a ticket to resell we record the price and your payout number.
• Event content. Event details and poster images that organizers upload, and cancellation requests and their reasons.
• Activity and entry records. Tickets you hold, queue places and checkout reservations, upgrade, transfer and resell history, and check-in records (when a ticket was scanned and by which staff account).
• Technical data. Your IP address (used to limit abuse, such as repeated guest checkouts or reservations), browser and device type, pages visited, and error reports. See section 8.
• Camera. Door staff using the ticket scanner grant camera access in their browser. The camera feed is read on the device to find QR codes and is not recorded or uploaded.

We use personal data only for the purposes below. The legal basis under the Data Protection Act, 2019 is shown for each.

• To provide the service (performance of our contract with you): creating your account, holding and issuing tickets, running queues, processing payments, transfers, reselling and upgrades, checking tickets at entry, paying sellers and resellers, and emailing you tickets and updates about them.
• To verify sellers and prevent fraud (legitimate interests and legal obligation): checking seller identity, enforcing purchase limits, rate-limiting abuse, protecting QR codes from copying, and investigating suspicious payments.
• To handle refunds and payment problems (contract and legal obligation): matching payments to M-Pesa receipts, refunding failed or cancelled purchases, and reversing seller earnings.
• To keep the Platform working (legitimate interests): monitoring errors and performance, securing the Platform, and improving it.
• To meet our legal obligations (legal obligation): keeping financial and tax records and responding to lawful requests.

The emails we send are about your tickets, payments, transfers, resold tickets, queue places, payouts, and events you’re involved in. We do not send marketing emails. If we ever want to, we will ask for your consent first.

We share personal data only as described here:

• Event organizers. The organizer of an event you buy or reserve tickets for sees the attendee details needed to run it: the holder’s name, email, phone number, ticket type and status, and for paid tickets the amount and M-Pesa receipt. Organizers must use this only for their event.
• Door staff. Staff scanning tickets at an event see the information needed to check a ticket in, such as the holder’s name and ticket type.
• Other users, in transfers and reselling. When you transfer a ticket, the recipient is emailed and told who it is from. Resell listings are shown without the reseller’s contact details.
• Service providers. We use these providers to run the Platform. They process data on our instructions and under appropriate safeguards:
  • Clerk: accounts and sign-in.
  • Convex: our application database and backend.
  • Vercel: website hosting.
  • Safaricom (M-Pesa Daraja): payment prompts, payment confirmation, refunds, and payouts. Your use of M-Pesa is also covered by Safaricom’s own terms and privacy policy.
  • Resend: sending our emails.
  • Cloudflare R2: storing event images.
  • Cloudflare Turnstile: checking that contact-form messages come from a person, not a bot.
  • Sentry: error reporting and performance monitoring.
• Legal and safety. Where the law requires it, to enforce our Terms, or to protect the rights, safety, or property of AfroRow, our users, or the public, including to regulators, the police, or Safaricom in a fraud investigation.
• Business changes. If AfroRow is merged, sold, or restructured, personal data may pass to the new owner, who must keep protecting it as this policy describes.

We do not sell your personal data.

Some of our service providers store or process data outside Kenya, including in the United States and the European Union. When data leaves Kenya we rely on the safeguards the Data Protection Act, 2019 allows, such as the provider’s contractual data protection commitments, and we transfer only what the provider needs.

• Payment, ticket, transaction, refund, and payout records are kept for as long as Kenyan tax and financial record-keeping law requires, and as long as needed to settle disputes.
• Seller verification details are kept while you are a seller and for as long afterwards as needed for legal, tax, and fraud-prevention purposes.
• Account details are kept while your account is open. When you ask us to delete your account, we delete or anonymize what we don’t need to keep for the reasons above.
• Error reports and session recordings are kept by Sentry for a limited period and then deleted automatically.

We use encrypted connections (HTTPS), access controls that limit seller, door staff, and admin access to what each role needs, secret codes in each QR ticket that change when a ticket changes hands, hashed transfer access codes, verified-email checks for claiming tickets, rate limits against abuse, and removal of checkout links and secrets from error reports. No system is perfectly secure; if a breach affects your data, we will notify you and the Office of the Data Protection Commissioner as the law requires.

• Essential cookies. Our sign-in provider uses cookies to keep you signed in and secure. The Platform can’t work without them.
• Preferences. Your browser stores your light or dark theme choice.
• Bot protection. The contact form runs a Cloudflare Turnstile check, which reads signals from your browser and device to tell people from bots. It doesn’t use advertising cookies.
• Error monitoring and session recordings. We use Sentry to find and fix problems. It records technical details when something goes wrong, and for a sample of visits, and for visits where an error happens, a recording of how the page behaved. Recordings mask text you type and on-screen text, and we strip checkout links and other secrets from what is sent. We don’t send your name or email to Sentry.
• We do not use advertising cookies or sell data to advertisers. You can clear cookies and storage in your browser settings, but you will be signed out.

Under the Data Protection Act, 2019 you have the right to:

• be told how your personal data is used;
• access the personal data we hold about you;
• have inaccurate or misleading data corrected;
• have data deleted, where we don’t need to keep it by law;
• object to, or ask us to restrict, certain processing;
• receive your data in a portable format, where this applies; and
• withdraw consent, where we rely on it.

To use any of these rights, email us at contact@afrorow.com from the address on your account or tickets. We may need to confirm your identity, and we will respond within the time the law requires. You can also complain to the Office of the Data Protection Commissioner (odpc.go.ke).

The Platform is not for people under 18, and we don’t knowingly collect their personal data. A parent or guardian may buy a ticket on a child’s behalf where the event allows it. If you believe a child has given us personal data, contact us and we will delete it.

We may update this Privacy Policy. When we do, the “Last updated” date above will change, and we will tell you about significant changes on the Platform or by email.

Questions about this Privacy Policy or your data? Contact us at contact@afrorow.com.