ShambaBoy Privacy Policy

3.1 Information from Workers

3.2 Information from Farm Owners and Supervisors

• Name, contact details, farm location, farm size, crop types
• Operational data (task assignments, inventory, schedules)
• Payment information (for subscription billing)
• Comments and notes about workers and farm operations

3.3 Information from Diaspora Users

• Login credentials (email, password)
• Location of access (to comply with cross-border data transfer laws)
• Relationship to farm (owner, investor, family member, estate administrators)

4.1 To Provide Our Core Services

• Task verification: Recording and verifying farm activities through photos, GPS, and timestamps
• Worker identity profiles: Building portable work histories that workers can take to other farms
• Farm management: Helping farm owners track operations, assign tasks, and manage workers
• Compliance records: Creating audit trails for export standards (for example, GLOBALG.A.P), financial institutions, and government requirements

4.2 To Prevent Fraud and Ensure Platform Integrity

• Detecting false task submissions
• Identifying unusual patterns or activities that may indicate fraud
• Preventing account sharing
• Verifying worker identity

4.3 To Share with Institutional Partners

With your written consent, ShambaBoy may share verified data with:

• The worker's supervisor and farm owner: Enhances monitoring and evaluation, work records, task submissions, and performance data
• Potential employers: When a worker applies for jobs at other farms
• Banks and microfinance institutions: For credit assessment and agricultural lending
• Insurance companies: For agricultural insurance verification
• Export buyers: For compliance certification and verification
• Government agencies: When required by law (court orders, legal processes, requests from government authorities, or investigations by regulatory bodies)
• Carbon and climate partners: For agricultural carbon credit verification (for example, Consuming Carbon)
• Service providers: Cloud hosting providers (data stored in Kenya), SMS and email service providers (notifications), payment processors (subscription billing), and security and fraud prevention services

4.4 To Improve Our Services

• Analysing usage patterns (anonymised)
• Identifying best practices across farms
• Improving fraud detection models
• Enhancing user experience

4.5 To Improve Communication

• Sending task notifications and reminders
• Providing customer support
• Notifying you of important changes to our services
• Sending security alerts (unusual account activity)

Under Kenyan law, all service providers are contractually required to protect your data and use it only for specified purposes.

6.1 Your Data Stays in Kenya

• All personal data is stored on servers physically located in Kenya
• When you access your dashboard, you are viewing data through an encrypted connection
• Data is not downloaded or stored on your device

6.2 Legal Protections for Cross-Border (Diaspora) Access

We use Standard Contractual Clauses approved by data protection authorities to ensure your data remains protected when accessed from: the European Union (EU), the United Kingdom (UK), the United States of America (USA), Canada, Australia, and other approved jurisdictions.

6.3 Diaspora User Responsibilities

• Use only ShambaBoy's encrypted connections (do not screenshot or download personal data)
• Access only from secure devices (not public or shared computers)
• Comply with Kenyan data protection laws

7.1 What AI Does

• Fraud detection: AI flags potentially fraudulent task submissions for human supervisor review
• Image verification: AI checks if photos are authentic (not reused or manipulated)
• Pattern recognition: AI detects unusual patterns that may need investigation

7.2 What AI Does Not Do

AI does not make final decisions about employment, compensation, or your legal rights and obligations. All important decisions are made by human supervisors and farm owners.

7.3 User Rights Regarding AI

• Right to know if AI flags your submission
• Right to request human review of any AI flag
• Right to explanation in simple language for AI flags
• Right to challenge: Provide evidence if you believe AI made a mistake
• Right to opt-out: You can choose manual review (may take longer)

8.1 Right to Access

• In-app: Tap "My Profile" or "My Data"
• Download: Use "Export My Data" button
• Request: Email support@shambaboy.com
• SMS: Text "ACCESS" to +254-722575426

Response time: Within 48 hours electronically; 7 days for written requests.

8.2 Right to Data Portability

• Export complete work history in JSON, CSV, or PDF
• Transfer profiles to competing platforms
• Share credentials with potential employers
• Export as many times as needed (free, unlimited)

8.3 Right to Rectification

• In-app: Tap "Report Error" next to any data field
• Email: support@shambaboy.com with details

ShambaBoy will correct factual errors within 48 hours.

8.4 Right to Erasure (Deletion)

• Marketing data is deleted immediately upon request
• Core profile data is retained for 7 years to comply with the Kenya Employment Act and tax laws
• After the retention period: Personal identifiers are removed and records are anonymised

8.5 Right to Object

• Marketing communications (unsubscribe anytime)
• Data sharing with specific institutional partners
• AI processing of submissions (opt for manual review)

8.6 Right to Withdraw Consent

• Biometric data processing
• Data sharing with institutional partners
• Marketing communications

Withdrawing consent may affect a user's ability to use certain features.

8.7 Right to Lodge a Complaint

• Contact the ShambaBoy Data Protection Officer: support@shambaboy.com
• File a complaint with Kenya's Office of the Data Protection Commissioner (ODPC)
• Email: datacommissioner@odpc.go.ke
• Website: www.odpc.go.ke
• Phone: +254-20-2675580