Privacy policy

What Gariboss collects about car owners and their drivers, why we need it, who else sees it, and what you can ask us to do with it. Written in plain words, under the Kenya Data Protection Act, 2019.

Last updated 3 November 2026 · Privacy · Terms

Who we are

Gariboss keeps the books for people who own cars that drivers work with, mostly on Uber, Bolt and Little: each car's daily payments and targets, its drivers, expenses and papers, with reminders and reports by WhatsApp.

Gariboss does not track cars. It collects no GPS or location from cars, drivers or phones, does not connect to vehicle trackers, and cannot switch a car off. Tracking, where an owner uses it, is done by their own CA-licensed tracker company.

Gariboss is run by Buniverse Limited, a private limited company registered in Kenya (company number PVT-BB16Y5Z7), P.O. Box 1733-00900, Kiambu. Buniverse also runs duka.bio.
Email: support@gariboss.com
WhatsApp or call: 0101 054 001

Owners and drivers: who decides what

Car owners are our customers. For an owner's own account, Gariboss decides how the data is used (we are the data controller).

Drivers are added by the owner of the car they drive. The owner decides which driver details to keep and why, and Gariboss stores and uses them on the owner's behalf (for driver data, the owner is the data controller and we are the data processor). A driver can ask their owner or us about their data; we will help either way.

What we collect

About car owners

Name, phone number, email address and business name.
Your sign-in account (by Google or by email), held by our sign-in provider, Clerk.
Where your money goes: the M-Pesa number, till, paybill or bank account you choose, and the name on it as the payment company confirms it.
If you pay your Gariboss bill by card: only the last 4 digits, the card type and the expiry date. The card number itself is kept by Paystack, never by us.
If you connect your own M-Pesa till: its number and the API keys you give us. We store the keys encrypted.
Your cars: registration, make, model, papers (insurance, inspection and their dates and costs), service records, expenses with any receipt photos, and accidents.
Your settings, such as working days, daily amounts, reminder times and the hour of your morning report.
Your Gariboss bills and how you paid them, and any referral code you used or shared.

About drivers

Name, phone number, and the M-Pesa number they pay from if it is different.
ID number and photo, if the owner adds them.
Which car they drive, from when, and the daily amount agreed with the owner.
Every payment: amount, date and time, the M-Pesa reference, the phone number that paid, and whether it went through.
Days off and garage days they ask for, and the owner's answer.
Odometer readings (the mileage they type in), expenses, repairs and accidents they report.
If they join the app: their sign-in account, and a notification token if they turn on phone notifications.
When they stop driving the car: the date, and the reason the owner gives.

Messages

We keep a copy of the WhatsApp messages Gariboss sends (reminders, reports, alerts) and of replies sent to Gariboss, such as "PAID 1500" or an answer to a question we asked. That way both sides can see what was said and when.

When you visit gariboss.com

Google Analytics counts visits and the pages people open, so we can see how owners find us. It uses cookies and sees your IP address and browser.
When something breaks, an error report goes to Sentry. It can include the page, your browser and your account ID.
Sign-in uses cookies to keep you signed in.

Why we use it

To run the service you signed up for: record what each car owes and what was paid, send reminders, send the owner's report, and take M-Pesa payments.
For the owner's business: an owner has a real interest in knowing which driver has their car and what has been paid. Driver data is used for that and nothing else.
To bill owners for Gariboss.
Because the law requires it: payment and billing records are kept for tax and for disputes.
To keep Gariboss working and safe: error reports, stopping misuse and fixing problems.

We do not sell personal data, and we do not use it for advertising. A driver's payment record is shown to the owner of the car they drive, never to other owners.

Who else sees it

Only the companies we need to run Gariboss, and only what each one needs:

Paystack: takes drivers' M-Pesa payments, pays owners out, and charges owners' cards.
Safaricom (M-Pesa): sends the payment prompt to the driver's phone.
WhatsApp (Meta): carries the messages we send and receive.
Clerk: sign-in accounts.
Google Analytics and Sentry: visit counts and error reports.
Hetzner: the servers where Gariboss and its database run.

We also share data when the law requires it, for example a court order, or a request from the Data Commissioner or the Kenya Revenue Authority.

Where it is kept

Our servers are run by Hetzner in the European Union. Clerk, Google and Sentry are based in the United States and the European Union. Under the Data Protection Act we send data outside Kenya only to companies that protect it to the standard Kenyan law expects, and only what is needed for the service.

How long we keep it

An owner's account and their cars' records: for as long as the account is open.
Payments, Gariboss bills and the ledger behind them: at least 5 years, because Kenyan tax law requires business records to be kept that long. They are also how a payment dispute gets settled.
A driver who leaves a car: their payment history stays with that car's records, because the owner needs it. Their contact details and ID number can be deleted on request.
Sign-in codes sent by WhatsApp expire within minutes and are stored only in scrambled form.

If an owner closes their account, we delete their data on request, except the records the law makes us keep.

How we protect it

Every connection to Gariboss is encrypted (HTTPS).
We never see or store passwords: sign-in is handled by Clerk.
M-Pesa till API keys are stored encrypted. Sign-in codes are stored only in scrambled form.
Owners see only their own cars and drivers. A driver sees only their own car and payments.

If personal data is ever exposed, we will tell the Data Commissioner within 72 hours, as the law requires, and tell the people affected.

Your rights

Under the Data Protection Act, 2019, you can ask us to:

tell you what data we hold about you, and give you a copy;
correct anything that is wrong;
delete data we no longer need (except records the law makes us keep);
stop using your data for something you object to;
give your data to you in a form you can take to another service.

Send the request by email or WhatsApp (details above). We may ask you to prove who you are first, so nobody gets someone else's data. A driver can also ask the owner of their car.

If you are not happy with how we handled your data, you can complain to the Office of the Data Protection Commissioner: www.odpc.go.ke.

Children

Gariboss is for car owners and licensed drivers. It is not meant for anyone under 18.

Changes

When this policy changes, we update the date at the top. If a change matters to how your data is used, we will tell owners by WhatsApp or email before it applies.