Privacy Policy

1. Who runs Karibu

Karibu is a real-estate market-intelligence platform operating across the 54 member states of the African Union. The platform is built and operated by Provecta Group, a company incorporated in the United States. Founder and primary operator: Hassan Qaseem. Operating contact: hassan.qaseem@gc-usa.com (privacy contact: privacy@karibu.africa once domain registered).

Karibu Kenya (the live country tile) operates with locally-engaged agents and data partners; the other 53 country tiles are research-in-progress with email waitlist capture only.

2. The aggregator posture

Karibu does not seek or claim ownership of the data it surfaces. We are an aggregator: we curate publicly-available real-estate data, cross-reference it against multiple sources, and present it with citations. Every figure on the site cites its source — Hass Property Index, KBA-HPI, Knight Frank, KNBS, CBK, NSE filings, county land registries, and the 45+ catalogued public sources we maintain.

Anyone whose data is visible on Karibu — agents, developers, property owners — can claim, correct, or remove their data by registering and going through the Karibu-Verified flow. The aggregator role is permanent; we do not assert ownership over the underlying public data.

3. Verified-data licence (what buyers buy)

When a buyer purchases a Karibu Tier 1, Tier 2, or Tier 3 report, they receive a non-transferable, non-exclusive licence to view and reference the contents. The aggregated dataset, the synthesis methodology, the source citations, the report structure, and the analytic commentary are intellectual property of Karibu / Provecta Group.

• Buyers may read, quote with attribution, and use the report to inform their own real-estate decisions.
• Buyers may not redistribute the report, repackage it as their own product, claim authorship, or reproduce it in commercial materials without written permission.
• Buying a report does not transfer ownership of the underlying data or the synthesised insight.

This licence model preserves Karibu's authority to leverage its dataset commercially and prevents downstream parties from misrepresenting Karibu's research as their own.

4. What data Karibu collects

From the public record

• Real-estate transactions, listings, valuations, and market commentary from the catalogued public sources (full source list at Karibu Index).

From you, when you interact with Karibu

• Registration data: email, name, phone, country, role, organisation
• Lead-form submissions (investor / developer / retail / sponsor)
• Listing claim requests
• bRRAIn questions you ask
• Payment records via Stripe (we never see your card details — they go directly to Stripe under PCI-DSS)

Anonymous telemetry

• One-way hash of your IP (we never store the raw IP), session ID, browser user-agent string
• Cookies: karibu_user (your client session, 30 days) and karibu_admin (admin session, 8 hours) — both HttpOnly and Secure

5. African Union compliance map

Karibu commits to the strictest applicable data-protection standard wherever a user accesses the platform. Our compliance baseline:

• African Union — the AU Convention on Cyber Security and Personal Data Protection (the Malabo Convention, 2014) is our pan-continental policy framework
• Kenya — Data Protection Act 2019 (DPA 2019); Karibu is registering with the Office of the Data Protection Commissioner
• South Africa — POPIA (Protection of Personal Information Act, 2013)
• Nigeria — NDPR + Nigeria Data Protection Act 2023
• Ghana — Data Protection Act 2012 (Act 843)
• Egypt — Personal Data Protection Law 2020 (Law 151)
• Morocco — Law 09-08 on the protection of personal data
• Senegal — Law 2008-12
• Côte d'Ivoire — Law 2013-450
• All other AU member states — Karibu honours the local data-protection regime; where none exists yet, the Malabo Convention standard applies

6. Your rights as a data subject

Across all 54 jurisdictions in which Karibu operates, you have the right to:

• Access the personal data we hold about you
• Correct inaccuracies
• Delete your account and personal data (subject to legitimate-interest retention for fraud / financial-records purposes)
• Port your data to another service in a machine-readable format
• Object to processing for direct marketing
• Withdraw consent at any time, with future effect
• Lodge a complaint with your national data-protection authority

To exercise any of these rights, email privacy@karibu.africa or hassan.qaseem@gc-usa.com. Response SLA: 30 days.

7. Cross-border data transfers

Karibu's infrastructure spans:

• United States — Netlify (CDN + Functions runtime), Stripe (payments), Resend (email), Anthropic (bRRAIn AI inference), Provecta Group (corporate operations)
• European Union — Google Cloud (Calendar API for booking flow)

Cross-border transfers are governed by the Standard Contractual Clauses where applicable, plus each vendor's local certifications (SOC 2, ISO 27001, GDPR adequacy).

8. Data retention

• Active accounts: retained while the account remains active
• Closed accounts: deleted within 30 days of closure, except for financial records (retained 7 years per US tax law)
• Lead submissions: 24 months from submission
• bRRAIn query logs: anonymised after 12 months (retained for product analytics)
• Audit logs: 7 years

9. Children

Karibu is not directed at users under the age of 18. Account creation requires affirmation of majority. If we learn that we have collected data from a minor, we delete it.

10. Changes to this policy

Material changes are announced via email to all registered users at least 30 days before they take effect. The latest version always lives at karibuhome.netlify.app/privacy.html.

11. Contact + complaints

Privacy contact: privacy@karibu.africa · operating contact: hassan.qaseem@gc-usa.com.

If you are dissatisfied with our response, you may complain to:

• Kenya: Office of the Data Protection Commissioner
• South Africa: Information Regulator
• Nigeria: Nigeria Data Protection Commission (NDPC)
• Other AU member states: your national data-protection authority