Skip to content
Deliver to Kampala Account Sign In

Legal

Privacy Policy

Last updated 12 November 2026

1. Who we are

This policy explains how Beyi poa (“we”, “us”) handles personal information when you use the Beyi poa website, the Beyi poa app on Google Play or the Apple App Store, and the related ordering and delivery service in Kampala, Uganda.

Beyi poa is the data controller for the information described here. Stringfy Labs builds and hosts the service for Beyi poa and processes that information only so the service can run. For privacy requests, use the contact details in section 12.

2. The information we collect

We collect only what we need to create an account, take an order, deliver it, and keep the service secure.

Account. Your name, Ugandan phone number, and, if you choose email, Google, or Apple sign-in, your email address. For a phone account we store a one-way hash of your password, not the password itself. A one-time SMS code is used to prove the SIM when you create the account and when you reset the password. We store that code only as a hash, and it expires after 10 minutes.

Orders and delivery. The items you order, prices in Uganda shillings, delivery area, street, building, landmark, delivery instructions, the name and phone number of the person receiving the order, the delivery slot, and any map coordinates you choose to give us for that address. We do not collect your location in the background.

Payment. If you pay with MTN Mobile Money or Airtel Money, we send the mobile-money number and the amount to our payment provider so it can show you the approval prompt. We never receive or store your Mobile Money PIN. We keep the payment result (paid, failed, or refunded) with the order.

Device and security. If you allow notifications, we may store a device token so we can send order updates. When we send a verification SMS we record the IP address and the time, so we can limit repeated requests. We also keep ordinary server logs needed to run and protect the service.

What we do not collect. We do not buy personal information, and we do not collect contacts, health information, or an advertising identifier. A profile photo is stored only if you choose to upload one. We do not track you across other companies’ apps or websites for advertising.

3. How we use it

  • To create and protect your account, including the one SMS that proves your phone number.
  • To show prices, take payment, pick the order, and deliver it to the address you gave us.
  • To send order updates by SMS or notification where you have allowed that.
  • To prevent fraud, limit abuse of verification codes, and fix faults.
  • To keep records we are required to keep under Uganda tax and accounting law.
  • To tell you about a change to this policy or to the service.

We do not use your information to sell advertising, and we do not sell personal information.

4. Why we are allowed to use it

Under the Data Protection and Privacy Act, 2019 of Uganda, we rely on one or more of these grounds:

  • Contract. We need the information to open your account and to deliver the order you asked for.
  • Consent. You agree to this policy when you create an account. You can refuse optional notifications, and you can withdraw consent for optional messages.
  • Legal obligation. We keep certain order and payment records because the law requires it.
  • Legitimate interest. We use limited security logs to protect customers, riders, and the service, where that interest is not overridden by your rights.

5. Who we share it with

We share personal information only with people and companies who need it to perform the service:

  • Google Firebase (Google LLC) handles sign-in, including Google, email, and Apple sign-in, and the session that follows a phone sign-in.
  • MarzSMS, operated by WeAreMarz, sends the verification SMS. It receives the phone number and the message.
  • MarzPay, operated by WeAreMarz, sends the Mobile Money prompt. It receives the phone number, the amount, and the payment reference. It does not receive your PIN.
  • Shoppers and riders who fulfil the order receive the recipient’s name, phone number, delivery address, and the items to deliver.
  • Our hosting provider stores the service and its database so the website and apps can run.

We may also disclose information if a court or a competent authority in Uganda lawfully requires it, or if we must do so to protect a person’s safety or to investigate fraud.

Some of these providers process information outside Uganda. Where that happens, we require them to protect the information and we share only what the task needs.

6. How long we keep it

  • Account details are kept while the account is open.
  • A verification code expires after 10 minutes and cannot be used after that.
  • Order and payment records are kept for as long as Uganda tax law requires us to keep financial records, commonly at least five years, and then deleted or stripped of details that identify you.
  • Security logs are kept for a limited period and then deleted.

7. How we protect it

The website and apps talk to our servers over encrypted connections. Passwords and verification codes are stored as hashes. Staff can see an order only when their role requires it. No method of storage or transmission is perfectly secure, and we will tell you if a breach creates a real risk to you, as the law requires.

8. Your rights

You may ask us to:

  • confirm whether we hold information about you, and for a copy of it;
  • correct information that is wrong or incomplete;
  • delete your account, or restrict how we use the information, where the law allows;
  • stop optional marketing or SMS messages;
  • object to processing based on legitimate interest.

To use these rights, contact us with the phone number on the account. We may ask you to confirm that you are the account holder before we act.

9. Deleting your account

You can ask us to delete your account at any time by contacting us. Where the app or the website shows a delete control, you can use that as well. We will deactivate the account so it can no longer be used to sign in, and we will switch off its notification tokens. We then delete or anonymise personal information we no longer need to keep.

We keep an order or payment record for the period in section 6 where the law requires that record. Deleting the account does not by itself cancel an order that is already out for delivery, and it does not erase a charge that was validly made.

10. Children

Beyi poa is a grocery service for adults. You must be at least 18 years old to create an account or to pay for an order. The service is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will delete it.

11. Cookies and on-device storage

Sign-in and the shopping cart use cookies or storage on your device. We do not use advertising cookies. The details are in the Cookie Policy.

12. How to contact us and how to complain

Beyi poa, Plot 12, Kampala Road, Kampala, Uganda. Phone: +256 700 123 456. Use the same phone number shown in the app and on the website.

If you are not satisfied with our reply, you may complain to the Personal Data Protection Office under the Data Protection and Privacy Act, 2019.

Orders are also governed by our Terms of Service.

13. Changes

If we change this policy, we will post the new version on this page and change the date above. If a change materially affects how we use your information, we will also tell signed-in customers in the app or by SMS before the change takes effect. The version on this page is the one that applies.