Privacy Policy

Kifurushi is operated by Samuel Kimani Sikuku, an individual based in France, who is the data controller for the purposes of the EU General Data Protection Regulation (GDPR).

Contact for any privacy question or request: hello@kifurushiapp.com. We answer privacy requests within one month, as the GDPR requires.

Verification uses Didit, a specialist identity provider. When you verify, you photograph your ID document and take a short selfie. Didit compares the two, which involves processing biometric data — a special category of personal data under Article 9 of the GDPR.

Three things follow from that, and we want them to be unambiguous:

• It happens only if you ask for it. We rely on your explicit consent, given by the tick box on the verification page. Verifying is optional — you can browse, post and receive parcels without it, though travellers are expected to verify before a first carry and other members may decline to deal with an unverified account.
• Your images never reach Kifurushi. The photographs go from your device to Didit. We receive only the result — approved, declined or under review — the document type, and a session reference. We could not produce your ID photo if we wanted to.
• You can withdraw consent at any time by emailing us. We will delete the verification result and remove your verified badge. Withdrawing does not undo checks already completed.

Didit retains the images it captures under its own retention policy, as an independent processor for this purpose. If you want them deleted at Didit, tell us and we will pass the request on.

Where an automatic check cannot decide — for example when the same face already appears on another verified account — the session is either refused automatically or referred to a person. In every case you can contest the outcome by emailing us and a human will look at it, as Article 22 requires.

Your name, profile photo initials, verified badge, rating, completed delivery count and the listings you publish are visible to other members, and your public profile page is reachable by anyone with the link.

Your email address, phone number and payment details are never shown to other members.

We use a small number of established providers. Each processes your data on our instructions, under its own data processing terms:

• Supabase — database, accounts and file storage (hosted in the EU, Frankfurt).
• Vercel — website hosting and delivery.
• Didit — identity verification (see section 3).
• Stripe — membership payments. Stripe collects your card details directly; we never receive them.
• Resend — sending the emails we owe you (confirmations, match notifications, delivery updates).
• Neo — the mailbox behind hello@kifurushiapp.com, so anything you write to us is stored there.

Some of these are established outside the European Economic Area. Where that is the case, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision.

We do not sell your data, we do not share it with advertisers, and we run no advertising or cross-site tracking on this website.

We use no advertising or analytics cookies, which is why you are not asked to consent to any. The site stores two things in your browser: your sign-in session, so you stay logged in, and your language choice. Both are strictly necessary for the service to work. The session ends when you sign out; the language choice stays until you clear your browser.

• Your account and profile — until you delete it or ask us to.
• Listings, matches and messages — kept while your account exists, because they are the record both parties may need if a delivery is disputed.
• Verification results — kept while your account exists, then deleted with it.
• Payment and invoice records — ten years, which French accounting law requires of us.
• Failure logs — 90 days.

Under the GDPR you may ask us to:

• give you a copy of the data we hold about you;
• correct anything inaccurate;
• delete your account and data;
• restrict or object to a particular use;
• transfer your data to another service in a machine-readable format;
• withdraw a consent you previously gave, such as verification.

Email hello@kifurushiapp.com and we will act within one month. Deleting your account removes your listings and profile; messages exchanged with another member may be retained in that member's record of a delivery, since it is their evidence too.

If you think we have handled your data badly, you can complain to the French data protection authority, the CNIL, or to the authority in your own country. We would rather you told us first.

Kifurushi is for adults. You must be 18 or older to hold an account, and we do not knowingly collect data about children. If you believe a child has an account, tell us and we will remove it.

Access to your data is restricted at the database level so that members can only read what they are entitled to; passwords are hashed by our authentication provider and delivery codes are stored hashed, never in readable form. No system is perfect, and we will tell you and the CNIL without undue delay if a breach puts your rights at risk.

If we change how we use your data we will update this page and change the effective date above. Significant changes will be emailed to members.