Privacy Policy

This Privacy Policy explains how Bright River Marketing ("BRM", "we", "us"), a Zimbabwean company based in Harare, collects, uses, shares and protects personal information when you use the KuraNhaka platform — including the KuraNhaka mobile application for Android and iOS, this website, and related services. KuraNhaka is developed and operated by BRM together with its technology partner, Kalekt.

We handle personal information in line with Zimbabwe's Cyber and Data Protection Act [Chapter 12:07] and, where applicable, the data protection laws of other jurisdictions in which our users are located.

1. Information we collect

Through this website

• Beta programme requests: your name, email address, preferred platform (Android and/or iOS), and any notes you provide.
• Contact form messages: your name, organisation, email address, area of interest, and your message.
• Technical details: when you submit a form, our servers also record your IP address, browser user-agent and the page origin, which we use for security and anti-spam purposes.

Through the KuraNhaka mobile app

• Account information: your mobile phone number (verified by one-time SMS code) and a password. On Android, the app may offer your device's phone number for convenience through a system prompt; nothing is read without your selection.
• Identity (KYC) information: first, middle and last name; sex; date of birth; country; national ID number; a photograph of your ID document; and an optional email address. At input collection points and grain depots, an agent may photograph your ID document to verify voucher redemptions and deliveries.
• Farm and field information: farm names and addresses, ward and land-use details, field sizes and crops, planting and harvest dates, field activity records, yields and deliveries, and photographs of fields that you or authorised field officers capture.
• Location information: precise GPS coordinates used to map your farm and field boundaries (captured while you walk or trace the boundary) and to show your position on the map. Approximate location is also used to fetch localised weather information. Location is collected only while you use these features, with your device-level permission.
• Device information: a push-notification token, your device model and platform (Android or iOS), used to deliver notifications and keep your account secure.
• Programme and scoring information: your training progress, input and loan applications, vouchers, deliveries, and your Nhaka Index — a score generated from your profile completeness and farming activity on the platform (see section 4).

The app does not access your contacts, and we do not use third-party advertising trackers or analytics SDKs in the app or on this website.

2. How we use your information

• To create and secure your account, and to verify your identity as part of farmer registration and field verification.
• To provide the platform's core features: farm and field mapping, activity records, training, advisory and weather information, input access, vouchers, deliveries and market linkage.
• To calculate your Nhaka Index and assess readiness for finance and input programmes.
• To send you service messages by SMS, WhatsApp or push notification (for example one-time codes, application updates and delivery confirmations).
• To respond to beta programme requests and enquiries submitted through this website.
• To prevent spam, fraud and abuse, and to comply with legal obligations.

3. Who we share information with

KuraNhaka is an ecosystem platform. Depending on the programmes you participate in, relevant parts of your information are shared with:

• Ecosystem participants: microfinance institutions and financiers (when you apply for inputs or finance), input distributors and depot agents (to issue and redeem vouchers), aggregators and their depots (to record grain deliveries), and accredited extension officers (to verify your identity, farm and fields). These parties see only the information needed for their role.
• Service providers (processors): we use trusted providers to run the platform — cloud database hosting (DigitalOcean), content delivery and file storage (Cloudflare), SMS and WhatsApp messaging (Twilio), push notifications (Google Firebase), map imagery (Google Maps, MapTiler, OpenStreetMap), and satellite crop-intelligence services (Aspia Space, which receives farm and field boundary geometry to provide field monitoring and weather data). This website also loads fonts, styles and icons from content delivery networks (Google Fonts, Tailwind CDN, Iconify), which receive standard technical data such as your IP address when the page loads.
• Legal and safety: authorities or other parties where required by law, or to protect the rights, safety and property of our users, partners or BRM.

We do not sell your personal information. Some of the service providers above process data outside Zimbabwe; where that happens, we take reasonable steps to ensure your information receives an adequate level of protection.

4. The Nhaka Index (automated scoring)

The Nhaka Index is a score generated automatically from information on the platform — such as completing your profile, verifying your identity, mapping your farm and fields, finishing training, and your recorded farming activity. Finance and input partners may use your score, together with other information, to decide whether you qualify for their products. If an application is declined, you may contact us or the relevant partner to ask about the decision and have it reviewed by a person.

5. How long we keep information

• Account and KYC information is kept while your account is active.
• Farm, field and programme records (including boundary history) are kept for the life of the platform to preserve the integrity of verification, scoring and delivery records.
• Website form submissions are kept for as long as needed to respond and administer the beta programme.

6. Deleting your account

You can delete your account at any time from the app's profile settings (confirmation with your password is required). Step-by-step instructions are on our Delete Account page. When you delete your account:

• Your name, national ID record, ID document photo, phone numbers, email, password and push tokens are deleted or removed from your profile immediately — there is no waiting period.
• Farm, field and programme records are retained but permanently de-linked from your identity (attributed to an anonymised "Deleted User") and cannot be re-attached later.
• If you register again with the same phone number, you start with a new account, with no previous score or history.
• Deletion may be temporarily blocked while you have an active obligation on the platform, such as an application under review, an active contract or an unconfirmed delivery.

7. How we protect information

• Data is transmitted over encrypted connections (HTTPS/TLS), and our database connections are encrypted.
• Passwords are stored only as salted hashes; they are never stored in plain text.
• On your device, session tokens and profile details are kept in the platform's secure storage (Android encrypted preferences / iOS Keychain).
• Access to administrative systems is restricted to authorised personnel.

No system is perfectly secure, but we work continuously to improve our safeguards. If we become aware of a data breach that affects you, we will notify you and the relevant authority as required by law.

8. Your rights

Subject to applicable law, you have the right to access the personal information we hold about you, to have inaccurate information corrected, to object to certain processing, and to request deletion of your information. You can exercise most of these directly in the app (editing your profile, deleting your account), or by contacting us using the details below. You also have the right to lodge a complaint with the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), Zimbabwe's data protection authority.

9. Children

KuraNhaka is not intended for children under the age of 12. The app does not allow a profile to be created for anyone under 12, and instead directs younger users to involve a parent or guardian. If you believe a child's information has been provided to us, please contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date above and, for significant changes, notify you in the app or on this website. Continued use of the platform after a change takes effect means you accept the updated policy.

11. Contact us

Bright River Marketing
Harare, Zimbabwe
Email: partnerships@brightrivermarketing.com