Privacy Policy
for customers & businesses

Petrabuy ("Petrabuy", "we", "us", "our") operates a QR-code-based cashback and gifting marketplace connecting customers and businesses across the Democratic Republic of Congo and East Africa. This Privacy Policy describes how we collect, use, store, and share information when you use the Petrabuy mobile application (the "App"), whether you use it as a customer who scans business QR codes to earn gifts and cashback, or as a business that issues QR codes and approves rewards.

By creating an account or using the App, you agree to the collection and use of information as described here. If you do not agree, please do not use Petrabuy.

We collect the minimum data needed to operate scanning, rewards, and payouts safely. What we collect depends on whether you hold a customer or business account.

Account & identity data

• Full name
• Phone number (used for login via phone + PIN, and for withdrawal payouts)
• A securely hashed PIN — we never store your PIN in plain text and cannot view it
• Preferred language (English, French, or Swahili)
• Country and, where applicable, dial code / region
• Profile photo or business logo, if uploaded

Business-specific data

• Business name, category, and physical address
• Business QR code identifier
• Aggregate rating and rating count generated from customer reviews
• Reward-approval configuration and payout history

Transaction & activity data

• QR scan events (time, business, amount, and reward split)
• Wallet activity: direction (in/out), amount, currency, label, and reference type (gift, deposit, withdrawal, transfer)
• Star ratings submitted after a completed reward

Device & technical data

• Device identifiers, operating system, and app version
• Push notification tokens
• Crash logs and diagnostic data

When a customer scans a business's QR code, Petrabuy records the transaction and automatically calculates a reward split across the customer, the platform, and a safe/reserve allocation. This creates a transaction record tied to both the customer's and the business's accounts.

Approximately 90 seconds after a successful scan, customers are asked to rate the business from 0–5 stars. This rating is merged into the business's running average and is visible to other customers browsing that business.

If you operate a business account, customers who scan your QR code will be able to see your business name, category, address, and aggregate rating. You will be able to see aggregated scan volume, reward payout history, and the ratings customers leave — but Petrabuy does not share an individual customer's phone number or full account details with your business unless required to process a specific payout dispute or as required by law.

Business QR codes are unique identifiers generated by Petrabuy and should not be shared outside your business's authorized point-of-sale locations.

Petrabuy uses location services (via Google Maps) to help customers discover nearby participating businesses on the in-app map, and to help businesses confirm their listed address. Location access is requested at the operating-system level and can be granted or revoked at any time through your device settings. Denying location access will not prevent you from scanning QR codes directly, but may limit map-based discovery features.

We do not sell personal data. We share data only in the following circumstances:

• Between customers and businesses, limited to what is necessary to complete and display a scan/reward transaction (e.g., a business sees that a scan occurred and its value; a customer sees the business name and reward amount).
• With service providers who process data on our behalf under contract — see Third-party services below.
• For legal reasons, if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Petrabuy, our users, or the public.
• In a business transfer, such as a merger, acquisition, or sale of assets, where user data may be transferred as part of that transaction, subject to this policy or a comparable one.
• With your consent, for any other purpose we disclose to you at the time of collection.

Petrabuy is built on trusted infrastructure providers who process data strictly to deliver App functionality:

Each provider is bound by its own data-processing terms and applicable data protection safeguards. We periodically review these providers to confirm they meet our security expectations.

Your Petrabuy wallet records every credit and debit — gifts earned, deposits, withdrawals, and transfers — along with the currency and country associated with each entry. Withdrawal requests are only ever sent to the phone number registered on your account; this number is resolved against official country dial-code records and cannot be changed to a third-party number within the withdrawal flow, to protect you from misdirected payouts.

Amounts are recorded as whole numbers in most local currencies; USD-denominated balances in the DRC context may include decimal values consistent with standard currency practice.

Star ratings submitted by customers after a scan are merged into a business's public running average and total rating count. Individual ratings are not displayed with the identity of the customer who submitted them, but Petrabuy retains the underlying record to prevent rating manipulation and to support account-level moderation.

We retain personal data for as long as your account remains active, and for a reasonable period afterward to meet legal, accounting, fraud-prevention, and dispute-resolution obligations. Transaction and wallet records are generally retained longer than account profile data, given their financial nature. When data is no longer needed, we delete or anonymize it in line with our internal retention schedules.

We apply technical and organizational safeguards to protect your data, including:

• PIN hashing — your PIN is never stored or transmitted in plain text
• Access-controlled database policies restricting who can read or modify wallet and transaction records
• Encrypted data in transit between the App and our backend services
• Restricted, auditable access for Petrabuy staff to production data

No system is completely secure. If you suspect unauthorized access to your account, contact us immediately using the details below.

Depending on your location, you may have rights to access, correct, export, or request deletion of your personal data, and to object to or restrict certain processing. To exercise any of these rights:

• Update your name, language, and profile details directly within the App's account settings.
• Request a copy or deletion of your account data by contacting us at the email below.
• Manage location and notification permissions through your device's operating-system settings at any time.

We will respond to verified requests within a reasonable timeframe, and may need to retain certain transaction records where required for financial or legal compliance even after an account deletion request.

Petrabuy operates across multiple countries in the DRC and East Africa region, and our infrastructure providers may process or store data in facilities outside your home country. Where this occurs, we take steps to ensure such transfers are subject to appropriate safeguards consistent with applicable data protection law.

Petrabuy is not directed at children and is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will take steps to delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will update the "Effective date" at the top of this page and, for material changes, provide additional notice in the App or via push notification.

If you have questions about this Privacy Policy or how your data is handled, reach out to us: