How Triplona handles your data

This Privacy Policy describes how Triplona International Limited ("Triplona", "we") handles personal data of everyone who uses the Triplona marketplace — travellers, providers across our eight service categories (stays & hotels, rides & transport, dining, hire & services, media & photography, experiences, events, and Travel Agents), and visitors to our public pages. It is part of, and should be read together with, our Terms & Conditions.

We only collect what we need to run the marketplace safely:

• Account data — name, email, phone, password hash, chosen roles.
• Verification data — government ID reference, business registration and tax details, and any documents you upload to support verification.
• Booking confirmation data — the genuine name, contact details and, where the service category requires it, the identification or passport number you enter when confirming a booking, together with the agreed dates, amount and notes. These details are shared with the other party to that booking and with authorised Triplona support and compliance staff only; identification numbers are stored privately and are never shown publicly.
• Listing & content data — photos, descriptions, prices, availability, reviews and chat messages you send on the platform.
• Usage & device data — pages viewed, approximate country (from IP), device type and basic diagnostics.
• Subscription payment data — the fact of payment, the plan purchased and the reference from our payment partner. Triplona does not store card numbers, and Triplona does not receive or hold any money a customer pays a provider for a booking — that money never touches the platform.

• To create and secure your account and verify your identity.
• To publish listings, run search and discovery, and let travellers contact providers.
• To keep the community safe — moderation, fraud and abuse detection, and cooperating with lawful requests from authorities.
• To send account, transactional and (where you have opted in) marketing emails, and to remind you about pending subscription renewals.
• To improve the product and understand aggregate usage.

We share personal data only when necessary and only with:

• Other members you interact with — a provider sees the name and messages of the customer contacting them, and vice versa. Verification documents are never shared with other members.
• Service providers we rely on to run the platform (hosting, email delivery, error monitoring, AI features) under written processing agreements.
• Payment method providers — the bank, mobile-money or card provider you use to pay your provider subscription or boost. Triplona does not store card details.
• Authorities where we are required by law, court order, or in response to a lawful request from regulators such as the Financial Reporting Centre or the Kenya Revenue Authority.

We do not sell personal data.

We use a small number of first-party cookies for sign-in, session security and preference storage, and privacy-respecting analytics that record page views without individual tracking. You can clear cookies or block them in your browser; some features (like staying signed in) will stop working if you do.

Triplona is a global marketplace. Personal data collected through triplona.com is transferred outside Kenya and stored and processed by the following categories of providers:

• Database, authentication, file storage and automated backups — managed Postgres and object storage hosted on Amazon Web Services in Frankfurt, Germany (EU, eu-central-1). This is where accounts, listings, messages, verification documents, chat photos, job CVs and audit logs live at rest.
• Application runtime, edge network and CDN — served from Cloudflare's global edge (including a Nairobi point of presence). Requests transit the nearest edge but no personal data is stored on the edge itself.
• Transactional and auth email delivery — routed through Lovable's email infrastructure (EU / United States). Recipient addresses and email bodies are processed in transit.
• AI features (document scanning, moderation, drafting, translation) — Google Gemini models called through the Lovable AI Gateway, processed in Google data centres in the EU / United States. Documents and text are sent only at the moment you use the feature and are not used to train the models.
• Maps & geocoding — Google Maps APIs, global infrastructure.
• Provider subscription payments — processed by Kenyan bank and mobile-money providers; no card data is stored by Triplona.

Where transfers leave Kenya, we rely on recognised safeguards (standard contractual clauses and the EU adequacy framework) and only work with processors who commit to comparable data-protection standards. This notice is filed with the Office of the Data Protection Commissioner (Kenya) and mirrored in §8 of our Data Protection Compliance Pack.

We keep account data for as long as your account is active. If you delete your account, most personal data is removed within 30 days, except records we must keep to comply with law (for example tax and anti-fraud records for the period required by the Kenya Revenue Authority and equivalent authorities in your country), to resolve disputes, or to enforce our Terms.

You can, at any time and free of charge:

• Access the personal data we hold about you.
• Correct anything that is wrong from your account settings.
• Request deletion of your account and associated personal data.
• Object to or restrict certain uses, and withdraw marketing consent.
• Export a copy of your data.

To exercise any of these rights, email hello@triplona.com. You may also complain to your local data-protection authority — for members in Kenya, that is the Office of the Data Protection Commissioner.

Questions about this policy or a data request? Write to Triplona International Limited, hello@triplona.com. We aim to respond within 30 days.

All Triplona email — account, verification, subscription, activity and support notices — is sent from hello@triplona.com, and every request or notice you send us should go to the same address. If a message about Triplona arrives from any other address, treat it as suspicious and report it to us.