Privacy Policy

GRUTH is an on-the-ground verification service helping the Kenyan diaspora and remote investors get independent, photo and video evidence on their properties, construction projects, and business interests in Kenya.

Data controller: GRUTH, operating at gruth.co.ke. For any privacy-related questions, contact us at hello@gruth.ke with subject line “Privacy Request”.

We use the data we collect for the following purposes:

• To create and manage your account
• To process, schedule, and deliver verification reports
• To communicate with you about your projects and requests
• To send transactional emails (e.g. report ready, payment confirmation, status updates)
• To improve our platform and inspector network quality
• To prevent fraud and maintain platform security
• To comply with applicable Kenyan and international laws

Your data is stored on servers hosted in secure, EU-located data centres. We use TLS/HTTPS for all data in transit and encryption at rest for sensitive fields. Access to production data is restricted to authorised personnel only, under strict least-privilege controls.

Inspection photos and videos are stored via Cloudinary using industry-standard cloud storage. Access controls ensure only you and our authorised team can view your project evidence.

While we take all reasonable precautions, no system is completely immune to security incidents. If a breach affecting your personal data occurs, we will notify you within 72 hours of becoming aware of it, in line with applicable data protection law.

We retain your account and project data for as long as your account is active or as needed to provide our services. If you close your account, we will delete or anonymise your personal data within 90 days, except where we are legally required to retain records — for example, financial transaction records which we keep for 7 years under Kenyan tax law.

Depending on where you are located, you may have the following rights regarding your personal data:

• —Access — request a copy of the personal data we hold about you
• —Correction — ask us to correct inaccurate or incomplete data
• —Deletion — request erasure of your personal data ('right to be forgotten')
• —Restriction — ask us to restrict certain processing activities
• —Portability — receive your data in a structured, machine-readable format
• —Objection — object to processing based on legitimate interests
• —Withdraw consent — at any time where processing is consent-based (e.g. analytics cookies)

To exercise any of these rights, email hello@gruth.ke with subject line “Privacy Request”. We will respond within 30 days.

We use cookies in three categories. You can manage your preferences at any time via the Cookie Preferences link in the site footer.

We use GA4 Consent Mode v2. No analytics or advertising data is collected until you grant permission. Functional UI state (theme preference, PWA banner) is stored in localStorage only — never transmitted to any server.

We integrate with the following third-party services to operate the platform. Each is bound by their own privacy policy and applicable data protection laws.

Our services are not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact hello@gruth.ke and we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we'll update the “Last updated” date at the top of this page. For significant changes, we'll notify you by email or via an in-app banner. Your continued use of GRUTH after changes constitutes acceptance of the updated policy.