What we collect
- Account data — name, email, password (stored as a hash), and sign-in activity (IP address, device/browser info, session records).
- Listing data — photos, descriptions, price, location (parish and community), and private verification evidence: battery health, device info, activation-lock and network-status screenshots, and the device IMEI.
- Transaction data — offers, orders, payment status (not card numbers — see below), delivery records including collection checks and handoff photos, disputes and their evidence.
- Messages — conversations between buyers and sellers, which are screened automatically for scams and prohibited content.
What we deliberately don't hold
- Card details. Card payments are processed by our payment partner (Handypay); full card numbers never touch buyphonesja systems.
- Identity documents.Seller ID verification runs inside Didit's secure environment. We store only the outcome and a session reference — never the document or selfie. See identity verification.
How we use data
- Running the marketplace: listings, search, offers, orders, delivery, payouts.
- Trust and safety: fraud prevention, content moderation, stolen-device checks (IMEIs are stored encrypted with access logged), disputes, and enforcing our terms.
- Communications: transactional emails for account security, messages and questions, and each delivery step. Marketing is opt-in and separate.
- Improving the product with aggregate usage analytics.
Who processes it
Infrastructure and security run on Cloudflare (hosting, database, content checks). Payments are processed by Handypay. Identity verification is processed by Didit. Delivery partners receive only what a job needs: names, the delivery area, the listing being checked, and contact for coordination — never your payment details.
Retention
Account data is kept while your account is active. Transaction and dispute records are retained after completion because they are the evidence both sides rely on, and to meet legal obligations. Data that is no longer needed is deleted or anonymised.
Your rights
Under the Jamaica Data Protection Act, 2020, you can request access to your personal data, correction of inaccurate data, and deletion where we no longer have a lawful basis to keep it; you can also object to certain processing and withdraw consents. Contact us through the help centre and we will respond within the timeframes the Act requires. You may complain to the Office of the Information Commissioner if you believe your data has been mishandled.
Security
Data in transit is encrypted, access to sensitive records (like IMEIs) is restricted and logged, passwords are hashed, and every system access rule is enforced server-side. No system is perfectly secure — if a breach affects you, we will notify you and the regulator as the Act requires.
Changes
Material changes to this policy are announced in the app and dated at the top of this page.
