Privacy Policy
CheckNuh is based in and built for Jamaica, and handles personal data in line with Jamaica's Data Protection Act, 2020 (the "DPA"). In this policy, CheckNuh is the data controller for your information, and you are the data subject. Section 8 sets out your rights under the DPA and how to use them.
1. Who we are
CheckNuh is a marketplace app connecting customers and businesses, starting in Jamaica. This policy covers everyone who uses the CheckNuh app, our website at checknuh.com, or CheckNuh's public storefront pages: customers, businesses, and visitors who reach a storefront through a QR code without ever creating an account.
CheckNuh decides why and how your personal data is processed, which makes it the data controller under the DPA. You can reach us about anything in this policy at support@checknuh.com.
2. Information we collect
Everyone with an account
- Email and password. Your password is never stored in readable form. We keep a one-way cryptographic hash of it (bcrypt), which can't be turned back into your password, even by us.
- If you sign in with Google, Apple or Yahoo instead: your email address and whether that provider has verified it. Nothing else from your Google, Apple or Yahoo account.
- Your name, if you add one to your profile.
- Country and, if you share it, your approximate location. See Section 6 for exactly what "location" means here.
- Your searches: what you search for, when, and the town or parish it was searched from. If you're signed in, your searches are saved to your account so you can see your search history; you can clear it at any time (Search History → Clear). If you're not signed in, your searches aren't linked to you. We also count searches across everyone, without names or accounts, to show popular searches and to give subscribing businesses reports of what's being searched for in each area. Businesses never see who searched, and we never show a figure made from fewer than five different people's searches.
- Your saved (favourited) listings.
- Messages you send to a business or customer through CheckNuh's in-app chat.
- Reviews and reports: star ratings and comments you leave for a business, and reports you make about a listing or user.
- A push notification token for your device, if you allow notifications, so we can tell you about new messages and account updates.
Businesses, additionally
- Storefront details: business name, profile photo, banner image, opening hours, delivery information, and (optionally) a phone number, TikTok link, Instagram link and a business address. These are shown publicly on your storefront so customers can find and contact you. Phone number, social links and address are your choice.
- Business address and map location (optional): if you tap "Use my current location" at sign-up or in Store Profile, we save your phone's location at that moment as your business's map pin, with an address you can edit. It's shown to signed-in customers on your listings and on your storefront, and opens in Google Maps for directions. Use it from your business premises, not your home, unless you're happy for customers to see that address. You can change or remove it any time in Store Profile, and it's erased when you delete your account.
- Product photos and barcode photos you upload for your listings.
- Photo Studio uploads: product photos you upload ahead of time, on checknuh.com or in the app, so you can turn them into professional photos later. They're stored on CheckNuh's servers against your account, not in your browser. See Section 7 for how long they're kept.
- Listing details: price, condition, category and the town or parish you sell from.
- Subscription and payment status. If you subscribe to a paid plan, we record whether a payment succeeded, the amount, and a reference number from Apple or Google. We never see or store your card number: you enter payment details with Apple or Google, never inside CheckNuh.
Business identity verification
Every business owner must prove they're a real person who owns the business they sell under before they can post. To do that, we collect:
- Your full legal name, as it appears on your ID or business certificate.
- The business name you're confirming you own.
- A photo of a government-issued ID (driver's licence, passport, or national/voter ID), and which type it is, or, only if you can't present ID, a photo of your business registration certificate from the Companies Office of Jamaica.
- A check against the Companies Office of Jamaica: our team looks up the business name you give in the Companies Office of Jamaica's records to confirm it's registered and matches. We use only what those records show about the business.
- The outcome: whether you were approved or not, when, and, if not, the reason we gave you.
How your ID or certificate photo is handled. It's stored in private storage that can't be reached by a link. It's never shown to customers or on your storefront, and it's only viewed by CheckNuh staff reviewing your verification. A person makes the decision; we don't run your ID through facial recognition or any automated identity check.
If you delete your account
- Your answers to a short exit questionnaire: why you're leaving, how long you used CheckNuh, what would have kept you, and any comments. This is used only to improve CheckNuh.
Automatically, from your device
- Standard technical information every app request carries (IP address, timestamp), used only for security and abuse prevention, not kept as a profile of your device.
✓ No analytics in the app✓ No ad tracking✓ No selling your data
The CheckNuh app doesn't run analytics or advertising software that profiles you across apps or websites. We sign you in with a login token, not a tracking cookie.
On our website, checknuh.com
- Signing in: when you sign in on the website, your login token is kept in your browser's local storage so you stay signed in. It's removed when you sign out.
- Analytics, only if you agree: the first time you visit, we ask whether we may use Google Analytics. If you say yes, Google Analytics sets cookies and tells us which pages are visited and how people find the site, with IP addresses shortened. If you say no, or ignore the question, it never loads. You can change your answer any time with "Cookie settings" at the bottom of every page.
- Server logs: our web host records standard request details (IP address, time, page requested) for security and to keep the site running.
- No payments: the website never asks for or receives card or payment details. All purchases happen in the app through Apple or Google.
3. How we use it
- To create and run your account, and let customers and businesses find each other.
- To show you listings near you, and to rank search results.
- To show popular searches, and to give businesses on the Pro plan anonymous reports of what customers are searching for in each area, so they can stock what people want. These reports never identify anyone.
- To confirm every business owner's identity and ownership of their business before they can sell, so customers can trust who they're dealing with.
- To review product photos businesses take themselves before their listing is posted, keeping listings honest and free of prohibited content.
- To generate professional product photos when a business asks for them (this uses a third-party image-processing service, see Section 5).
- To read a barcode from a photo you provide, so we can match your item to the right product.
- To process a subscription when you choose to upgrade a business plan.
- To email you a one-time code when you sign up, a code if you reset your password, a code to confirm it's you before every purchase, and the result of your business verification.
- To send push notifications about new messages and changes to your account or listings.
- To detect fraud, abuse, and breaches of our Terms of Service.
- To answer support requests you send us.
We don't use your data to sell you ads, we don't build an advertising profile of you, and we don't send you marketing.
4. Why we're allowed to use it
The DPA requires personal data to be processed fairly and lawfully, only for specified purposes, and only as much as is needed. We rely on these grounds:
- To provide the service you signed up for: your account, listings, messages, searches, saved items, subscriptions and support.
- Your consent: sharing your location, receiving push notifications, and analytics cookies on our website. You can withdraw either at any time in your device settings, and CheckNuh keeps working without them.
- Our legitimate interests in a safe marketplace: verifying businesses, reviewing photos, preventing fraud and abuse, keeping the service secure, and counting searches anonymously for popular searches and business demand reports, always balanced against your rights.
- Legal obligations: keeping payment records where tax or accounting law requires it, and responding to lawful requests from authorities.
We collect only what each purpose needs. For example, we ask business owners for one photo of one ID, not copies of every document, and we keep your town or parish rather than your exact GPS position.
6. Location data
Sharing your location is optional. If you allow it, your device's GPS coordinates are sent to our server once and matched to the nearest town or parish we have on file. Only that town or parish is stored; your exact coordinates aren't kept. Declining location access doesn't stop you using CheckNuh: you can pick your area from a list instead.
7. How long we keep it
The DPA says personal data mustn't be kept longer than needed. We keep your account information while your account is active. When you delete your account (Section 9), it's deactivated straight away and your personal information is erased 7 days later, including a business owner's ID photo and legal name. These exceptions apply:
- Photo Studio uploads that aren't turned into professional photos are deleted automatically 15 days after you upload them, whether or not you've closed your browser or signed out. Ones you've processed, or used in a listing, are kept with your account.
- Payment records may be kept where tax, accounting or fraud-prevention law requires, for as long as that law requires.
- Messages you sent to another user may stay visible to that person. Deleting your account removes your access to the conversation, not their copy of it.
- A record that a business's verification was approved or rejected, without the ID photo or legal name, so we can deal with fraud if a removed business tries to return.
- Exit questionnaire answers are kept to improve CheckNuh, but once your account is erased they're no longer linked to your email address.
- Searches stay linked to your account, for your search history, for 12 months, or until you clear your history or your account is erased, whichever comes first. After that they're kept only as anonymous counts that can't be traced back to you.
8. Your rights under the DPA
Under Jamaica's Data Protection Act, 2020 you have the right to:
- Know and access what personal data we hold about you, why, and who it's shared with, and get a copy of it.
- Have it corrected if it's inaccurate or incomplete. Most of your details can be changed in the app directly.
- Have it erased, by deleting your account (Section 9) or by asking us.
- Object to processing that is causing, or is likely to cause, you damage or distress.
- Stop direct marketing. We don't send any, but you can tell us never to.
- Not be subject to decisions made purely by automated means that significantly affect you. Business verification and photo review are always decided by a person.
- Withdraw consent to location sharing or notifications at any time in your device settings, and to website analytics with "Cookie settings" on checknuh.com.
- Complain to Jamaica's Information Commissioner (see Section 14).
To use any of these rights, email support@checknuh.com from the address on your account (so we can confirm it's you) and say what you're asking for. We'll respond within 30 days and won't charge you for a reasonable request.
If you live outside Jamaica, your own country's data protection law may give you further rights, for example under the EU or UK GDPR. Contact us and we'll help.
9. Deleting your account
You can delete your account at any time in the app: Settings → Delete account. We ask a few quick questions first; every question has an answer that fits anyone, so the questions never stop you from leaving. You can also use our account deletion page from any browser, with no login needed.
Your account is deactivated immediately and erased 7 days later. If you change your mind within those 7 days, email us.
10. Security & data breaches
Before any purchase, we email a one-time code to the address on your account and the app won't open the payment screen until it's entered, so someone holding your unlocked phone can't buy on your behalf. Your card details stay with Apple or Google; CheckNuh never receives them.
Passwords are hashed, never stored in plain text. All traffic between the app and our servers is encrypted (HTTPS/TLS). Business owners' ID photos are kept in separate private storage, served only through an admin-only route and never cached. Access to production data is limited to the people who need it to run CheckNuh, and admin actions are recorded in an audit log.
No system is perfectly secure. If a breach puts your personal data at risk, we'll notify the Information Commissioner and tell affected users as the DPA requires, including what happened and what we're doing about it.
11. Children's privacy
CheckNuh isn't meant for children: you must be at least 18 to create an account. We don't knowingly collect information from anyone under 18, and if we learn we have, we'll delete it.
12. Transfers outside Jamaica
CheckNuh's database and file storage, where your account data and uploaded files are kept, are hosted in Canada. Our website and app server are run by Hostinger, and other service providers in Section 5 (such as our image-processing, search and email providers) may process data in the United States or other countries. The DPA only allows personal data to leave Jamaica where it will be adequately protected. We meet that by using providers that encrypt data in transit and at rest, limit access to it, and may use it only to provide their service to us. Transfers are also necessary to give you the service you signed up for.
13. Changes to this policy
If we make a significant change to this policy, we'll update the date at the top and tell you in the app before it takes effect.
14. Contact us & complaints
For questions about this policy, your data or your rights: support@checknuh.com.
If you're not happy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the Office of the Information Commissioner, Jamaica's data protection regulator.