Privacy Policy

1. Who we are

Poetria is an event-staffing marketplace operated by Poetria Company Limited, a company based at KK 4 Avenue, Kigali, Rwanda (“Poetria”, “we”, “us”, “our”). Customers use Poetria to book vetted event professionals — bartenders, servers, chefs, hosts, security, photographers, DJs, cleaners and similar roles (“crew”) — through our website and mobile app (together, the “Service”).

Poetria Company Limited, KK 4 Avenue, Kigali, Rwanda, is the data controller for personal data processed through the Service. We process personal data in accordance with Rwanda's Law No. 058/2021 of 13 October 2021 relating to the protection of personal data and privacy (the “Data Protection Law”), and we follow internationally recognised best practice, including principles drawn from the EU General Data Protection Regulation (GDPR).

You can reach us about anything in this policy at team.poetria@gmail.com or +250 789 549 977.

2. Personal data we collect

We collect the following categories of personal data:

• Account details: your name, email address, phone number, city and the account type you choose (customer, crew or admin-managed account).
• Crew work profiles: for crew members, the professional profile you build and publish — photos, bio, roles and skills, languages, hourly rates, experience, service areas and availability calendar.
• Identity-verification documents: for crew vetting, we collect government-issued ID documents and related verification information. These are used solely for verification and safety and are never displayed publicly.
• Booking and event details: event dates, times, venue addresses, event type, crew requirements, special instructions, booking history, confirmed hours and check-in/check-out records.
• Payment and invoice records: amounts charged, service fees, payout records, invoice details and payment status. Payment card and mobile-money credentials are handled by our payment providers; we do not store card numbers, PINs or mobile-money PINs.
• Device and notification data: device push-notification tokens (via Google Firebase Cloud Messaging) so we can deliver booking offers, confirmations and reminders to your device, plus basic device and app-version information.
• Communications: emails we send you (delivered through Resend) and records of messages and support requests exchanged through the Service.
• Usage logs, cookies and local storage: server logs (such as IP address, timestamps and pages or endpoints accessed) and cookies or browser local storage used to keep you signed in, remember preferences and protect the Service. We do not use third-party advertising cookies.

3. Lawful bases for processing

We only process personal data where the Data Protection Law allows it. Depending on the activity, we rely on:

• Performance of a contract: most processing — creating accounts, publishing crew profiles, matching, managing bookings, processing payments and issuing invoices — is necessary to provide the Service you have signed up for.
• Legal obligation: we keep certain records (for example tax, accounting and payment records) because the law requires it, and we disclose data to authorities where legally compelled.
• Legitimate interests: we process limited data to secure the platform, prevent fraud and abuse, enforce our Terms of Service and improve the Service, always balanced against your rights.
• Consent: where the law requires it — for example marketing messages or optional features — we ask for your consent first, and you can withdraw it at any time.

4. How we use your data

We use personal data to:

• Run the marketplace: matching customers with suitable crew, managing booking offers, acceptances, schedules, call times and confirmed hours.
• Process payments: charging customers, holding funds, releasing payouts to crew after events, applying service fees and generating invoices.
• Keep people safe: vetting crew through identity verification, screening for fraud, and investigating reports of misconduct.
• Communicate with you: sending transactional emails (via Resend) and push notifications (via Firebase Cloud Messaging) about offers, confirmations, reminders, payment updates and important account or policy changes.
• Prevent fraud and abuse: detecting suspicious activity, enforcing our Terms of Service and protecting users and the platform.
• Comply with the law: meeting tax, accounting, employment-classification and other legal obligations, and responding to lawful requests from authorities.

We do not sell your personal data to anyone.

5. How we share your data

• Crew profiles are public by design. The work profile a crew member chooses to publish — photo, bio, roles, rates, languages, service areas and reviews — is visible to customers and visitors so they can decide who to book. Identity documents and contact details are not part of the public profile.
• Between customer and crew: when a booking is made, we share the details each side needs — the customer sees the assigned crew members' profiles, and assigned crew see the event details (date, time, venue, requirements and the customer's name and relevant contact information).
• Service providers (processors) acting on our instructions: Supabase (application hosting, database, authentication and file storage), Resend (transactional email delivery), Google Firebase (push notifications) and our payment providers (payment processing and payouts). Each processes data only as needed to provide its service to us.
• Authorities and legal processes: we disclose personal data where required by Rwandan law, a court order or a lawful request from a competent authority, or where necessary to establish, exercise or defend legal claims.
• Business changes: if Poetria is involved in a merger, acquisition or asset sale, personal data may be transferred as part of that transaction, subject to this policy and applicable law.

6. International transfers

Some of our service providers (including Supabase, Resend and Google Firebase) store or process data on servers located outside Rwanda. Where personal data is transferred outside Rwanda, we do so in accordance with the Data Protection Law, including any required registration or authorisation from the supervisory authority, and we require our providers to protect the data through contractual safeguards and appropriate security measures.

7. How long we keep your data

• Account and profile data: kept while your account is active. If you delete your account, it is deactivated immediately and permanently deleted after a 30-day grace period (signing back in within those 30 days restores it).
• Booking, payment and invoice records: kept for as long as required by Rwandan tax, accounting and commercial law, even after account deletion.
• Identity-verification documents: kept only as long as needed for verification and legal compliance, then deleted.
• Logs and security data: kept for a limited period appropriate to security and fraud-prevention needs, then deleted or anonymised.

8. How we protect your data

• Data is encrypted in transit (TLS) and stored with encryption at rest by our hosting providers.
• Access controls (including row-level security in our database) ensure users and staff can only access the data they are permitted to see.
• Identity documents are stored in restricted storage that is not publicly accessible.
• We limit internal access to personal data to people who need it to operate the Service, and we review our security practices regularly.
• No system is perfectly secure. If a breach occurs that puts your rights at risk, we will notify the supervisory authority and affected users as required by the Data Protection Law.

9. Your rights

Under Rwanda's Data Protection Law you have the right to:

• Access: request a copy of the personal data we hold about you. In the mobile app, go to You → Privacy → Export my data.
• Rectification: correct inaccurate or incomplete data. Most details can be edited directly in the app at any time.
• Erasure: request deletion of your personal data. In the app, go to You → Privacy → Delete account, or email us. Some records must be retained where the law requires it (see Section 7).
• Objection and restriction: object to or ask us to restrict certain processing, including processing based on legitimate interests.
• Portability: receive the data you provided to us in a structured, commonly used, machine-readable format.
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting processing that already happened.
• Complain: lodge a complaint with the data protection office of the National Cyber Security Authority (NCSA), Rwanda's supervisory authority for personal data protection. We would appreciate the chance to address your concern first — write to team.poetria@gmail.com.

We respond to rights requests within the timelines set by the Data Protection Law. We may need to verify your identity before acting on a request.

10. Children

The Service is for adults only. You must be at least 18 years old to create an account or work as crew. We do not knowingly collect personal data from anyone under 18; if we learn that we have, we will delete it. If you believe a minor has provided us data, contact team.poetria@gmail.com.

11. Marketing

We only send marketing messages (news, offers or promotions) with your consent, and every marketing email includes a way to unsubscribe. Transactional messages — booking offers, confirmations, reminders, payment and security notices — are part of operating the Service and are sent regardless of marketing preferences.

12. Changes to this policy

We may update this policy as the Service or the law evolves. If we make material changes, we will notify you through the app or by email before they take effect and update the effective date below. Continued use of the Service after changes take effect means the updated policy applies.

13. Contact us

For any questions, requests or complaints about this policy or your personal data, contact Poetria Company Limited, KK 4 Avenue, Kigali, Rwanda — team.poetria@gmail.com or +250 789 549 977. You may also contact the NCSA data protection office if you are not satisfied with our response.