Privacy Policy
We never sell your personal data, and we never show your phone number to other members. This policy explains what we collect and why, as the Data Protection Act, 2019 (the "Act") requires. [Company Name] is the data controller and data processor, registered with the Office of the Data Protection Commissioner (ODPC) under number [ODPC Registration No.].
1. The waitlist
If you join our waitlist, we collect your first name, phone number, county, gender, who you want to meet and, if you choose, what you're looking for. We use this only to tell you when Mwenzi opens in your area, to plan our launch, and to run the invite-a-friend list. To stop spam sign-ups, we also keep a scrambled (hashed) code made from your internet connection address. It can't be turned back into the address. We delete waitlist details 12 months after launch if you haven't created an account, or sooner if you ask.
2. What we collect in the app
| Data | Examples | Why we need it |
|---|---|---|
| Account data | Phone number, first name, age, gender, county and town | To create your account, confirm you're 18+ and in Kenya, and show you nearby people |
| Profile data | Photos, bio, prompts, interests, occupation, education, height, languages, lifestyle, what you're looking for | To show your profile to other members, suggest matches and work out compatibility |
| Sensitive data | Religion, who you're interested in, your selfie (biometric data) | For matching filters you choose and for liveness selfie verification |
| Activity data | Likes, comments, matches, messages, voice notes, reports, blocks, hidden contacts | To run matching and chat, and to keep members safe |
| Safety data | Date check-in details and trusted contact, if you use them | To alert your trusted contact if you don't check in |
| Payment data | M-Pesa number, amount, transaction code | To process Premium payments. We never see or store your M-Pesa PIN. |
| Device data | Device type, app version, IP address, approximate location | For security, fraud prevention, distance matching and fixing problems |
If you sign in with Google or Facebook: we receive only your name, email address and profile photo from that service. We never see your password, and we never post anything to your accounts. You can unlink them at any time in Settings.
3. Sensitive personal data
The Act treats religion, sexual orientation and biometric data as sensitive personal data. We process it only with your explicit consent, which you give by adding it to your profile or taking the selfie check. You can remove it, or withdraw your consent, at any time in Settings. We use your selfie only to verify your identity, we never show it publicly, and we delete it within [30] days of a successful check.
4. Automated safety checks
To protect members, we automatically check photos for nudity, violence and stolen images, and we scan messages for signs of scams, threats, manipulation and pressure to meet in private places. These checks show warnings and may flag content for a human moderator to review. Staff open a chat only when it has been reported or flagged.
5. Our legal grounds
- Contract: we need your data to provide Mwenzi to you.
- Consent: for the waitlist, sensitive data and optional features. You can withdraw consent at any time.
- Legitimate interest: to prevent fraud and scams and to keep the service secure.
- Legal obligation: to keep tax records and to answer lawful requests from authorities.
6. Who we share data with
- Other members see your profile but never your phone number, exact location or selfie.
- Hidden contacts: numbers you add to "Hide people I know" are scrambled (hashed) and used only to keep you hidden from those people.
- Service providers process data only on our instructions: [Vendors], including SMS delivery, M-Pesa payments (Safaricom), hosting, photo moderation and selfie verification. Each provider has a written data-processing agreement with us.
- Authorities: we share data with the police or courts only when the law requires it, or when someone's safety is at serious risk.
- Buyers: if Mwenzi is sold or merged, your data moves with it under this policy, and we will tell you first.
We never sell your data, and we don't share it with advertisers.
7. Data kept outside Kenya
Some providers may store data outside Kenya. We transfer data abroad only as section 48 of the Act allows, for example to countries with adequate data protection or under safeguards such as contractual protections.
8. How long we keep data
- Account and profile data: while your account is open. We delete it within 30 days after you delete your account.
- Messages: deleted with your account, except those connected to a report, which we keep for up to 12 months.
- Data on banned accounts: up to 2 years, to stop the same person from signing up again.
- Payment records: 7 years, as Kenyan tax law requires.
9. Your rights
Under the Act, you have the right to:
- Be told how we use your data
- See a copy of your data (in the app: Settings, then View my data)
- Have wrong data corrected
- Have your data deleted (in the app: Settings, then Delete account)
- Object to processing, or withdraw your consent
- Receive your data in a portable format
To use any of these rights, or to leave the waitlist, email [DPO Email]. We will respond within the time limits set by the Data Protection (General) Regulations, 2021.
10. Security
We encrypt data when it's sent and when it's stored, limit which staff can access it, and log that access. If a data breach puts you at risk, we will notify the ODPC within 72 hours, as the Act requires, and tell affected people without delay.
11. Children
Mwenzi is only for adults aged 18 and over. If we learn that an account or waitlist entry belongs to someone under 18, we close it and delete its data.
12. Cookies and similar storage
Our website stores a small amount of information on your device, such as your waitlist invite code, so it can show your place in line when you come back. We don't use advertising cookies.
13. Changes to this policy
We will tell you about important changes in the app or by SMS before they take effect.
14. Contact and complaints
If you have a privacy question, contact our Data Protection Officer, [DPO Name], at [DPO Email]. If you're not satisfied with our response, you can complain to the Office of the Data Protection Commissioner.