Privacy Policy

What this policy covers

This one policy covers everything under the Kwamua name: the Kwamua mobile app, the Kwamua web app, and the kwamua.com website. It applies whether you have an account or are only visiting the website.

Who we are

Kwamua is run by Adcoar Ltd, Nairobi, Kenya ("we"). We decide why and how your personal data is used, which makes us the "data controller" under Kenya's Data Protection Act, 2019.

What we collect

Everyone with an account: your name, email address, phone number and password (we store only a scrambled form of the password, never the password itself). When you sign up we also record that you confirmed you are 18 or older and accepted these documents, with the date and the version you accepted.

Customers: your device's location when you search for help (to find nearby providers) and the place you ask a provider to come to; what you type when describing a job.

Providers: national ID number and a photo of your ID document (to verify you), a profile photo, business name, bio, the skills you offer, your starting price, and your location while you are marked available (customers who book you can see you are on the way).

Everyone using a booking: the messages in that booking's chat, ratings and reviews, and payment records for fees you pay (your phone number, the amount and the M-Pesa reference).

From your phone: the phone model and brand, Android version, memory size, the Kwamua version, a random install number (not a hardware ID), and a push-notification token if you allow notifications. When the app crashes or a request fails we receive a report with the screen, the type of error and the same device details - never what you typed.

From our servers: your IP address and basic request details in security and error logs.

We do not collect card details or M-Pesa PINs - those go straight to Safaricom.

Why we use it

• To run the service you asked for: matching you with providers, bookings, chat, reviews, notifications. (Contract.)
• To verify providers and keep the marketplace safe: checking IDs, preventing fraud, handling disputes, responding to abuse or a safety report or a crime, and meeting legal duties. (Legitimate interest and legal obligation.)
• To take and account for payments. (Contract and legal obligation.)
• To keep the app working: finding crashes, supporting different phones. (Legitimate interest.)

We do not use your data for advertising and we do not sell it.

Emails. We send you emails about your account, your bookings and sign-in or password codes; you need these. Some of them also include a short section about other services from Adcoar Ltd. Every email with that section has an Unsubscribe link, and once you unsubscribe the section stops (you keep getting the emails you need). Sign-in, password and confirmation code emails never include it.

Chat messages

Messages in a booking are stored on our servers. We keep them so that disputes, harassment, fraud and crimes carried out through the app can be investigated. A small number of authorised Kwamua staff can read a conversation through a restricted screen, and every time one is opened it is recorded with who opened it and when. An automatic filter also blocks phone numbers and similar contact details from being shared in chat before a booking's contact is unlocked. We do not read chats for any other purpose. We may give messages to the police or a court when the law requires it.

Who else handles your data

• The other person in a booking sees your name; and your phone number once contact is unlocked for that booking.
• Safaricom processes M-Pesa payments (it receives your phone number and the amount).
• Expo and Google deliver push notifications (they receive a device token and the notification text).
• OpenFreeMap supplies the map pictures in the app. When you open a map, the map server can see your IP address and the area you are viewing. It does not receive your name, account or bookings.
• Hetzner Online GmbH hosts our servers in Germany, Cloudflare protects and speeds up our website and API, and Zoho delivers our emails. They process data only to provide those services to us.
• Google Analytics is used on our website only if you accept cookies in the banner. The app does not use analytics or advertising tools.
• Authorities: the police, courts or regulators, when the law requires or a court orders it.

Sending data outside Kenya. Our servers are in Germany and some of the services above are run from other countries. We only use providers that keep personal data protected, and we share only what each one needs.

How long we keep it

• Account details (name, email, phone, photo, ID document, bio): While your account is open. Removed when you delete your account.
• Chat messages and booking details: 12 months after the booking ends; longer for a conversation involved in a dispute, report or investigation, until it is closed.
• Payment records: 7 years, as accounting and tax law require. These stay even after an account is deleted.
• Crash and error reports, device details: 90 days
• Server logs: 90 days
• Record that you accepted these documents: As long as we need to show you did.

After these periods the data is deleted or made anonymous. Past bookings and messages of a deleted account stay on the other person's record, shown as "Deleted user".

Your rights

Under the Data Protection Act, 2019 you can ask what data we hold about you, ask us to correct it, ask us to delete it, object to how we use it, and ask for a copy you can take elsewhere.

• Delete your account yourself: in the app, Profile > Delete my account. Or follow the steps at kwamua.com/delete-account.
• Anything else: email [email protected] from the email on your account. We reply within 14 days.
• If you are unhappy with how we handled it, you can complain to the Office of the Data Protection Commissioner (odpc.go.ke).

Our website and cookies

The kwamua.com website uses only the cookies it needs to work (for example to keep you signed in to the web app and to remember your language). If we switch on website analytics (Google Analytics), it only loads after you press Accept on the cookie banner; if you press Decline, or ignore the banner, it never loads. The mobile app does not use cookies, analytics or advertising tools.

Security

Data travels over encrypted connections. Passwords are stored scrambled. ID documents are stored privately and are only seen by staff verifying you. Uploaded pictures have their hidden location and camera details removed. No system is perfectly secure, and we cannot promise absolute protection. If a breach puts your data at risk we will tell you and the ODPC as the law requires.

Children

Kwamua is only for people aged 18 or older, and you confirm this when you sign up. If we learn that someone under 18 has an account, we delete it.

Changes

If we change this policy in a way that matters, we will tell you in the app before it takes effect, and ask you to accept it again where the law requires.

Contact

Adcoar Ltd, Nairobi, Kenya. Email: [email protected]. Data protection contact: Adcoar Ltd, at the same address.