Privacy Policy

Last updated: April 30, 2026

1. Introduction

Mtaani ("we", "us", or "our") is committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Mtaani platform at mtaani.site.

This Policy is drafted in compliance with the Kenya Data Protection Act, 2019 and other applicable data protection laws. By using the Platform, you consent to the practices described in this Policy.

2. Information We Collect

2.1 Information You Provide Directly

  • Account Information: Name, email address, password (stored encrypted), and user type (business owner, event organizer, service provider, or regular user).
  • Business/Service Listings: Business name, description, category, address, phone number, email, operating hours, and images.
  • Event Information: Event title, description, date, venue, location coordinates, pricing, and images.
  • Reviews & Ratings: Text content and star ratings you submit for businesses, events, and services.
  • Favorites: Listings you save to your favorites list.

2.2 Information Collected Automatically

  • Location Data: With your permission, we collect approximate geographic location to show you nearby businesses, events, and services. This is used only for proximity search and is not stored permanently.
  • Usage Data: Pages visited, search queries, time spent on the Platform, referral URLs, and browser/device type.
  • Cookies & Session Data: We use HTTP-only cookies for authentication (JWT tokens) and session management. These cookies are essential for the Platform to function and cannot be opted out of while using the service.

2.3 Information from Third Parties

  • Mapping Services: We integrate with OpenStreetMap (Nominatim) for geocoding. Addresses you enter may be sent to Nominatim for coordinate resolution. Please review Nominatim's privacy policy.

3. How We Use Your Information

We use the collected information to:

  • Create and manage your account and authenticate your identity.
  • Display your listings (businesses, events, services) to other users.
  • Power location-based search and discovery features.
  • Process and display reviews and ratings.
  • Send transactional emails (account confirmation, password reset).
  • Improve the Platform's features, performance, and user experience.
  • Detect and prevent fraud, abuse, and security incidents.
  • Comply with our legal obligations under Kenyan law.

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

4. Legal Basis for Processing

Under the Kenya Data Protection Act, 2019, we process your data on the following grounds:

  • Contract performance: Processing necessary to provide the services you requested (account management, listing display).
  • Consent: Where you have given explicit consent (e.g., location access, marketing communications).
  • Legitimate interests: To improve the Platform, prevent fraud, and ensure security.
  • Legal obligation: Where we are required to process data to comply with applicable law.

5. Data Sharing & Disclosure

We may share your information with:

  • Other Users: Your public listing information (business name, address, phone, email, description, images) is visible to all Platform users. Reviews you submit are attributed to your display name.
  • Service Providers: Third-party vendors who assist in operating the Platform (cloud hosting, database services) under confidentiality agreements.
  • Law Enforcement: Where required by court order, subpoena, or applicable Kenyan law.
  • Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with our services. If you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law (e.g., financial records) or for legitimate business purposes (e.g., resolving disputes).

Listing data may remain on the Platform after account deletion if it has been indexed by third-party search engines or archived.

7. Your Rights (Kenya Data Protection Act, 2019)

As a data subject, you have the right to:

  • Access: Request a copy of the personal data we hold about you.
  • Rectification: Request correction of inaccurate or incomplete data.
  • Erasure: Request deletion of your personal data (subject to legal retention requirements).
  • Objection: Object to processing based on legitimate interests.
  • Portability: Receive your data in a structured, machine-readable format.
  • Withdrawal of Consent: Withdraw consent at any time where processing is based on consent.

To exercise these rights, contact us at [email protected]. We will respond within 21 days as required by the Kenya Data Protection Act.

8. Cookies

We use the following types of cookies:

  • Essential Cookies: HTTP-only JWT authentication cookies required for login sessions. These cannot be disabled while using the Platform.
  • Functional Cookies: Store your preferences (e.g., location settings) to improve your experience.

We do not currently use advertising or tracking cookies from third parties.

9. Data Security

We implement industry-standard security measures to protect your personal data, including:

  • HTTPS/TLS encryption for all data transmitted between your browser and our servers.
  • Bcrypt hashing for all stored passwords.
  • HTTP-only cookies to prevent client-side script access to authentication tokens.
  • MongoDB Atlas security controls and access restrictions.

Despite these measures, no method of electronic transmission or storage is 100% secure. In the event of a data breach, we will notify affected users and the relevant authorities as required by law within 72 hours.

10. Children's Privacy

The Platform is not directed at children under the age of 18. We do not knowingly collect personal information from minors. If you believe a child has provided us with personal information, please contact us immediately at [email protected] and we will take steps to delete such information.

11. International Transfers

Your data may be processed and stored on servers outside of Kenya (e.g., cloud infrastructure). Where we transfer data internationally, we ensure adequate protection through appropriate safeguards in compliance with the Kenya Data Protection Act, 2019.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a notice on the Platform. The "Last updated" date at the top of this Policy indicates when it was last revised. Your continued use of the Platform after changes constitutes your acceptance.

13. Contact & Data Controller

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact:

Mtaani — Data Controller
Email: [email protected]
General enquiries: [email protected]
Website: mtaani.site

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya: odpc.go.ke.

Back to Home Terms of Service