Privacy Policy

Version 0.1. Last revised: [date].

[Company legal name, added when the business is registered] (“we”, “us”, “our”) runs Mosana. This policy explains what personal data we collect, why, who we share it with and what rights you have under the Data Protection Act, 2019 of Kenya. We are the “data controller” for the data described here. Our registration with the Office of the Data Protection Commissioner (ODPC): [Data Protection Commissioner registration number].

1. What we collect

You give us:

• Account data: name, email address, password (stored only in scrambled form), phone number, profile picture.
• Orders: what you buy, when, the amounts and your payment reference.
• Content and messages: what you post, comments, likes, messages with sellers or buyers and reviews.
• Seller data (if you sell): your profile name, description, location, contact phone, payout details (bank or M-Pesa account name and number), and identity verification results (see section 4).
• Support messages you send us.

Collected as you use the Site:

• Which pages, products, lessons and videos you open, your learning progress and reading position, searches, and technical data such as device type, browser and IP address.
• Watch history: when you are signed in, the videos you watch and the point you stopped at, so you can carry on where you left off. You see it under Account, then Watch history, and can remove any video or clear it all there. Signed out, your place is kept only in your own browser.
• What your feeds show and how you react to it: which posts and products were shown to you and which you opened, hid, or asked to see less of. We use this to order your feeds. It is kept against your account, or, if you are signed out, against a scrambled code made from your address and browser that cannot be turned back into either, and it is deleted after 90 days. Your browser’s Do Not Track or Global Privacy Control setting stops the recording of what was shown and opened.

From others:

• Paystack tells us whether a payment succeeded, the payment method used (for example M-Pesa or card type) and the last four digits and expiry of a saved card. We do not receive your full card number.
• Our identity verification provider tells us whether a seller’s identity check passed.

2. Why we use it, and our legal basis

What we do	Why	Basis
Create your account, take payment, give you access to what you bought, support you	To run the contract with you	Contract
Pay sellers, keep payment and tax records, prevent fraud and money laundering, answer lawful requests from authorities	To meet legal duties and protect the marketplace	Legal obligation, legitimate interests
Check sellers’ identity and payout accounts	To keep buyers and sellers safe	Legitimate interests, legal obligation
Show you relevant products, rank feeds, improve the Site, keep it secure	To run and improve the service	Legitimate interests
Send you product news and offers	Only if you opt in; you can opt out any time	Consent
Send service messages (receipts, access, security, renewals)	To run the service	Contract

3. Who sees your data

• Sellers see what they need to serve you: your name and what you bought or booked, and messages you send them. They must use it only to serve you and for their legal duties.
• Our service providers (processors), under contracts that require them to protect it. They currently include: Paystack (payments); Supabase (database and file storage); Vercel (website hosting); Cloudinary (images); Mux (video); Africa’s Talking (text messages); and an email sending service. [List to be confirmed with each provider’s current location and terms.]
• Authorities, where the law requires or allows, for example to investigate fraud or crime.
• A buyer of our business, if it is ever sold, who must respect this policy.

We do not sell your personal data.

4. Identity checks for sellers

To keep buyers safe, sellers must prove who they are. We check a national ID or passport and may use a specialist verification provider, which processes the ID and a photo on our behalf. We keep the result and a reference number, not a copy of the document, unless the law or a dispute requires it. [Confirm once a provider is chosen.]

5. Sending data outside Kenya

Some of our providers store or process data outside Kenya. Where that happens we put in place the safeguards the Data Protection Act requires, such as contracts that require the same level of protection, and we only send what is needed. [Lawyer to confirm the position for each provider.]

6. How long we keep it

We keep data only as long as we need it for the purpose it was collected, then delete or anonymise it. As a guide: account data while your account is open and for a short period afterwards; payment and tax records for the period the law requires (generally several years); messages and content until you or the other party delete them or the account closes; logs for a short period. [Retention periods to be confirmed.]

7. Your rights

Where the Data Protection Act gives you the right, you can ask us to: tell you what we hold about you and give you a copy; correct what is wrong; delete data we no longer need; object to or limit some uses (for example marketing); move your data to another service; and withdraw consent you gave (this does not undo earlier use). Email [privacy contact email]. We may need to check it is you, and we will reply within the time the law sets. You also have the right to complain to the Office of the Data Protection Commissioner (odpc.go.ke).

8. Security

We use encryption in transit, restrict access by role, keep payment card details with Paystack, and separate sellers’ data from each other. No system is perfectly secure. If a breach puts your data at risk, we will tell you and the ODPC as the law requires.

9. Children

Mosana is for people aged 18 and over. We do not knowingly collect data from children. If you think a child has given us data, contact us and we will delete it.

10. Cookies

See our Cookie Notice.

11. Changes and contact

We will post changes here and tell you of important ones. Questions: [privacy contact email], [Company legal name, added when the business is registered], [registered address].