Summary
- You can search and browse businesses without an account.
- If you create an account, we keep your name, phone number and a securely hashed password. We don't ask for an email address.
- Business listings and reviews are public - that is the point of the directory.
- We never sell your data and never show you third-party adverts.
- You can delete your account and data at any time, in the app or on our account deletion page.
Data we collect
When you create an account
- Your full name.
- Your phone number, which we verify by sending a one-time code by SMS.
- Your password - stored only in hashed form (see "How we keep your account and password safe").
A few accounts created before 13 October 2026 were made with an email address instead of a phone number. We keep that address only until the account is deleted, and no longer use it to sign in.
When you list a business
- The business name, description, categories, address and map location, phone and WhatsApp numbers, website, opening hours, services and prices, logo and photos. This information is public and shown to everyone who uses Mtaa Yangu.
- If you claim an existing listing, the message you send with your claim.
When you pay for Premium
- The M-Pesa phone number you pay from, the amount, the date, the payment status and the M-Pesa receipt number. You approve the payment on your own phone; we never see or store your M-Pesa PIN.
When you use the app
- Location. If you allow it, your device's location is sent with your searches so we can show nearby businesses and how far away they are. We do not save it to your account or keep a history of where you have been. You can turn location off at any time in your phone's settings and search by area name instead.
- Reviews, favourites and reports. Reviews you write are public and shown with your name. Your favourites are private to you. If you report a review, we keep the report so we can act on it.
- Activity. We record searches (the words and category you searched for) and actions such as viewing a business or tapping Call, WhatsApp, Directions or Share. If you are signed in, these are linked to your account. Business owners see only totals (for example "42 calls"), never who made them.
- Photos and camera. Only when you choose to upload a business photo or logo. We don't access your other photos.
- Technical data. Like most online services, our hosting providers automatically log IP addresses, device and browser type, and the time of each request, to keep the service secure and fix problems.
How we use your data
- To run Mtaa Yangu: create and secure your account, show listings and reviews, and find businesses near you.
- To verify your phone number and help you reset a forgotten password.
- To process Premium payments and keep a record of them.
- To show business owners how their listing is performing, using totals only.
- To improve search results and the app.
- To prevent spam, fraud and abuse - for example by limiting how often codes can be requested.
- To moderate content: our administrators can view account details to handle reports, claims and support.
We process your data to provide the service you asked for (performance of a contract), with your consent (for example location access, which you can withdraw), for our legitimate interests in keeping Mtaa Yangu safe and useful, and where the law requires it (for example keeping payment records).
Who we share data with
We do not sell or rent your personal data. We share it only with the service providers that run Mtaa Yangu for us, and only what each one needs:
- Supabase - our database, sign-in system and photo storage.
- Vercel - hosts our website and the servers the app talks to.
- Africa's Talking - sends the SMS verification codes to your phone number.
- Safaricom (M-Pesa) - processes Premium payments.
- OpenStreetMap and, where enabled, Google Maps - display maps and turn addresses into map locations.
When you tap Call, WhatsApp or Directions, we open your phone app, WhatsApp or Google Maps. What you do there is covered by those apps' own privacy policies. We may also disclose data if the law requires it, or to protect the rights and safety of our users.
Our providers store and process data on servers that may be outside Kenya. We only use providers that protect data with the safeguards the Data Protection Act, 2019 requires.
How we keep your account and password safe
- Passwords are never stored in plain text. Your password is converted into a salted one-way hash (bcrypt) by our sign-in system before it is stored. Nobody at Mtaa Yangu can see or recover your password.
- Passwords must be at least 8 characters long.
- We never send your password by SMS or email, and we will never ask you for your password or a verification code. Anyone who does is not Mtaa Yangu.
- Phone verification and password-reset codes are single-use, expire after 10 minutes, and are blocked after 5 wrong attempts. New codes can only be requested after a short wait.
- Forgotten passwords are reset with a code sent by SMS to your verified phone number.
- All data travels between your device and our servers over encrypted HTTPS (TLS) connections.
- Database rules ensure each user can only change their own account, listings and reviews. Administrator tools are limited to approved administrators.
- Payments are approved on your own phone through M-Pesa; we never handle your M-Pesa PIN.
What you can do
- Use a password you don't use anywhere else, and don't share it.
- Never share a verification code sent to your phone with anyone.
- If you think someone else has accessed your account, reset your password straight away.
No system is perfectly secure, but if a breach ever affected your personal data we would notify you and the Office of the Data Protection Commissioner as the law requires.
How long we keep data
- Account, listing, review and favourite data: until you delete it or delete your account.
- Verification codes: deleted after use, and they stop working after 10 minutes.
- Payment records: 5 years after the payment, as Kenyan tax law requires. When you delete your account they are no longer linked to it.
- Activity records: when you delete your account they are kept only as anonymous statistics.
- Technical logs: kept by our hosting providers for a short period, up to 90 days.
- Backups: deleted data may remain in our providers' encrypted backups for up to 30 days.
Deleting your account and data
You can permanently delete your account and data at any time:
Deletion happens straight away. It removes your account, your businesses and their photos, your reviews, favourites and claims. You can also delete individual reviews and favourites at any time without deleting your account. The account deletion page lists exactly what is deleted and what is kept.
Your rights
Under the Data Protection Act, 2019 you have the right to:
- be told how your data is used (this policy);
- get a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted;
- object to, or ask us to restrict, how we use your data; and
- withdraw consent, for example by turning off location access.
To use these rights, contact us as described below. If you are unhappy with how we handle your data, you can complain to the Office of the Data Protection Commissioner at www.odpc.go.ke.
Children
Mtaa Yangu is not directed at children. We do not knowingly collect personal data from anyone under 18 without the consent of a parent or guardian. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
If we change how we handle personal data, we will update this page and the "Last updated" date above. For significant changes we will also let you know in the app.
Contact us
Mtaa Yangu, Nairobi, Kenya. For privacy questions or requests, email us at the developer contact address shown under App support on the Mtaa Yangu page on Google Play.