Privacy Policy

This policy explains how Minada handles personal data on minada.ke and on stores hosted on the platform. It covers two groups: merchants, who run stores on Minada, and shoppers, who buy from those stores. It is written to comply with the Data Protection Act, 2019 of Kenya.

For merchant accounts, Minada is the data controller. For shopper data collected through a store, such as your name, phone and delivery details on an order, the merchant is the data controller and Minada processes that data on the merchant's behalf to run their store. If you are a shopper and want your data corrected or deleted, the merchant you bought from is your first point of contact, and we support them in honouring your request.

• Merchant account data. Name, email, phone number and business details such as business name, location and contact information.
• Settlement details. The M-Pesa or bank details a merchant nominates for payouts. These are encrypted at rest and only the last digits are ever shown in the interface.
• Order data. Buyer name, phone, email, the items ordered and the delivery method and location chosen at checkout.
• Payment records. References, amounts and outcomes of payment attempts. Payment itself happens with licensed payment processors and mobile money providers. We never see or store M-Pesa PINs, card numbers or wallet credentials.
• Technical data. IP address, device and browser information and security logs, used to keep accounts safe and prevent abuse.
• Cookies. Essential cookies only: login sessions and shopping carts. We do not run third-party advertising trackers.

• Running the platform: stores, orders, stock, deliveries and payouts.
• Sending transactional messages such as order receipts, merchant alerts, verification codes and password reset codes.
• Security: verifying sensitive changes, rate limiting, fraud prevention and keeping an audit trail of sensitive actions.
• Improving the product and complying with the law.

We do not sell personal data. We do not send marketing on behalf of third parties.

We share data only where the service needs it to work:

• Payment processors, such as M-Pesa, Airtel Money and bank integrations, to take online payments and settle money to merchants.
• Shipping and logistics partners, including agent pickup networks and the merchant's own riders, who receive the recipient's name, phone and delivery location to fulfil an order.
• The merchant you buy from, who sees the order details their customers submit to their store.
• Authorities, where the law of Kenya requires it.

Behind the platform we also use service providers, each receiving only what its part of the service needs:

• Cloud hosting and storage providers, who host the database, accounts and product images.
• Email and SMS providers, who deliver receipts, delivery updates, verification codes and one-time codes.
• Analytics and monitoring services, used to keep the platform running and secure.

• Settlement details are encrypted at rest with strong encryption.
• Every store's data is isolated. Merchants can only ever access their own store's records, enforced at the database level.
• Sensitive changes require step-up verification by email and phone.
• Sensitive actions are recorded in an append-only audit log.

We keep personal data for as long as the related account is active and afterwards only as long as needed for legal, accounting and dispute purposes. Order records may be retained as part of a merchant's business records even after a shopper asks for erasure, where the law allows or requires it.

When a merchant erases a shopper, we remove that shopper's name, phone and email from the store's records and keep the order itself as a business record. Two things that erasure does not reach, so you know where to ask next:

• Emails already delivered to your inbox, and the copies our email providers keep under their own retention rules. Payment records held by our payment processors are also kept under their terms and Kenyan financial rules.
• Your Minada login itself, if you created one. One login works across every store on the platform, so erasing you at one store does not close it. Write to us to close the login entirely.

Under the Data Protection Act, 2019 you have the right to know what data we hold about you, to have it corrected or deleted, and to object to certain processing. Shoppers should contact the merchant they bought from first. Merchants and anyone else can write to minadabypickupmtaani@gmail.com. If you are not satisfied with our response you may complain to the Office of the Data Protection Commissioner of Kenya.

Merchant accounts are for adults aged 18 and over. Shoppers under 18 should use the platform with a parent or guardian.

We may update this policy as the platform grows. The date above shows the current version, and material changes will be announced on the platform or by email. Questions go to minadabypickupmtaani@gmail.com.