Privacy Policy

We collect only what the marketplace needs to work:

• Account data: name, email address, phone number, password hash, avatar.
• Provider data: business details, service category, bio, service area, and verification documents you upload.
• Booking data: job descriptions, addresses or areas, schedules, messages, reviews and photos.
• Payment data: M-Pesa reference numbers, amounts, and payout destinations. We never store your PIN or full card numbers.
• Technical data: device, browser, IP address, and usage analytics for security and product improvement.

• Matching customers with suitable, verified providers.
• Processing bookings, escrow payments, commissions and payouts.
• Verifying provider identity and preventing fraud or abuse.
• Sending transactional notifications about your bookings and payments.
• Improving search, reliability and safety of the platform.

We process data to perform our contract with you (bookings and payments), to comply with legal obligations (tax, fraud, dispute records), on the basis of our legitimate interest in operating a safe marketplace, and with your consent where consent is required (for example, optional marketing or non-essential cookies).

We do not sell your personal information. We share it only:

• With the other party to a booking — providers see the request details you submit; customers see the provider profile.
• With service processors: cloud hosting, database, email delivery, analytics and M-Pesa payment processing.
• With authorities where legally required, or to prevent imminent harm or fraud.

We use essential cookies for authentication and security, and limited analytics cookies to understand usage. Details and controls are in our Cookie Policy.

• Account data: kept while your account is active, then deleted or anonymised within 90 days of closure.
• Booking and payment records: retained up to 7 years for tax, accounting and dispute-resolution obligations.
• Verification documents: retained while the provider account is active, then deleted.
• Support tickets and reports: retained up to 3 years.

Data is encrypted in transit (TLS) and at rest. Access to records is enforced at the database level with row-level security so users can only reach their own data. Verification documents live in a private bucket accessible only to authorised staff through short-lived signed links. Administrative access is role-based and audited.

Under Kenya’s Data Protection Act 2019 (and GDPR where applicable) you may request access, correction, deletion, restriction, portability, or object to processing.

Most of this is self-service in Settings — including editing your profile and deleting your account. For anything else, email supportconnectlocalafrica@gmail.com. We respond within 30 days.

Connect Local is not intended for anyone under 18. We do not knowingly collect data from children; if we learn we have, we delete it.

Our infrastructure providers may process data outside Kenya. Where that happens we rely on providers offering appropriate safeguards and contractual data-protection commitments.

We may update this policy. Material changes are notified by email or in-app before they take effect, and the “last updated” date above always reflects the current version.