Privacy Policy.
MtaaLink exists to bring order to your organization's records — not to extract from them. This policy explains what we collect, why, and the rights you and your members have over your data.
01Who we are
MtaaLink is an organization management platform built and operated from Nairobi, Kenya. We serve chamas, churches, SACCOs, welfare groups, villages, and small businesses across Kenya.
For any privacy question, contact us at sukanoelijah@gmail.com.
02What we collect
Information you give us
- Organization details — name, type, location, and settings you configure.
- Member records — names, ID numbers, phone numbers, roles, and any notes your organization chooses to store.
- Financial records — contributions, expenses, balances, and receipts entered by your organization.
- Election data — candidates, voting codes, and vote tallies.
- SMS messages — announcements you send and their delivery status.
- Account information — admin email and password (hashed, never stored in plain text).
Information collected automatically
- Device & browser info — to ensure the platform works correctly on your device.
- Usage logs — anonymized records of actions taken in the app (for security and troubleshooting).
- IP address — used only for security and abuse prevention.
03How we use your data
We use your data strictly to run the platform you signed up for:
- To store, display, and process your organization's records.
- To send SMS messages on your behalf (voting codes, announcements).
- To generate PDF reports and exports you request.
- To secure your account and detect abuse.
- To improve the platform (using anonymized, aggregated data only).
We do not sell your data. We do not share it with advertisers. We do not train AI models on it.
04Who can see your data
- Your organization's admins — full access to records within your organization.
- Your members — only their own records, unless your organization grants more access.
- MtaaLink operators — limited access, only when needed for support, security, or legal compliance.
We do not allow third parties to access your data except:
- SMS delivery providers — we share phone numbers with our SMS gateway to deliver messages. They process this data only for delivery.
- Hosting infrastructure — our servers run on reputable cloud providers with encryption at rest and in transit.
- Legal obligations — if required by a valid court order or Kenyan law.
05How we protect your data
- All data is encrypted in transit using HTTPS/TLS.
- Passwords are hashed using industry-standard algorithms (never stored in plain text).
- Database backups are encrypted and stored in the region you operate in.
- Access to production systems is restricted to named MtaaLink operators.
- We log and monitor for suspicious activity.
Honest note: No system is 100% secure. If we ever become aware of a breach affecting your data, we will notify you within 72 hours with details of what happened and what we're doing about it.
06How long we keep your data
- While your account is active — we keep your data so the platform works.
- After account deletion — we delete your data within 30 days, except where required by law.
- Backups — may persist for up to 90 days after deletion, then are purged.
- Logs — anonymized usage logs are kept for 12 months.
07Your rights
You have the right to:
- Access — request a copy of all data we hold about your organization.
- Correct — fix any inaccurate data (via the app, or by contacting us).
- Delete — request deletion of your organization's account and all associated data.
- Export — download all your data in a machine-readable format.
- Object — object to any processing you're not comfortable with.
To exercise any of these rights, email sukanoelijah@gmail.com. We respond within 7 days.
08Cookies & tracking
MtaaLink uses minimal cookies:
- Session cookie — keeps you logged in. Essential.
- CSRF token — protects against cross-site attacks. Essential.
We do not use advertising cookies, cross-site trackers, or third-party analytics that profile you.
09Children
MtaaLink is not intended for use by individuals under 18 without adult supervision. We do not knowingly collect data from children. If you believe a child has submitted data, contact us immediately.
10Changes to this policy
If we make material changes, we will notify you by email and post a prominent notice on the platform. Continued use after changes means you accept the updated policy.
11Governing law
This policy is governed by the laws of Kenya, including the Data Protection Act, 2019. Disputes will be handled in Kenyan courts.
12Contact
Questions about this policy? Reach us at:
- Email: sukanoelijah@gmail.com
- WhatsApp: +254 719 750 245
- Location: Nairobi, Kenya