Privacy Policy

This Privacy Policy explains how Kazi Links ("we", "us", "our") collects, uses, discloses, and protects information when you use our Platform to find, hire, or offer skilled professional services in Kenya. We process personal data in accordance with the Kenya Data Protection Act, 2019.

Account & profile information:

• Name, email address, phone number, and password (hashed, never stored in plain text).
• Profile photo, bio, skills, hourly/project rates, experience, and profession/category (Professionals).
• Location details: Town/City, Estate/Neighborhood, nearest Landmark, and precise GPS coordinates if you opt into "Near Me" search.

Identity verification (KYC):

• National ID photos (front and back) submitted by Professionals for identity verification, and the verification decision/notes.

Financial information:

• M-Pesa phone number, transaction references, amounts, and status for deposits, withdrawals, escrow payments, and registration fees. We never see or store your M-Pesa PIN.
• Wallet balance and full ledger/transaction history.

Communications:

• In-app chat messages and file/image attachments exchanged between a Client and a Professional.

Usage & device information:

• Pages visited, buttons clicked, and general usage analytics (see "Analytics & Cookies" below).
• Device/browser type, IP address, and approximate location inferred from it.

Google Sign-In (optional):

• If you choose "Continue with Google", we receive your verified email, name, and profile picture from Google.

• To create and manage your account, and to let you switch between Client and Professional roles.
• To process registration fees, deposits, escrow payments, and withdrawals via M-Pesa.
• To power search, "Near Me" location sorting, and matching between Clients and Professionals.
• To verify Professional identity (KYC) and display verification badges.
• To enable in-app chat between a Client and a Professional they are booking or discussing work with.
• To send transactional emails (e.g. password reset) and in-app notifications.
• To investigate disputes, fraud, abuse, or violations of our Terms of Use.
• To understand how the Platform is used and improve it, via aggregated product analytics.
• To comply with legal obligations, including anti-fraud and payment regulations in Kenya.

We process your personal data on the basis of: (a) your consent (e.g. optional GPS location, Google Sign-In); (b) performance of our contract with you (e.g. processing bookings and payments); (c) our legitimate interests (e.g. fraud prevention, product analytics); and (d) compliance with legal obligations (e.g. KYC and financial record-keeping).

We share limited data with the following processors, only as needed to operate the Platform:

• Safaricom M-Pesa (Daraja API): phone number and transaction amount, to process STK Push deposits/fees and B2C withdrawals. We never receive your M-Pesa PIN.
• Google: if you use "Continue with Google", Google authenticates your identity and shares your verified email, name, and photo with us.
• Resend: your email address, to deliver transactional emails such as password resets.
• Emergent Object Storage: securely stores uploaded files — profile photos, portfolio images, KYC ID photos, and chat attachments.
• PostHog: anonymized/pseudonymized usage analytics (pages viewed, actions taken) to help us understand and improve the Platform, hosted on PostHog's US Cloud infrastructure.

We do not sell your personal data to third parties.

A Professional's name, profession, profile photo, bio, skills, rates, rating, reviews, and general location (town/estate — never your exact home address unless you choose to share it in chat) are visible to Clients browsing search results or your public profile/QR code. Chat messages are only visible to the two participants and, if a dispute is reported, our moderation team.

We use PostHog to capture pageviews and in-app events so we can understand how the Platform is used. We also use your browser's local storage to keep you logged in (storing your session token) and to remember search preferences. You can clear this at any time via your browser settings, though doing so will log you out.

Passwords are hashed and never stored in plain text. Payment processing runs through Safaricom's secured M-Pesa Daraja API. Uploaded files (KYC documents, photos, chat attachments) are stored in access-controlled object storage. While we take reasonable technical and organizational measures to protect your data, no system is completely secure, and we cannot guarantee absolute security.

We retain account, booking, and financial/ledger records for as long as your account is active and for a reasonable period afterward to meet legal, tax, and dispute-resolution obligations. KYC documents are retained only as long as necessary for verification and compliance purposes. You may request deletion of your account as described below, subject to records we are legally required to keep.

Under the Kenya Data Protection Act, 2019, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or outdated information (some fields, like phone number and profession, are locked post-verification for security — contact support to update these).
• Request deletion of your account and associated personal data, subject to legal/financial record-keeping requirements.
• Object to or restrict certain processing (e.g. opt out of optional location sharing).
• Withdraw consent for optional features (e.g. Google Sign-In, GPS location) at any time.

To exercise any of these rights, contact us using the details in Section 13.

The Platform is not intended for anyone under 18 years old. We do not knowingly collect personal data from minors. If we learn that a minor has created an account, we will take steps to delete it.

Some of our service providers (e.g. PostHog, Google, Resend) may process data on servers located outside Kenya, including in the United States or European Union. Where this occurs, we rely on appropriate contractual and technical safeguards from those providers.

For any privacy questions, or to exercise your data rights, contact us at support@kazilinks.co.ke or by phone/WhatsApp at +254 745 576 048.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will update the "Last updated" date above when we do; significant changes may also be communicated in-app.