Privacy Policy

Last updated: 2 August 2026

MomBoss VIP (mboss.vip) is a marketplace for women-owned businesses in Kenya and South Africa. This policy explains what we collect, why, who we share it with, and what you can ask us to do about it. It covers the website and the MomBoss VIP mobile app.

We have written it against what the platform actually does, verified in August 2026 – not against what a template says a marketplace usually does. Where a detail is still being confirmed, we say so rather than guess.

Who is responsible for your data

MomBoss VIP is the data controller for the information described below. [TO CONFIRM: registered legal entity name, registered address, and a named data protection contact. Required by Kenya’s Data Protection Act 2019 and South Africa’s POPIA. This section must be completed before submission to the app stores.]

What we collect

Information you give us

Account details – your name, email address and password. Your password is stored only as a cryptographic hash; we never see it.
Profile details – a bio, a profile picture, and optionally your gender, if you fill them in.
Store details, if you sell – your store name, description, banner, and your store’s address and map location. These are shown publicly on your store page.
Order details – billing and delivery address, phone number, and what you bought.
Things you create – product listings and photographs, stories, diary entries, cycle-tracking entries, saved items, and messages you send.

Information we collect automatically

Approximate location from your IP address, used to show you stores and events near you. We do not store this against your account, and the app does not request access to your device’s GPS. The app requests no device permissions beyond internet access.
Usage and device information – standard web server logs, and caching and security data from our hosting provider.

What we do not collect

We do not store your card or M-Pesa details. Payments are handled entirely by our payment providers; those details never reach our systems.
The app contains no advertising, analytics, or tracking software. There is no Facebook SDK, no Google Analytics, no crash reporter, and no advertising identifier. We do not track you across other companies’ apps or websites.

Sensitive information

If you use the cycle tracker, the information you enter is health information. It is private to you, it is not shown to other members, it is never used for advertising, and it is deleted when you delete your account. [TO CONFIRM: exact fields stored by the cycle tracker, and whether any derived data is retained.]

Why we use your information

To create and run your account, and to keep it secure
To process orders and payments, and to let a seller fulfil what you bought
To show you the marketplace, including stores and events near you
To let you message other members and our AI assistants
To pay sellers and affiliates what they are owed
To meet our legal and tax obligations

Our AI assistants

When you chat with one of our AI assistants (Mira, Amy, Steve, Lara or MBBM), what you write is sent to Google’s Gemini service through our own automation server in order to generate a reply. Your conversation is also stored on our systems so the assistant can remember context between messages.

Do not share payment details, passwords or identity-document numbers with an AI assistant. [TO CONFIRM: how long assistant conversation history is retained. No retention limit is currently set, and one will be published here once agreed.]

Who we share information with

We do not sell your personal information. We share it only with the following, and only for the purposes described:

Payment providers – Paystack, PayPal, Visa Acceptance Solutions and M-Pesa, to take payment. Each handles your payment details under its own privacy policy.
Sellers – when you buy from a store, that seller receives the delivery and contact details needed to fulfil your order.
Google (Gemini) – the content of your AI assistant conversations, as described above.
Cloudflare R2 and our hosting provider (Hostinger) – storage, delivery and security of the site and its images.
Brevo – to send marketing email, if you have opted in.
Automattic (Jetpack, Gravatar) – site statistics, video hosting and profile pictures.
Google Fonts – loading the fonts used in the app discloses your IP address to Google. [TO CONFIRM: we intend to self-host these fonts to remove this.]

[TO CONFIRM: whether the SMS (Texty) and print-on-demand (Printful) integrations are in active use. If they are, they receive phone numbers and shipping addresses respectively and will be listed here.]

How long we keep it

Your account and the things you create – until you delete your account.
Orders, payments, wallet transactions, seller payouts and affiliate commissions – kept after your account closes, because tax law in Kenya and South Africa requires it. Once your account is deleted these records are no longer linked to your name. [TO CONFIRM: exact retention period, to be set with our legal advisers.]
Backups – encrypted backups may hold data for a period after deletion before they rotate out. Deleted data is not restored to the live site. [TO CONFIRM: backup retention window.]

Your rights

Under Kenya’s Data Protection Act 2019 and South Africa’s POPIA you may ask us to:

Give you a copy of the information we hold about you
Correct anything that is wrong
Delete your account and your personal information
Object to, or restrict, how we use it
Withdraw consent to marketing at any time

You also have the right to complain to the Office of the Data Protection Commissioner (Kenya) or the Information Regulator (South Africa).

Deleting your account

[TO CONFIRM: this section is written and will be published together with the account-deletion feature, which is in development. It will describe the in-app route, the web route at mboss.vip/delete-account/, what is deleted, and what is kept in anonymised form for tax purposes. This policy will not claim a deletion route exists before it does.]

Children

MomBoss VIP is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us information, contact us and we will remove it.

Security

Traffic to and from MomBoss VIP is encrypted in transit using HTTPS. Passwords are stored as hashes. Access to production systems is restricted. No system is perfectly secure, and we will tell you and the relevant regulator if a breach affects your personal information, as the law requires.

Changes to this policy

If we make a material change we will update the date at the top and, where the change is significant, tell you in the app or by email.

Contact

[TO CONFIRM: privacy contact email address on the mboss.vip domain, and postal address. Both stores require a working contact route, and a Gmail address will not be accepted by Apple.]