Privacy Policy

1. Introduction & Scope

Mvuvi BlueConnect is committed to protecting your privacy and Personal Data in accordance with the Kenya Data Protection Act (2019), GDPR, and CCPA/CPRA. This policy explains how we collect, use, disclose, and protect your data.

2. Categories of Personal Data Collected

• Account Information: Email, hashed password, full name, phone number, avatar URL, role.
• Facility Registration Data: Facility details, location, capacity, pricing, operating hours, compliance documents, media.
• Booking Data: Contact details, fish type, quantity, storage duration, dates, total price, notes, and a photo of the goods.
• Stock Listing Data: Species, quantity, asking price, wild-catch or farm-harvest source, farm name, harvest or projected harvest date, listing photo, notes.
• Location Data: Precise coordinates and accuracy, captured once from your device when you create a booking or a stock listing — with your permission, and never in the background. See section 3.5 of the full policy.
• Technical Data: IP address, device info, cookies, analytics events, support inquiries.

2a. Your Location

• It is optional. Decline the browser prompt and your booking or listing still works — the coordinates are simply left empty.
• It is a single point in time. We capture your position only at the moment you submit. We do not track you in the background or build movement histories.
• You can type it instead. The stock listing form accepts manually entered coordinates.
• Listing coordinates may be shown to buyers so your stock appears in distance-based search. Booking coordinates are internal — visible only to you, the facility, and administrators.
• Walk-in bookings recorded by facility staff never capture your location; the facility's own registered address is used.

3. Purposes & Legal Bases

We process data under contract (account creation, bookings), legal obligation (tax compliance, KRA), legitimate interests (fraud prevention, analytics), and consent (direct marketing, non-essential cookies).

4. Data Sharing & Processors

We share data with trusted processors: Render (hosting), Vercel (frontend), PostHog (analytics), email/SMS providers. We do not sell your personal data. We may disclose data to authorities (KRA, ODPC, law enforcement) when legally required.

5. Data Retention

• Active account data: indefinitely while account is active
• Booking records: 7 years after completion
• Analytics data: 26 months
• Server logs (IP addresses): 90 days
• Support tickets: 3 years after resolution
• Moderation records: 7 years

6. Your Rights

You have rights to access, correct, delete, restrict processing, data portability, and objection. Contact dpo@mvuvi.co.ke to exercise these rights. We respond within 45 days.

7. Data Security & Breach Notification

We use HTTPS, bcrypt password hashing, RBAC, and regular security audits. In case of a breach likely to result in risk to your rights, we will notify the ODPC within 72 hours and affected users without undue delay.

8. Children's Privacy

The platform is for users 16+. We do not knowingly collect data from children under 16. If discovered, we will delete such data immediately.