Privacy Policy

Last updated: September 14, 2026

Plug-Yangu ("we", "us", "our") operates a marketplace that connects clients with service providers and listings across Kenya. This policy explains what we collect, why we collect it, and the choices you have. By using our website, mobile app, or related services, you agree to this policy.

1. Who we are

Data controller: Plug-Yangu
Contact: support@plugyangu.co.ke
Address: Nairobi, Kenya
Business District

2. Information we collect

Account data: name, email, phone number, password (hashed), role (client and/or provider), profile photo, and verification status.
Location: approximate and precise GPS when you search, set a map pin on a listing, or use provider job features such as "I've arrived". We do not collect background location.
Photos and files: listing images, portfolio photos, and identity or business documents uploaded for verification.
Messages: in-app chat between clients and providers related to jobs, inquiries, and support.
Payments: M-Pesa phone numbers, wallet balances, top-up records, and transaction references. We do not store full card numbers — wallet funding is via M-Pesa.
Device data: push notification tokens (FCM), device type, and basic app/platform identifiers needed to deliver notifications.
Audio (optional): if in-app Wi‑Fi calling is enabled, microphone access is used only during an active call.
Usage and logs: pages visited, actions taken, IP address, browser or app version, and security logs.

3. How we use your information

Create and secure your account; route you to the correct client or provider portal.
Match clients with nearby or relevant providers and listings.
Process bookings, job status updates, and wallet top-ups.
Send in-app, SMS, email, and push notifications about jobs, messages, and account activity.
Verify provider identity and documents before listings go live.
Prevent fraud, enforce our Terms of Service, and respond to support requests.
Improve reliability, safety, and product quality.

4. Legal bases (where applicable)

We process personal data to perform our contract with you, comply with legal obligations, pursue legitimate interests (fraud prevention, platform safety), and — where required — with your consent (for example, optional marketing or device permissions you can revoke in settings).

5. Sharing with third parties

We do not sell your personal data. We share data only as needed to run the service:

Safaricom / M-Pesa (Daraja): to initiate STK Push wallet top-ups.
Google Firebase Cloud Messaging: to deliver push notifications to the Android app.
Google Sign-In: if you choose to log in with Google (client accounts).
Agora (optional): if in-app Wi‑Fi calling is enabled, call session metadata and audio routing.
Maps providers: location coordinates you submit may be sent to map or geocoding services to display pins and distances.
Hosting and infrastructure: servers, email, SMS gateways, and realtime services that process data on our behalf under confidentiality obligations.

6. Data retention

We keep account and transaction records while your account is active and for a reasonable period afterward to meet legal, tax, and dispute-resolution requirements. Chat, job, and wallet records may be retained according to operational and regulatory needs. You may request deletion subject to limits described below.

7. Security

We use HTTPS in production, access controls, hashed passwords, and server-side safeguards. No method of transmission over the internet is 100% secure; please use a strong password and keep your device secure.

8. Your choices and rights

Update profile details in your account settings.
Revoke location, camera, microphone, or notification permissions in your device or browser settings.
Opt out of non-essential SMS or email where settings are provided.
Delete your account: use Delete account (public instructions and guest request form) or open Profile → Delete account while signed in on the website or Android app. Deletion removes your login identity and associated personal data. We may retain certain records where required by law or for legitimate business purposes (for example, anonymised payment audit trails). You may also email support@plugyangu.co.ke with the subject “Account deletion”.

9. Children

Plug-Yangu is not directed at children under 18. We do not knowingly collect personal data from minors. Contact us if you believe a minor has registered an account.

10. International transfers

Our primary operations are in Kenya. Some processors (for example Google or Agora) may process data in other countries. We require appropriate safeguards where applicable.

11. Changes

We may update this policy from time to time. Material changes will be posted on this page with an updated date. Continued use after changes means you accept the revised policy.

12. Contact

Questions about privacy: support@plugyangu.co.ke
General support: Contact us