Privacy policy
Version 2026-10
Makao (operated by Dennis Muthui) runs Makao, a marketplace where hosts list places to stay in Nairobi and guests book them. We are the data controller for the personal data described here, and we handle it under Kenya's Data Protection Act, 2019.
What we collect and why
| Data | Why we need it | Legal basis |
|---|---|---|
| Name, email, M-Pesa phone number, password (stored only as a one-way hash) | Create your account, take payments, send refunds and host payouts, contact you about a booking | Contract |
| Bookings, M-Pesa payment details (phone number, amount, receipt number), refunds and payouts | Run bookings, keep financial records, resolve disputes | Contract; legal obligation |
| Listing details, photos, addresses and reviews you post | Show your place or your review to other users | Contract |
| Hosts only: ID or passport number and a photo of the document | Verify identity to protect guests and show a Verified host badge. The photo is deleted after review and the number is masked to its last four digits | Your consent, which you can withdraw by asking us to remove the badge |
| Technical data: IP address in server logs, a session cookie | Keep you logged in, prevent fraud and abuse, limit repeated login attempts | Legitimate interest |
We do not sell your data. We do not use advertising or analytics trackers.
Who sees your data
- Hosts and guests see each other's name and phone number, and the guest sees the exact address, only after a booking is paid.
- Safaricom (M-Pesa) processes payments. We never see your M-Pesa PIN.
- Our hosting and network providers store and deliver the service for us.
- Your browser contacts other services when pages load: Google Fonts (fonts), OpenStreetMap (map tiles) and jsDelivr and unpkg (open-source scripts for the date picker and map). They receive your IP address and browser details under their own policies.
- Authorities, where the law requires us to share information.
Our servers are hosted with Contabo and may be outside Kenya. Where data is transferred out of Kenya we do so in line with the Data Protection Act.
How long we keep it
- Account details: until you delete your account.
- Host ID photo: deleted once our team has reviewed it.
- Booking, payment, refund and payout records: 7 years, because the law requires us to keep financial records. After you delete your account these records stay but no longer carry your name, email or phone number.
- Audit log of admin actions: 7 years. It holds user numbers, not personal details.
- Server logs: kept for a short period for security and then discarded.
Your rights
You can ask to see your data, correct it, delete it, object to how we use it, or move it elsewhere. You can do most of this yourself on your Account page: download all your data as a file, edit your details, or delete your account. For anything else, email [email protected] or call 0729437395. We reply within 30 days.
If you're unhappy with how we handled your data, you can complain to the Office of the Data Protection Commissioner (odpc.go.ke).
How we protect it
Passwords are hashed. Connections use HTTPS. Forms are protected against forgery. Repeated failed logins are blocked. Host ID photos can only be opened by authorised staff, and each time they do it is logged. If a breach affects your data, we will tell you and the Data Protection Commissioner within the time the law sets.
Cookies
We use one cookie that keeps you logged in and protects forms. It is essential, so there is no cookie banner. We use no advertising or analytics cookies.
Children
Makao is for people aged 18 and over. We don't knowingly collect data about children.
Changes and contact
If we change this policy in a way that matters, we'll tell you in the app. Questions: [email protected].