MAANTA APP ("MAANTA", "we", "us") Last updated: 31 July 2026 (DRAFT)
1. Who we are
MAANTA operates a platform that shows deals published by shops inside shopping malls, lets shoppers claim a deal and receive a one-time code, and lets shop staff verify that code at the counter.
MAANTA APP is the data controller for the personal data described in this policy.
Registered address: None yet — MAANTA APP is not incorporated. A registered address is confirmed at incorporation. Correspondence: Nairobi, Kenya Contact for privacy matters: admin@maanta.app ODPC registration: ODPC-DEMO-0000-NOT-REGISTEREDPlaceholder
2. What this policy covers
This policy covers personal data we handle for:
- Shoppers who browse, claim and redeem deals
- Merchants — shop owners and the staff they add to an account
- Mall operators and their representatives
- People who join our waitlist or contact us
- Visitors to maanta.app
It does not cover what a shop does with information you give it directly at its counter. When you buy something in a shop, that transaction is between you and the shop.
3. What we collect
If you are a shopper
- Your phone number. Required when you claim your first deal. Your phone number is your account — we do not ask for a password or an email address.
- Deals you claim and redeem, including the code issued, which shop it was for, and when it was claimed, verified, rejected or expired.
- Favourites and preferences you set.
- Approximate location, if you allow it, so we can show deals near you and distances in metres. You can refuse this and still use MAANTA.
- Notification preferences, and a push subscription token if you turn on notifications.
You can browse deals without an account. We do not require a phone number to look.
If you are a merchant or shop staff
- Shop details — name, category, and location within the mall, including a what3words address used to place your shop precisely on the map.
- Contact details — name and phone number for the account owner and each staff member added.
- Account activity — deals published, codes verified or rejected, wallet top-ups and fee deductions.
- Payment details processed by our payment providers (see section 6). We do not store full card numbers.
If you are a mall operator
Name, role, organisation and contact details you give us, plus records of our correspondence.
Everyone
- Technical data — IP address, device and browser type, and pages viewed, used to run the service, keep it secure, and understand how it is used.
- Error reports when something breaks.
- Anything you send us by form, email or WhatsApp.
4. Why we use it, and our lawful basis
| What we do | Why | Lawful basis |
|---|---|---|
| Issue and verify redemption codes | To run the core service | Performance of a contract |
| Tie a code to one person and prevent reuse | To stop fraud against shops | Legitimate interest |
| Charge merchants the success fee and run wallets | To bill for the service | Performance of a contract |
| Send service messages — code issued, deal expiring, low balance | To operate your account | Performance of a contract |
| Send marketing and launch updates | Only where you agreed | Consent |
| Show deals near you | To make the feed useful | Consent (location) |
| Understand product usage | To improve the service | Legitimate interest |
| Keep records of redemptions | To resolve disputes and meet tax and accounting duties | Legal obligation / legitimate interest |
You can withdraw consent at any time. Withdrawing consent for marketing does not affect service messages about a deal you have claimed.
If you joined our waitlist, the launch updates you agreed to may reach you by email, WhatsApp or SMS, using the address and number you gave us. Today we send them by email only; if we add WhatsApp or SMS, every message will still carry a way to stop.
5. Ranking and automated processing
Deals are ordered using verified redemptions, distance, and how soon a deal expires. This affects what you see in the feed. It does not produce legal or similarly significant effects about you, and we do not use it to profile you for any decision about you personally.
6. Who we share it with
We do not sell personal data. We do not share it with advertisers or data brokers.
With shops, when you redeem: a shop sees that a valid code was presented and which deal it relates to. Shops do not receive your phone number or your browsing history through MAANTA.
With mall operators: aggregated, shop-level and mall-level reporting only. Mall operators do not receive information identifying individual shoppers.
With service providers who process data on our instructions:
| Provider | Purpose | Where |
|---|---|---|
| Vercel | Hosting and delivery of the website and app | United States |
| Supabase | Database and file storage | the EU (Ireland) |
| Clerk | Account authentication | to be confirmed with engineering |
| IntaSend | M-Pesa payments and wallet top-ups | Kenya |
| Stripe | Card payments | United States / global |
| PostHog | Product analytics | European Union |
| Sentry | Error monitoring | to be confirmed with engineering |
| Resend | Transactional and notification email | the United States |
| what3words | Converting a shop's location into a precise address | United Kingdom |
With authorities, where we are required by law to do so.
7. Cookies and similar technologies
We use:
- Strictly necessary cookies to keep you signed in and to keep the service secure. These cannot be turned off.
- Analytics to understand how the product is used.
We do not place analytics identifiers on your device before you sign in. Analytics for anonymous visitors runs in memory only and is discarded when you close the tab, so there is no analytics cookie to consent to or withdraw. Session cookies needed to keep you signed in are strictly necessary and are described in the Cookie & Tracking Notice.
Full detail is in our Cookie Notice.
8. How long we keep it
| Data | Retention |
|---|---|
| Shopper account and phone number | While your account is active, then for as long as your account is open. If you close it, or if you do not use MAANTA for 24 months, we delete or anonymise your account data within 6 months after you close it |
| Redemption records | for 7 years. Redemptions are financial records — they evidence a fee charged to a merchant — and Kenyan tax and accounting rules require us to keep them — needed for dispute resolution, merchant billing, tax and accounting |
| Merchant account and wallet records | For the life of the account, then as required by tax and accounting law |
| Analytics | for 24 months, after which it is deleted or aggregated so it no longer identifies anyone |
| Contact and waitlist messages | for 24 months after we last replied to you, so we have the history if you get back in touch |
| Waitlist signup details | for 24 months from the day you joined, or until you ask us to remove you — whichever comes first. Your signup is held in two places: our email platform, which sends you the launch updates you agreed to, and our own database, which is what lets us count and organise the list. A request to be removed clears both |
| Merchant interest form (shop name, your name, phone number, mall, floor and unit, what you sell, counter size, the consent wording you ticked) | for 24 months from the day you registered interest, or until you ask us to remove you — whichever comes first. Held in our own database only; nothing from this form goes to our email platform |
9. Your rights
Under the Data Protection Act, 2019 you have the right to be informed how your data is used, to access it, to have it corrected, to have it erased, to object to processing, and to data portability.
How long we take:
- Access requests — within 7 days.
- Corrections — within 14 days. If we refuse, we will tell you within 7 days and give our reasons in writing.
- Erasure — within 14 days. Where the same information is held in more than one place — a waitlist signup, for example, sits both in our email platform and in our own database — erasure means all of them, not whichever one you contacted us about.
To exercise any of these, email admin@maanta.app from the phone number or address on your account, or write to us at the address above. We may ask you to confirm your identity. We do not charge for this.
Some data we cannot delete on request. Records of verified redemptions are needed to bill merchants correctly, settle disputes and meet tax obligations. Where that applies we will tell you which records we are keeping and why.
10. Complaints
If you are unhappy with how we have handled your data, contact us first at admin@maanta.app. You also have the right to complain to the Office of the Data Protection Commissioner, whose contact details are at odpc.go.ke.
11. Security
We use encryption in transit, access controls, and separate accounts for each member of shop staff so that activity can be attributed to a person. Redemption codes are single-use and time-limited.
If a personal data breach occurs that presents a risk to you, we will notify the Data Commissioner within 72 hours of becoming aware of it, and we will tell affected people where the law requires it.
We will never ask you for a password, a card PIN or an M-Pesa PIN. Anyone who does is not us.
12. Data processed outside Kenya
Some of our providers process data outside Kenya, including in the United States and the European Union, as set out in section 6. Our primary database is hosted in the EU (Ireland) and our analytics in the EU. Some processors are outside Kenya — notably our email provider, in the United States. Where personal data leaves Kenya we rely on appropriate safeguards under section 48 of the Act, in the form of contractual data protection terms with each processor, and we transfer only what the processor needs to provide its service and take steps to ensure it remains protected to the standard required by the Act.
13. Children
MAANTA is not intended for children under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, contact admin@maanta.app and we will delete it.
14. Changes to this policy
If we change this policy we will update the date at the top. If a change materially affects your rights, we will tell you directly.
15. Contact
MAANTA APP Nairobi, Kenya admin@maanta.app