1. Who We Are
Wingman is operated by Mafichoni Limited, a company registered in Kenya (the “Company”, “we”, “us”, or “our”). Our registered office is at Mararo Avenue, off Riara Road, Nairobi, Kenya.
Wingman is a location-based personal care matching platform that connects individuals and households (“Clients”) with verified independent personal care professionals (“Practitioners”). We are the data controller for personal data processed through our platform and website at wingman.co.ke.
2. Data We Collect
We collect the following categories of personal data from Clients and Practitioners:
- Identity data: full name, date of birth, national ID number, and profile photograph.
- Contact data: mobile phone number, email address, and sub-county or area of operation.
- Professional data (Practitioners): services offered, pricing, portfolio photographs, years of experience, and availability schedule.
- Location data: GPS coordinates used to calculate proximity between Clients and Practitioners during discovery. Location is captured with your permission and is not stored continuously.
- Booking data: service type, date and time of bookings, booking status, and Client confirmation records.
- Financial data: M-Pesa phone number for subscription and commission payments; subscription and commission payment records.
- Review data: ratings and written reviews submitted by Clients following confirmed completed bookings.
- Usage data: pages visited, features used, device type, browser, and IP address.
Location permission: Wingman requests access to your device's GPS location solely to surface nearby Practitioners or, for Practitioners, to display proximity to Clients. You may deny location permission at any time; doing so may limit discovery features. We do not track your location in the background.
3. How We Use Your Data
We use personal data for the following purposes:
- To match Clients with verified Practitioners near them based on GPS proximity, service type, and availability.
- To verify Practitioner identity and maintain the integrity of the platform.
- To facilitate the booking, confirmation, and review process between Clients and Practitioners.
- To process monthly subscription fees and per-order commissions via M-Pesa.
- To manage the Practitioner account lock system — pausing new bookings when outstanding commissions are unpaid.
- To display featured Practitioner listings to Clients on the discovery grid.
- To communicate with you about bookings, account status, and platform updates.
- To comply with our legal obligations under Kenyan law.
- To improve our platform through anonymised, aggregated usage analytics.
We do not use your data for automated decision-making or profiling that produces significant legal effects without human review.
4. Sharing Your Data
We share personal data only where necessary:
- Between Clients and Practitioners: When a booking is initiated, the Practitioner's name, profile photo, services, and general area are visible to Clients. The Client's name and booking details are shared with the Practitioner to fulfil the appointment.
- Service providers: We use Supabase (database hosting), Vercel (web hosting), and M-Pesa (payments processing). All processors are contractually bound to protect your data and may not use it for their own purposes.
- Legal obligations: We may disclose data to regulatory or law enforcement authorities if required by Kenyan law or a valid court order.
We do not sell personal data to third parties. We do not share data with advertisers.
5. Data Retention
We retain personal data for the following periods:
- Active accounts: for as long as the account remains active and in good standing.
- Booking and order records: 3 years from the date of the booking, to support dispute resolution and platform integrity reviews.
- Financial records (subscription and commission payments): 7 years, as required by the Kenya Revenue Authority.
- Review data: retained for the lifetime of the Practitioner's profile; anonymised upon account deletion.
- Inactive accounts: 2 years from last login, after which data is anonymised or deleted upon request.
6. Your Rights
Under the Kenya Data Protection Act 2019, you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Delete your data (subject to retention obligations).
- Object to processing where we rely on legitimate interests.
- Withdraw consent for any processing based solely on your consent.
- Data portability — receive your data in a machine-readable format.
To exercise any of these rights, contact us at hello@wingman.co.ke. We will respond within 21 days as required by law.
7. Cookies & Tracking
We use essential cookies to maintain your session and platform preferences. We do not use third-party advertising cookies. Analytics cookies (where used) are anonymised and can be disabled in your browser settings.
Local storage is used in the Practitioner and Client portals to maintain session state. This data does not leave your device and is cleared on logout.
8. Security
We implement industry-standard technical and organisational measures to protect your data, including TLS encryption in transit, AES-256 encryption at rest, row-level security on our database, and access controls that limit who can view account and financial data.
In the event of a data breach that is likely to result in risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner and affected individuals within 72 hours of becoming aware of the breach.
9. Children's Privacy
Wingman is intended for users aged 18 and over. We do not knowingly collect personal data from individuals under 18 for account registration. If you believe a minor has created an account without parental consent, please contact us at hello@wingman.co.ke so we can take appropriate action.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email or a prominent notice on the platform. Your continued use of Wingman after such notice constitutes acceptance of the updated policy.