This Privacy Policy explains what personal data muvevi.com collects, why it is collected, how it is used, how long it is kept, and the rights you have over it. Joseph Muvevi is committed to handling your data lawfully, transparently, and with respect for your privacy.
01. Who We Are and Who This Policy Covers
- —"Muvevi", "I", "me", or "my" refers to Joseph Muvevi, a sole proprietor trading as Muvevi, based in Nairobi, Kenya. Contact: hello@muvevi.com.
- —This policy applies to all individuals who visit muvevi.com, submit a contact or inquiry form, purchase a digital product from the Muvevi Marketplace, or engage Muvevi for professional services.
- —Muvevi is committed to handling personal data responsibly and in compliance with the Kenya Data Protection Act, 2019 (DPA 2019). For visitors from the European Union or United Kingdom, Muvevi also applies the core principles of the General Data Protection Regulation (GDPR) where practicable.
02. What Personal Data We Collect and Why
- —Contact form submissions: name, email address, and message content. Used solely to respond to your inquiry and not added to any marketing list without your explicit consent.
- —Marketplace purchases: name, email address, billing country, and payment confirmation reference. Used to fulfil your order, send receipts, verify licence entitlement, and handle refund requests.
- —Professional service engagements: name, email, company name (if applicable), and project details shared during scoping. Used to manage the engagement, issue proposals and invoices, and deliver the agreed work.
- —Payment data: card details are never processed or stored by Muvevi — they are handled entirely by third-party payment processors (see Section 6). For bank transfers and M-Pesa payments, only the transaction reference number and confirmation record are retained.
- —Website analytics: aggregated page view counts, referral sources, approximate geographic region (country level), browser type, and device category, collected in anonymous, non-identifiable form. Used only to understand which content is valuable and to improve the site.
- —Muvevi collects no personal data from visitors who simply browse the site without submitting a form or making a purchase.
03. Legal Basis for Processing
- —Contract performance: processing your order, delivering Services, and fulfilling contractual obligations arising from your purchase or engagement.
- —Legitimate interests: maintaining analytics to understand site performance; protecting Muvevi against fraudulent transactions and chargebacks; enforcing the Terms of Service.
- —Legal obligation: retaining financial records to comply with Kenya's Tax Procedures Act, 2015, and other applicable financial record-keeping requirements.
- —Consent: sending marketing or newsletter communications, where you have explicitly opted in. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.
04. How Long We Keep Your Data
- —Contact form submissions: retained for 12 months from the date of submission, or until you request deletion — whichever comes first.
- —Purchase records and invoices: retained for 7 years to comply with financial and tax record-keeping obligations under Kenyan law.
- —Service engagement records (proposals, contracts, project correspondence): retained for 5 years after the engagement closes, to support resolution of any legal or contractual dispute.
- —Analytics data: stored in aggregate form only, not linked to any individual, and retained indefinitely as statistical data.
- —At the end of any applicable retention period, data is securely deleted or irreversibly anonymised.
05. Cookies and Tracking Technologies
- —Muvevi does not use advertising cookies, social media tracking pixels, or any cross-site tracking technologies.
- —A minimal functional cookie may be set for security purposes (e.g. CSRF protection on contact forms). This cookie does not track you across other websites.
- —Where analytics are used, they operate in a cookieless or privacy-preserving mode and do not create persistent identifiers linked to individual users.
- —You may disable cookies in your browser settings at any time without affecting your ability to browse the site. Disabling cookies may limit the functionality of interactive forms.
06. Third-Party Services and Data Sharing
- —Card payment processors (e.g. Stripe): when you pay by card, your payment details are processed directly by the card processor. Muvevi receives only a transaction confirmation reference. Card processors are PCI-DSS compliant and subject to their own privacy policies.
- —PayPal: when you pay via PayPal, the transaction is processed directly by PayPal Inc. Muvevi receives only a transaction confirmation. PayPal's privacy policy governs their handling of your data.
- —M-Pesa (Safaricom): mobile money transactions are processed via the Safaricom M-Pesa network. Muvevi receives only a transaction confirmation reference and has no access to your M-Pesa account or personal information held by Safaricom.
- —Vercel: muvevi.com is hosted on Vercel's infrastructure. Vercel processes server request logs (IP address, timestamp, URL) as part of standard hosting operations, subject to Vercel's Data Processing Agreement.
- —Transactional email provider (e.g. Resend): used to send order receipts and service-related emails. Only your email address and the minimum information needed to generate the email (e.g. product name, order reference) are shared.
- —Muvevi does not sell, rent, or share your personal data with any third party for marketing, advertising, or profiling purposes.
- —Muvevi will disclose your data if required to do so by law, court order, or a valid request from a competent authority, and will notify you to the extent permitted by law.
07. International Data Transfers
- —Muvevi is based in Kenya. Some third-party providers (e.g. Vercel, Stripe, Resend) operate servers in the United States or the European Union. Where your data is transferred outside Kenya, Muvevi takes reasonable steps to ensure it is protected to a standard at least equivalent to that required under the Kenya DPA 2019.
- —For EU or UK residents, transfers to third countries are made subject to appropriate safeguards, including Standard Contractual Clauses (SCCs) adopted by the relevant authority, where applicable.
08. Data Security
- —All data transmitted between your browser and muvevi.com is encrypted via HTTPS/TLS.
- —Application databases are accessible only via least-privilege credentials and are not publicly exposed.
- —Muvevi never stores raw card numbers, CVV codes, or M-Pesa PINs.
- —While Muvevi applies reasonable and industry-standard security measures, no method of transmission over the internet or electronic storage is completely secure. In the event of a personal data breach likely to result in high risk to your rights and freedoms, Muvevi will notify you without undue delay as required by applicable law.
09. Your Rights
- —Right of access: you may request a copy of the personal data Muvevi holds about you.
- —Right to rectification: you may request correction of inaccurate or incomplete personal data.
- —Right to erasure: you may request deletion of your data, subject to legal retention obligations (e.g. financial records required to be kept for 7 years).
- —Right to restrict processing: you may request that Muvevi limits how your data is used in certain circumstances.
- —Right to data portability: you may request that data you have provided be supplied in a structured, commonly used, machine-readable format.
- —Right to object: you may object to processing carried out on the basis of legitimate interests, including any direct marketing.
- —Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
- —To exercise any of these rights, email hello@muvevi.com with the subject line 'Data Rights Request'. Muvevi will respond within 30 days. If you are dissatisfied, you have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya (ODPC) or, for EU/UK residents, with your local supervisory authority.
10. Children's Privacy
The Website and its products are intended for users aged 18 and over. Muvevi does not knowingly collect personal data from anyone under 18. If you believe a minor has submitted personal data, please contact hello@muvevi.com and the data will be deleted promptly.
11. Links to Other Websites
The Website may contain links to third-party websites (e.g. GitHub, social media profiles, payment portals). Muvevi is not responsible for the privacy practices of those websites. This policy applies solely to data collected on muvevi.com.
12. Changes to This Policy
This policy may be updated to reflect changes in data practices, applicable law, or the services offered. The 'Last updated' date at the top of this page will change when updates are made. For material changes, Muvevi will post a notice on the Website. Continued use of the Website after an update constitutes acceptance of the revised policy.
Questions about this policy? Email hello@muvevi.com and we'll respond within 2 business days.