Privacy Policy

Information we collect

When you register, we collect your full name, phone number, and national ID number. Workers also submit a photo of their ID document for verification. When you use the platform we collect job history, ratings, and general location data (district level) to match you with nearby opportunities or workers. We do not collect precise GPS coordinates without your explicit consent.

How we use your information

We use your data to operate the platform: verifying identities, matching workers to jobs, processing MoMo payments, and displaying your rating to prospective employers or workers. We may also use aggregated, anonymised data to improve our matching algorithms and understand how the platform is used - this data cannot identify you individually.

Who we share your data with

When a job is confirmed, the employer can see the worker's name, photo, rating, and job category experience - and vice versa. Beyond this, we share data only with MTN MoMo for payment processing and, if legally required, with Rwandan law enforcement or regulatory authorities. We do not sell, rent, or trade your personal data to any third party for marketing purposes.

ID verification

Workers submit a national ID document during onboarding. This document is reviewed by our verification team and then stored in an encrypted, access-restricted environment. Only authorised MpahMapu staff can access raw ID documents, and only for the purpose of resolving disputes or meeting legal obligations. Verified status is displayed as a badge; the underlying document is never shared with employers.

MoMo and payment data

We store only the MoMo phone number associated with your account. Full transaction records are held by MTN MoMo under their own privacy policy. MpahMapu retains payment records (amount, date, job reference) for up to 7 years as required by Rwandan tax law.

Cookies and app analytics

Our web and mobile platforms use essential cookies to keep you logged in and remember your preferences. We also use privacy-respecting analytics to understand which features are used and where the platform can be improved. Analytics data is aggregated and does not identify individual users. You can disable non-essential cookies in your device or browser settings.

Data retention

Active accounts: data is retained as long as your account is open. Deleted accounts: personal data is removed within 30 days of deletion, except for transaction records (7 years, legal requirement) and data relevant to unresolved disputes. Anonymised, aggregated data may be retained indefinitely.

Your rights

Under Rwandan law and in the spirit of fair data practice, you have the right to access a copy of your personal data, correct inaccurate information, request deletion of your account and data, and object to certain processing. To exercise any of these rights, contact privacy@MpahMapu.rw or use the in-app support form. We will respond within 10 business days.

Security

We use TLS encryption for all data in transit, AES-256 encryption for sensitive data at rest, and strict access controls so that only the staff who need data to do their jobs can access it. We conduct regular internal security reviews. If a breach occurs that affects your data, we will notify you within 72 hours and report it to the Rwanda Information Society Authority (RISA) as required.

Changes to this policy

We may update this Privacy Policy to reflect changes in the law or the platform. If changes are material, we will notify you via SMS or in-app notification at least 7 days before they take effect. Continued use of MpahMapu after that date constitutes acceptance.

Contact us

For privacy questions, data requests, or to report a concern, contact our data team at privacy@MpahMapu.rw. For general queries use legal@MpahMapu.rw or the contact form on our website.