Privacy Policy

1. Who we are

WingMan (wingman.co.ke and the WingMan WhatsApp number) is a service of Mafichoni Limited, Nairobi, Kenya ("WingMan", "we", "us"). WingMan connects clients with verified barbers, salonists, massage therapists, nail technicians and makeup artists, and holds payments in M-Pesa escrow until a job is done.

We are the data controller for the personal data described here, under Kenya's Data Protection Act, 2019 and its regulations. This policy covers the website, the WingMan WhatsApp chat and our API.

2. What we collect

From everyone

• Phone number and WhatsApp profile name, when you message us or sign in. We use your number as your account.
• Messages you send us on WhatsApp or the website, including voice notes and their transcripts.
• Location: the area you type, or GPS coordinates if you choose to share your location, so we can find providers nearby.
• Bookings: the service you asked for, date, time, place, price, status, and messages about the job.
• Payments: M-Pesa phone number, amounts, M-Pesa receipt numbers and payment status. We never see your M-Pesa PIN.
• Ratings and reviews you give and receive.
• Safety information: SOS alerts you trigger and, if you give it, an emergency contact's phone number.
• Technical data: IP address, browser type and request logs kept by our servers to run and secure the service.

Additionally from providers

• Your name, trade, specialties, prices, service area, whether you do home visits, years of experience and a profile photo.
• The name registered to your M-Pesa number, from the KSh 1 verification payment. We compare it with the name on your profile.
• A SIM-swap check on your number (a yes/no answer about a recent SIM swap) from our telecom partner.
• Your availability, response times, completed and cancelled jobs, endorsements from other providers and earnings.

3. How we use it and why

• To provide the service: understand your request (including voice notes), match you with providers, send booking updates, run escrow and pay providers. Legal basis: performance of our contract with you.
• To verify providers and prevent fraud: M-Pesa name matching, SIM-swap checks, unusual-booking checks and trust scores. Legal basis: our legitimate interest in a safe marketplace, and your consent where required.
• To keep people safe: when you send SOS (9), we alert your emergency contact and our team with the job details. Legal basis: your vital interests and your consent.
• To send service messages on WhatsApp: login codes, booking confirmations, reminders, payment updates, a weekly summary for providers and an occasional "book again?" reminder for clients. Tell us (section 14) if you'd like to stop the optional reminders. Legal basis: contract; legitimate interest for reminders.
• To resolve disputes and keep financial records. Legal basis: legal obligation and legitimate interest.
• To improve WingMan, using aggregated or de-identified data where we can. Legal basis: legitimate interest.

We don't sell personal data, we don't use it for advertising, and we don't use your messages to train third-party AI models.

4. What other people can see

• Provider profiles are public at wingman.co.ke/p/…: name, photo, trade, specialties, prices, general area (never your exact address), trust score and its breakdown, M-Pesa-verified badge, ratings and reviews. They can appear in search engines and be shared on WhatsApp.
• When a provider accepts a booking, we share the client's name, phone number, and the time and place of the job with that provider, so they can do the job.
• Clients' details are never public. Ratings on a provider's profile show the stars, comment and date, never the client's name or number.

5. Who we share it with

We share personal data only with service providers that help us run WingMan, under contracts that require them to protect it and use it only on our instructions:

• Meta Platforms (WhatsApp Business Platform): to send and receive WhatsApp messages.
• Safaricom PLC (M-Pesa): payments, escrow payouts, refunds and payer-name verification.
• Africa's Talking: SIM-swap checks for providers.
• Hetzner Online: servers that host our API and database.
• Cloudflare: storage and delivery of photos and voice notes, DNS and network security.
• RunPod: GPU servers that run our speech-to-text and language models on your voice notes and requests.
• Vercel: hosting of the wingman.co.ke website.

We may also disclose data if the law requires it, to the police or emergency services when someone's safety is at risk, or to a buyer if our business is sold (with this policy still applying).

6. Data outside Kenya

Some of these providers process data outside Kenya, including in the European Union (our servers in Germany) and the United States. Where we transfer data abroad, we do so as the Data Protection Act allows: to countries or providers with appropriate safeguards, such as contractual data-protection commitments, and only as needed to run the service.

7. How long we keep it

• Account and profile data: while your account is active, then up to 24 months after your last activity, unless you ask us to delete it sooner.
• Payment and escrow records: at least 5 years, as Kenyan tax law requires.
• Booking history, ratings and SOS records: up to 24 months after the job, longer if a dispute or legal claim is open.
• Login codes expire after 5 minutes. Server logs are kept for a short period for security and troubleshooting.

When data is no longer needed, we delete or anonymise it.

8. How we protect it

All traffic to WingMan is encrypted (HTTPS). Our database is not reachable from the internet, access is limited to the people who need it, payment callbacks are verified with M-Pesa before any money moves, and login codes are stored only as a one-way hash. No system is perfectly secure. If a breach puts you at risk, we will tell you and the Office of the Data Protection Commissioner as the law requires.

9. Trust scores, matching and fraud checks

WingMan uses automated processing. A provider's trust score (0-100) is calculated from M-Pesa verification, ratings, completed jobs, response time, the SIM-swap check, endorsements and time on WingMan. Our matching ranks providers by skill, distance, trust score, availability and price, and an AI model reads voice notes and requests to understand them. A fraud check may ask for an extra confirmation on unusual bookings. It never blocks you on its own.

Providers can see their full score breakdown on their dashboard. If you think an automated result is wrong, contact us and a person will review it. Disputes about payments are always decided by a person.

10. Your rights

Under the Data Protection Act, 2019 you have the right to:

• be told how your data is used (this policy);
• access the personal data we hold about you;
• correct data that is wrong or incomplete;
• delete data we no longer need, or that you withdraw consent for, unless we must keep it by law;
• object to processing based on our legitimate interests, and to direct marketing;
• withdraw consent at any time, without affecting what happened before;
• data portability: get your data in a common, machine-readable format;
• not be subject to a decision based solely on automated processing that significantly affects you.

To use any of these rights, contact us (section 14). We may ask you to confirm the request from the phone number on your account. We answer within the time the law allows. If you're not satisfied, you can complain to the Office of the Data Protection Commissioner (odpc.go.ke).

11. Children

WingMan is for people aged 18 and over. Providers must be 18 or older. A parent or guardian may book a service for a child, but children shouldn't create accounts. If you believe a child has given us personal data, contact us and we will delete it.

12. Cookies and browser storage

The website doesn't use advertising or tracking cookies. When you sign in, your session token is kept in your browser's local storage so you stay signed in. Signing out removes it. If you allow it, your browser shares your location with us only when you tap "near me", and your microphone only while you record a voice note.

13. Changes to this policy

We may update this policy as WingMan changes. The date at the top shows the latest version. If a change significantly affects how we use your data, we'll tell you on WhatsApp or on the website before it takes effect.

14. Contact us

For privacy questions or to use your rights, contact Mafichoni Limited, Nairobi, Kenya:

• WhatsApp: send PRIVACY to WingMan (@wingman.co.ke)

See also: wingman.co.ke