Pongezi Privacy Notice
Effective date: 21 October 2026. Updated 28 October 2026: hosts' email addresses, and email delivery by Resend.
Who we are. Pongezi is operated by Mafichoni Limited, a company registered in Kenya, of Nairobi, Kenya. We are the data controller for the data described here, jointly with the Host for their guests' data (see the Host Agreement). Mafichoni Limited's registration with the Office of the Data Protection Commissioner (ODPC) as a data controller and processor is in progress. Contact for privacy matters: info@mafichoni.co.ke.
What we collect
| From | Data | Why |
|---|---|---|
| Guests who leave a wish | Name, message, time posted; a scrambled (hashed) version of your internet address; only if you choose to give it, an email address or phone number | To show your wish on the page; to stop spam (the scrambled address can't be turned back into your address); so the Host can thank you |
| Guests who contribute | Name, M-Pesa phone number, amount, M-Pesa receipt, optional message | To process your payment, to show your wish with a Supporter badge, and so the Host can thank you |
| Hosts | Name, ID name for verification, phone, email address, payout M-Pesa number, event details, photos | To build the page, verify payouts and pay you; to email you your receipt, payout notices, reminders and password-reset links (never your password) |
Not shown publicly, ever: phone numbers, email addresses and contribution amounts.
Who can see it
- The Host sees each guest's name, phone number, amount and message in their dashboard, and the email or phone a guest chose to leave with a wish, to send thank-you notes. Hosts agree to use this only to thank guests for this event, and not to share it. A memorial page's treasurer does not see the contacts left with wishes.
- Mafichoni Limited staff, for support, payouts and fraud checks.
- Our service providers:
- Safaricom M-Pesa, through the Mafichoni Limited payment gateway (payments);
- Supabase (database; servers outside Kenya);
- Vercel (hosting; servers outside Kenya);
- Cloudflare R2 (photo storage; servers outside Kenya);
- Resend (sending our emails to hosts; servers outside Kenya).
- Authorities, only where the law requires it.
We do not sell personal data or use it for advertising.
Data stored outside Kenya
Our database and web hosting are in the United States (Supabase on Amazon Web Services, and Vercel), photos are stored by Cloudflare R2 on its global network, and emails to hosts are sent by Resend (United States and European Union). M-Pesa payment data is processed by Safaricom in Kenya. We transfer data abroad under section 48 of the Data Protection Act 2019, only to providers that are bound by data processing agreements, encrypt data in transit and at rest, and process it only on our instructions. You can ask us for details of these safeguards at the contact above.
How long we keep it
- Page content (wishes and photos): until 30 days after the page expires, unless the Host extends the page.
- Email or phone left with a wish: deleted 90 days after the event ends, or sooner if you ask the Host or us.
- Payment records: as long as tax and financial law requires (currently up to 7 years).
- Record of emails sent to a host: 12 months, or until the page is cleared if that is sooner.
Your rights
Under the Data Protection Act 2019 you can ask to access, correct or delete your data, or object to its use. Contact info@mafichoni.co.ke; we reply within 7 days. You may also complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).
Security
Your data is sent only over encrypted connections. Phone numbers, email addresses and payment details are never shown on public pages, and only the Host and authorised Mafichoni Limited staff can see them. If a breach puts your data at risk, we will tell the ODPC within 72 hours and tell you without undue delay.
Children
Pages about children are created by a parent or guardian and are hidden from search engines by default.
Changes to this notice
We will post any update here with a new effective date, and tell Hosts of material changes before they take effect.