Privacy Policy

1. Who We Are (Data Controller)

Kenyan.menu is the data controller for personal information collected through this platform. We are responsible for how your personal data is collected, stored, used, and protected, in accordance with the Kenya Data Protection Act No. 24 of 2019.

2. What Data We Collect

We collect the following categories of personal data:

From Business Owners (Registered Users)

• Restaurant Name — used as your unique identifier and public menu URL slug
• Email Address — used for account recovery, password resets, and critical platform notifications
• Location — the city or area your business operates in
• Password — stored securely
• Brand colour preference — used to theme your public menu page
• Menu content — food categories, item names, prices, descriptions, and images you upload
• Payment reference messages — M-PESA transaction codes you submit for subscription verification

From Menu Viewers (Public Customers)

• We do not require registration or collect personal data from members of the public who view menus
• Standard server logs (IP address, browser type, pages accessed) may be recorded automatically by our hosting infrastructure for security and performance monitoring

3. Legal Basis for Processing

Under the Kenya Data Protection Act 2019, we process your data on the following lawful bases:

• Performance of a contract — to provide you with the digital menu service you signed up for
• Consent — when you voluntarily provide information during registration and agree to these terms
• Legitimate interests — to maintain platform security, prevent fraud, and improve the service

4. How We Use Your Data

Your data is used solely to:

• Create and manage your account and public menu
• Verify your subscription payment and activate your menu
• Generate your unique QR code and shareable menu link
• Communicate with you regarding your account or subscription
• Maintain the security and integrity of the platform

We do not sell, rent, or share your personal data with third parties for marketing purposes.

5. Data Storage and Security

Your data is stored on secured servers. Passwords are hashed and never stored in plain text. We implement reasonable technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. If you close your account, we will delete or anonymise your personal data within a reasonable period, unless retention is required by law or for legitimate business purposes such as resolving disputes or fraud prevention.

7. Your Rights (Data Subject Rights)

Under the Kenya Data Protection Act 2019 (Sections 26–34), you have the following rights:

• Right of Access — request a copy of the personal data we hold about you
• Right to Rectification — request correction of inaccurate or incomplete data
• Right to Erasure — request deletion of your data where there is no lawful basis for continued processing
• Right to Object — object to processing of your data in certain circumstances
• Right to Data Portability — receive your data in a structured, commonly used format
• Right to Withdraw Consent — where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, contact us at kenyamenu8@gmail.com. We will respond within 21 days as required by law.

8. Cookies and Local Storage

We use browser localStorage (not cookies) to store your authentication session and theme preference locally on your device. No personal data stored in localStorage is transmitted to third parties. You can clear this data at any time by clearing your browser storage.

9. Third-Party Services

Our payment verification is conducted manually via M-PESA. We do not directly integrate with or transmit your M-PESA data to Safaricom. You submit a transaction code to us as confirmation. Images uploaded to the platform may be stored via our backend hosting service. We use the Resend API to securely deliver essential transactional emails (e.g., password reset links). We use only reputable infrastructure providers.

10. Children's Privacy

The Service is intended for business owners who are at least 18 years of age. We do not knowingly collect personal data from individuals under 18. If you believe a minor has submitted personal data to us, please contact us immediately.

11. Complaints

If you believe we have not handled your personal data in accordance with the Kenya Data Protection Act 2019, you have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya (ODPC) at www.odpc.go.ke.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via your registered contact details. The date at the top of this page indicates when the policy was last revised.