Introduction
Nyumba Yanga ("the App", "we") is a household management application used by families in Malawi, Kenya and Zambia. This Privacy Policy explains what personal information we hold, why we hold it, who it is shared with, how long it is kept, and the rights you have over it.
We process personal data in accordance with Kenya's Data Protection Act, 2019 and the regulations made under it, Malawi's Data Protection Act, 2024, and the data protection law of any other country the App is offered in. Where this policy and the law differ, the law applies.
Who Is Responsible for Your Data
Nyumba Yanga is the data controller for the information you give us to run your account: your name, phone number or email address, city, country, subscription and payment records, and the messages you send to our support and WhatsApp services.
For the records a household keeps inside the App — its members, employees, children, spending, shopping and household routines — the household that enters them is the controller and decides what is recorded and who may see it. Nyumba Yanga stores and processes those records on the household's behalf, and this policy describes how.
Information We Collect
The App holds the following information when you or your household choose to enter it:
- Account data: household name, your name, phone number or email address, city and country, invite codes, and the access level of each household member.
- Employee records: the name, job, start date, pay, benefits, attendance, leave, loans and advances, payslips, tasks, warnings and references of domestic employees the household employs. A household may also record an employee's phone number, national ID number, date of birth, next of kin, bank or mobile money details for salary payment, qualifications, and medical notes relevant to the job.
- Children's details: the names, dates of birth, schools, timetables and activities of children in the household, entered by a parent or guardian so that the household and its employees can look after them.
- Health and care information: health profiles, medications, vaccination records and medical contacts a household chooses to keep for its members.
- Financial data: expenses, budgets, bills, savings goals, school fees, income and payroll records, and the mobile money or bank details used to pay employees.
- Home data: shopping lists, meals, storeroom stock, meter readings, vehicles, maintenance and household routines.
- Price data: store names, item prices and receipts you scan.
- Technical data: the device type and app version, crash reports, and the times the App connects to our servers, used to keep the App working and secure.
Employee photographs and photographs of identity documents stay on the phone they were taken with. They are not uploaded to our servers.
Why We Use Your Information and On What Basis
- To provide the service you signed up for (performance of a contract): running your household account, syncing it across your devices, producing payslips, reports and reminders, and answering your support requests.
- To meet legal obligations: keeping payroll and employment records a household is required to keep under employment law, and keeping payment records for tax and accounting.
- In our legitimate interests, where these do not override your rights: keeping the App secure, preventing fraud and abuse, fixing faults, and understanding how the App is used in aggregate so we can improve it.
- With your consent, which you can withdraw at any time: optional features such as publishing an employee reference to the Employee Board, sending you marketing messages, and any processing of health information or children's details that is not needed to run the household account.
We do not sell personal information, and we do not use it to make automated decisions that have a legal or similarly significant effect on you.
Employees: Your Rights When Your Employer Uses the App
If your employer keeps your employment record in Nyumba Yanga, you are a data subject and you have rights over that record even though you did not enter it. In particular:
- Your employer must tell you that your record is kept in the App and what it is used for. The Employee Portal shows you your own record, pay, leave, warnings and tasks so that you can see what is held about you.
- Your employer may only share a reference about you on the Employee Board with your agreement. You can see exactly what would be shared, and you can withdraw your agreement at any time from the Portal. Only you can withdraw it.
- You may ask your employer to correct anything that is wrong, and you may contact us directly at the address below if you believe your record is being held or used unlawfully.
Where Your Data Is Stored and Who Can See It
Your data is stored in a database hosted by our cloud provider, with most features also working offline on your own phone until a connection is available. Data in transit is encrypted, access to our servers is restricted to the people who operate the App, and changes made to household records are logged so that they can be traced.
Within your household, members you invite can see the household data that their access level allows. Employees signed in to the Employee Portal can see only their own record and the tasks, requests and items their employer has made available to them.
Service Providers and International Transfers
We use a small number of service providers to run the App. Each one acts on our instructions under a written agreement, and receives only what it needs for its task:
- Hosting and database — stores your account and household data.
- OpenAI — powers optional AI features such as the Thandizo assistant, recipe suggestions, receipt scanning and support replies. Only the information needed to answer your request is sent, and only when you use one of these features. OpenAI does not use it to train its models.
- Meta (WhatsApp Business) — delivers the WhatsApp assistant and WhatsApp notifications you have opted in to.
- Africa's Talking — sends SMS messages such as one-time codes and reminders.
- Resend — sends email such as sign-in codes and receipts.
- Expo — delivers push notifications to your phone.
- Sentry — receives crash reports so we can fix faults. Crash reports from the App are stored in the European Union.
- PayChangu and mobile money providers — process subscription payments and salary payouts you ask the App to make. They receive the payment details needed to complete the transaction.
- Google — verifies that the Android app is genuine (Play Integrity). No household data is sent for this.
Some of these providers process data outside Kenya and Malawi, including in the United States and the European Union. Where personal data leaves the country it was collected in, we rely on written contractual safeguards with the provider that commit it to protecting the data to a standard equivalent to the law that applies to you, and we transfer only what the service needs. You may ask us for details of these safeguards.
We also share personal data when the law requires it, to protect the safety of a person, or to establish or defend legal claims.
How Long We Keep Your Data
- Household and account data is kept for as long as your household account is active.
- When you delete your account from the App's Settings screen, all of your household's data — members, employees, children, finances and everything else — is removed from our live systems straight away, and your sign-in is revoked. Copies in routine backups expire on the backup cycle that follows.
- Payroll and payment records that a household or we are required to keep by law may be retained for the period the law requires, and no longer.
- Support conversations and crash reports are kept only as long as needed to resolve the issue and improve the App.
Children's Privacy
The App is made for adults who run a household and for the adults they employ. We do not knowingly allow children under 18 to open an account or sign in to the Employee Portal.
Parents and guardians may record their own children's details in the App so that the household can care for them. Those details are visible only to the household members and employees the parent allows, are never published or shared outside the household, and are deleted with the household account. If you believe a child's information has been entered by someone without the right to do so, contact us and we will remove it.
Your Rights
Under the Data Protection Act, 2019 (Kenya), the Data Protection Act, 2024 (Malawi) and similar laws, you have the right to:
- be told how your personal data is used, which this policy does;
- access the personal data we hold about you, and receive a copy of it;
- have inaccurate or incomplete data corrected;
- have your data deleted, which you can do yourself from Settings or by asking us;
- object to processing, including any marketing, and to restrict processing while a dispute is resolved;
- withdraw consent at any time for anything that relies on it, without affecting what was done before;
- receive your data in a portable form — the App's export tools do this for household data;
- not be subject to a decision based solely on automated processing that significantly affects you.
To exercise any of these rights, email support@nyumbayanga.app. We will respond within the time the law allows, and we will not charge you unless the law permits it. We may ask you to confirm your identity first so that we do not hand your data to someone else.
If you are not satisfied with our response, you may complain to your data protection authority:
- Kenya: the Office of the Data Protection Commissioner (ODPC), www.odpc.go.ke.
- Malawi: the Malawi Communications Regulatory Authority (MACRA), the data protection authority under the Data Protection Act, 2024, www.macra.mw.
Security and Data Breaches
We protect your data with encryption in transit, access controls, logging and regular review of the App's code. No system is perfectly secure. If a breach occurs that puts your rights at real risk, we will notify the relevant data protection authority and the people affected within the time the law requires, and tell you what happened and what we are doing about it.
Changes to This Policy
We may update this Privacy Policy from time to time. We will post the new version in the App and on our website, with the date it took effect, and we will tell you directly about any change that materially affects how your data is used.
Contact Us
If you have any questions about this Privacy Policy or about how your data is handled, please contact us at:
Privacy & Support: support@nyumbayanga.app
General Enquiries: hello@nyumbayanga.app
Website: https://nyumbayanga.app