Privacy notice

Who is running this

Megun Community is a civic platform for the residents of Megun Ward, Kapseret Constituency, Uasin Gishu County, Kenya.

The community body that governs the platform decides what happens to your data — it is the data controller. The software and the servers are operated on its behalf by MySpace MyVibe LLC, which acts only on the community body's instructions — it is the data processor.

Being straight with you about the current state: the community body's registration as a Community Based Organisation is still in progress, and registration with the Office of the Data Protection Commissioner has not yet been completed. Until both are done, this platform runs as a closed, invite-only preview and is not open to the general public. Your rights under the Kenya Data Protection Act, 2019 apply to you now regardless, and we honour them now.

What we collect

• Your name and the email address you sign up with.
• Your password, stored only as a salted cryptographic hash — we never hold the password itself.
• What you choose to publish: posts, comments, issues you raise, events, listings, group messages and photos.
• Your ward, and any village or area you choose to add to your profile.
• Technical records needed to keep the platform safe: sign-in times, and a one-way fingerprint of the device and network you signed in from.
• Records of moderation actions — what was taken down, by whom, and when.

What we do NOT collect

• We do not track you across other websites, and we run no third-party advertising or analytics scripts.
• We do not sell, rent or trade your personal data to anyone, for any price.
• We do not read your private group messages for advertising or profiling.
• We do not ask for your national ID number, and you should never post it.

Why we are allowed to hold it

We rely on your consent for the account you chose to open and the things you choose to publish. You can withdraw that consent at any time by deleting the content or closing your account.

We rely on the legitimate interest of the community in a safe, usable platform for the small amount of security data described above — sign-in records and abuse prevention. Without it we cannot keep impersonators and spammers out.

Who can see what you post

Anything you publish to the community — announcements, issues, market listings, events — is visible to every signed-in member of this community, and to the community team who moderate it. Treat it as public within the community.

Posts inside a group are visible to that group's members and to moderators.

Your email address is never shown to other members.

Moderators on the community team can see who wrote what, because accountability is the point of a community platform. They cannot see your password, and they cannot read your security records.

How long we keep it

• Your account data: for as long as your account is open.
• Content you delete: removed from the platform immediately, and purged from backups within 35 days as the backup cycle rolls over.
• Security and sign-in records: 12 months, then deleted.
• Moderation records: kept while the account is open, because a takedown history is what makes an appeal possible.

Where it is stored

The platform runs on servers in Germany, operated within the European Union. Your data is therefore transferred out of Kenya to be stored and processed. It is protected in transit and at rest by encryption, and access is restricted to the small number of people who operate the service.

Kenyan law allows personal data to leave Kenya where appropriate safeguards travel with it (Data Protection Act, 2019, section 48). That is the basis we rely on: the encryption and access controls described here, and hosting inside the European Union, where data-protection law (the GDPR) imposes obligations of at least the kind the Act requires. A written agreement between the community body and the operator covering this transfer is being prepared alongside the registrations described above. Like the rest of this notice, this description has not yet had formal legal review, and we say so rather than imply otherwise.

Transactional email — sign-up confirmations and password resets — is delivered through an email provider that processes only your email address, the subject and the text of that specific message.

Your rights

Under the Kenya Data Protection Act, 2019 you have the right to be told what we hold about you, to get a copy of it, to correct it if it is wrong, to have it deleted, to object to how we use it, and to complain to the Office of the Data Protection Commissioner.

You do not need to write a letter to use the first three: your profile page has a data section where you can download everything we hold about you and delete your account yourself. For anything else, write to privacy@megun.community.

We answer data requests within 30 days. There is no charge.

Keeping it safe

• All traffic is encrypted in transit. Backups are encrypted before they leave the server.
• Passwords are hashed; nobody at Megun Community or MySpace MyVibe can read yours.
• The database enforces who may read which row, so a fault in the application cannot quietly widen access.
• Uploaded images are scanned for malware and stripped of embedded location data before anyone else can see them.
• If a security breach puts your data at risk, we will tell the Office of the Data Protection Commissioner and the members affected, honestly and without unhelpful delay, as the Act requires. How we would do that is written down before it is ever needed, not improvised on the day.

Children

This platform is for adults. You must be 18 or older to open an account. If we learn that an account belongs to a child, we close it and delete the data.

Changes to this notice

If we change how we handle your data, we change this page and update the date at the top. For anything significant, we tell you in the platform as well — we will not rely on you noticing a changed date.

Contact

Data protection questions and requests: privacy@megun.community

Anything else: support@megun.community

You also have the right to complain directly to the Office of the Data Protection Commissioner of Kenya.