Legal
Privacy Policy
Updated: 5 September 2026 · Policy 2026-09-05.1
1. Who We Are
LavingtonPost is a neighbourhood platform for Lavington, Nairobi. This notice explains what personal data we process, why we process it, who helps us operate the service, and the choices available to you under Kenya’s Data Protection Act, 2019.
2. Information We Collect
- Account and identity data: name, username, email, phone number, account type and verification status. - Neighbourhood verification data: estate or building details and information you submit for review. - Content and communications: posts, comments, reports, community activity and messages. - Location data: only when you grant device permission or attach a location to a post. - Technical and transaction data: IP address, device/app information, security logs and M-Pesa transaction references.
3. How We Use Information
- Provide and secure accounts, verification, neighbourhood content and messaging. - Moderate reports and prevent fraud, harassment and spam. - Process purchases and reconcile M-Pesa payments. - Send requested service messages and safety notifications. - Improve reliability and recommend relevant local content. We do not sell personal data.
4. Legal Grounds
Depending on the activity, processing is based on your consent, performance of the service you request, compliance with Kenyan law, or legitimate interests such as platform security and community moderation. You may withdraw consent where consent is the applicable ground.
5. Service Providers and International Processing
LavingtonPost uses service providers including Railway (backend and database hosting), Vercel (website hosting), Cloudinary (media hosting), Expo (mobile builds and push delivery), Google (sign-in and maps where enabled), Safaricom M-Pesa (payments), and Resend (service email). These providers may process data outside Kenya. We assess and apply safeguards required by Kenyan data-protection law before international transfers. Provider availability and sub-processors may change; this notice will be updated when material changes occur.
6. Sharing
We share only the data needed for providers to perform the services above, with moderators who need it to review safety or verification matters, and with authorities when required by a valid legal process. Public posts and profile fields are shown according to the visibility choices and audience rules in the product.
7. Location and Contact Privacy
The public post API withholds exact coordinates from anonymous visitors. Contact and neighbourhood details depend on your settings and the viewer’s access. Text or photos you choose to publish can still disclose personal information: check their contents before posting. You can withdraw device location permission in your phone settings.
8. Retention
Account closure and complete erasure are separate outcomes. Your account will close immediately. Your profile, posts and Baraza contributions will be removed from view in the app. Private messages, uploaded files and other remaining records will enter a deletion review. Payment and moderation records may be retained after review. This does not cancel an external subscription or issue a refund. A deletion request receives a reference and remains pending until reviewed. There is no implemented automatic 30-day purge or location-anonymization schedule. Contact dpo@lavingtonpost.com to request access, correction, erasure or an update on a request. Applicable rights and retention obligations still apply.
9. Security and Breaches
We use transport encryption, access controls, encrypted mobile credential storage, moderation logs and security monitoring appropriate to the service. No online service can guarantee absolute security. We investigate suspected breaches and notify the Office of the Data Protection Commissioner and affected people when Kenyan law requires it.
10. Your Rights
Under Kenyan data-protection law, you may have rights to be informed, access your data, correct it, request erasure, object to or restrict processing, and obtain portable data. Email dpo@lavingtonpost.com to make a request. We may need to verify your identity before acting on it. You may also complain to the Office of the Data Protection Commissioner.
11. Children
LavingtonPost is not intended for children under 18 without a parent or legal guardian’s involvement. Please contact us if you believe a child has provided personal data without appropriate permission.
12. Updates and Contact
We will post material changes to this notice and, where appropriate, notify account holders. Privacy enquiries and rights requests: dpo@lavingtonpost.com. Kenyan regulator: Office of the Data Protection Commissioner (ODPC), odpc.go.ke.
Questions about this policy?
Email our privacy team at dpo@lavingtonpost.com