Kenya Data Protection Act, 2019

Privacy Policy

Last Updated: September 29, 2026. Effective for all users, wherever they register, under the Data Protection Act, 2019 of the Laws of Kenya.

1. Who We Are & The Law We Answer To

Mooud (the “Application”) is developed and operated by Mooud Technologies Limited, a private company limited by shares incorporated in Kenya under the Companies Act, 2015 (Company Registration Number: pending).

Your privacy is a constitutional right here: Article 31 of the Constitution of Kenya, 2010 protects the privacy of your person, your home, your property, your communications and information about your family or private affairs. The Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021 give that effect, and Mooud Technologies Limited is the Data Controller for the personal data collected, stored and processed through your use of our services.

Registration status: Section 18 of the Act requires data controllers and processors of our size and activity to register with the Office of the Data Protection Commissioner. Our registration is pending. We are telling you that rather than displaying a certificate we do not yet hold.

2. Sensitive Personal Data & AI Processing

Under section 2 of the Act, biometric data is sensitive personal data — as are data about your health, race, ethnic origin, beliefs, marital and family details, sex and sexual orientation. Section 45 permits us to process it only with your express consent or on another specific ground in the Act. We rely on your consent, given actively and separately, and you can withdraw it at any time under section 32(4):

Aura Analysis: When you upload a photograph or video, our AI processes facial geometry and skin tone indicators. This is biometric data. It is used solely to generate skin-wellness summaries and is never shared for any other purpose without a fresh consent from you.
Naya Wellness Coach (voice): Voice inputs are processed by speech-to-text models to recognise wellness prompts and tone. Recordings are processed in real time or cached transiently and are not retained as a voice library.
Help Naya learn (optional, off unless you turn it on): Mooud is building its own AI model for Naya. If you switch on Help Naya learn (Account → Settings → Naya’s watch list), we keep what you type or say to Naya (kept as text), the few messages before it, Naya’s reply and what it did, whether that worked, and Naya’s short reading of your mood, to train and test that model. Before anything is kept, email addresses, phone numbers, card, account and ID numbers, M-Pesa and other payment codes, and links are replaced with markers; names you type may remain. Photos, selfies and voice recordings are not kept for this. Because a conversation can include what you choose to share about your health, skin or mood, we rely on your express consent (s.30(1)(a) and s.45), which is what turning the switch on is. It is used only to improve Naya: never sold, never used for advertising, and processed only by our cloud providers under the safeguards in section 4. Each conversation is kept for 180 days, then deleted automatically. Training files made from them carry no name or account and are deleted 30 days after they are made. Switch it off at any time and everything kept from your conversations is deleted at once; deleting your account deletes it too. Under s.32(4), withdrawing does not undo training already lawfully done, and nothing of yours is used in any training afterwards.
Impact assessment: Section 31 requires a Data Protection Impact Assessment where processing is likely to result in high risk to your rights. Biometric processing at scale is exactly that, and we carry one out before shipping a change to these features.

3. Categories of Data Collected

Category	Lawful Basis (DPA 2019)	Purpose
Account Details	Performance of a contract, s.30(1)(b)(i)	Registration, profile, authentication.
Biometric & AI Data	Express consent, s.30(1)(a) and s.45	Facial scans for Aura, speech for Naya.
Naya learning data (only if you turn on “Help Naya learn”)	Express consent, s.30(1)(a) and s.45	Training and testing Mooud’s own AI model for Naya. Scrubbed of contact details and numbers before it is kept.
Geolocation	Consent / performance of a contract, s.30	SKIP ride-hailing and courier dispatch.
Identity Documents	Legal obligation, s.30(1)(b)(ii)	Customer due diligence under the Proceeds of Crime and Anti-Money Laundering Act, 2009.
Financial Transactions	Legal obligation, s.30(1)(b)(ii)	Records required by the Companies Act, 2015, the Tax Procedures Act, 2015 and the National Payment System Act, 2011.

4. Transfers Outside Kenya

Mooud connects users, drivers, hosts and suppliers across East Africa and beyond, and our cloud infrastructure is provided by Google Cloud and Firebase. Your personal data may therefore be processed on servers outside Kenya.

Sections 48 and 49 of the Act permit a transfer out of Kenya only where we have given the Data Commissioner proof of appropriate safeguards, or where the transfer is necessary for the performance of our contract with you, or where you have consented after being told of the risks. We rely on contractual safeguards with every processor, encryption in transit and at rest, and — for anything sitting outside those grounds — your consent.

Data localisation: Section 50 allows the Cabinet Secretary to require that certain categories of data be processed on servers located in Kenya. Where a rule of that kind applies to data we hold, we will move it and say so here rather than seek an exemption.

5. How Long We Keep Things

Section 39 of the Act says personal data must not be kept longer than is necessary. Where a Kenyan statute sets a longer floor, that floor wins:

Account data: for as long as your account exists, and 30 days after you ask us to delete it.
Accounting and transaction records: seven (7) years, under section 636 of the Companies Act, 2015 and section 16 of the Proceeds of Crime and Anti-Money Laundering Act, 2009.
Tax records: at least five (5) years under section 23 of the Tax Procedures Act, 2015 — covered by the seven-year period above.
Identity verification documents: seven years after the end of the business relationship, as anti-money-laundering law requires, and then destroyed.
Naya learning data (only if you turned on “Help Naya learn”): 180 days from when each conversation was kept, then deleted automatically; at once if you switch it off or delete your account. Training files made from it are deleted 30 days after they are made.

A deletion request does not override these floors. Where we must keep a record by law, we keep only that record and tell you which one.

6. Your Rights Under the Data Protection Act

Section 26 gives you the rights below. Exercise them in the app under Settings, or by writing to our Data Protection Officer at dpo@mooud.app. We answer within the period the Regulations allow and we do not charge for it.

To be informed (s.26(a)): to know how your data is being used — which is what this page is for.
Of access (s.26(b)): a copy of the personal data we hold about you.
To object (s.26(c)): to stop processing you object to, including processing for direct marketing.
To correction (s.26(d)): to have inaccurate, out-of-date, incomplete or misleading data corrected.
To deletion (s.26(e) and s.40): to have false or misleading data deleted, and your account erased subject to the retention floors in section 5 above.
To data portability (s.38): to receive your history in a structured, machine-readable format.
To withdraw consent (s.32(4)): to switch off AI processing at any time in Settings. Withdrawal does not undo processing already lawfully done, and it does not cost you access to the rest of the app.
Against automated decisions (s.35): not to be subject to a decision based solely on automated processing that significantly affects you, without a human being able to review it.

7. Children

In Kenya a child is anyone under 18 — Article 260 of the Constitution and the Children Act, 2022. Section 33 of the Data Protection Actallows a child’s personal data to be processed only with a parent or guardian’s consent, in the child’s best interests, with a mechanism to check age and verify that consent.

Mooud does not admit children.You must be 18 or over to hold an account. Mooud handles payments, bookings and rides, which need the legal capacity to contract, and that is 18 in Kenya. The check is enforced on our servers, not in the app: an account that has not given a date of birth cannot use Mooud at all, and one that gives a date under 18 is refused. We therefore do not collect parental consent, because we do not knowingly process any child’s data.

What that check is, precisely: a date of birth you enter yourself. It is a declaration, not identity-verified age assurance, and somebody determined to misstate their age can. If you believe a minor is using Mooud, tell us at privacy@mooud.app and we will close the account and delete the data. A parent or guardian can ask for the same. We would rather describe the check accurately than let “18+” imply a verification we do not perform.

8. If Something Goes Wrong

Section 43 requires us to notify the Data Commissioner within 72 hours of becoming aware of a breach that presents a real risk of harm to you, and to notify you as well within a reasonably practical period. We will tell you what happened, what data was involved, and what we are doing about it — in plain language, not a legal notice.

Regulatory Oversight & Complaints

If you believe we have processed your personal data in breach of the Act, section 56 gives you the right to lodge a complaint with the Data Commissioner. You do not have to come to us first, though we would like the chance to fix it.

Office of the Data Protection Commissioner (ODPC)
Nairobi, Kenya
Email: info@odpc.go.ke
Website: www.odpc.go.ke — current physical and postal address, and the online complaint portal, are published there.