Version 2026-11-v1
Privacy policy
This explains what Massage Hub holds about you and why. Questions and requests go to info@massagehub.co.ke.
What we collect
- Everyone: your name, email, password (stored only in scrambled form) and that you confirmed you are 18 or older.
- Clients: your mobile number, bookings, session notes, out-call address, messages and reports.
- Therapists and spas: your ID and a selfie, public gender, two emergency contacts, where you work, certificates, business documents and payout number.
- Payments: Paystack handles your payment. We receive the amount, reference, the number or card type used, and the fee. We never see your M-Pesa PIN or full card number.
Why we use it
To make and manage your booking, take payment, pay providers, keep people safe, handle reports, and meet legal duties. We do not sell your data or use it for advertising. The selfie is used only so that a person can check you match your ID; we use no face-matching software.
Who sees it
- Your therapist gets your name, number, note and address only after you have paid, and only for that booking. You get their number at the same moment.
- IDs, emergency contacts and payout numbers are seen only by our named operators, and each access is recorded.
- Service providers working for us: Paystack (payments), Cloudflare (document and backup storage), our email service and our server host.
- The police, only with a court order.
Where it is stored
Our server and our document and backup storage are outside Kenya. Documents and backups are encrypted before they leave our server, and stored in the European Union. By creating an account you agree to this transfer.
How long we keep it
| Data | Kept for |
|---|---|
| Rejected or unfinished applications' documents | 30 days |
| Selfie, after approval | 90 days |
| Other approved provider documents | Until the account closes, plus 90 days |
| Out-call addresses and session notes | 90 days after the session |
| Messages | 12 months after the booking |
| Reports and safety cases | 3 years after closing |
| Payment records | 7 years |
| Backups | 35 days |
Closing your account
You can close your account from your account page, unless a booking, report or money is still open. Sign-in stops at once. Your name, phone and email are erased after 90 days. Payment records, reports and audit history stay for the periods above, tied to an anonymous reference, and your reviews stay without your name.
Your rights
Under Kenya's Data Protection Act, 2019 you can ask to see, correct or delete your data, and object to how it is used. You can download your data from your account page. For anything else, write to info@massagehub.co.ke, and we aim to reply within 14 days. You can also complain to the Office of the Data Protection Commissioner.
If something goes wrong
If a data breach could put you at real risk, we tell the Commissioner within 72 hours, and tell you how to protect yourself.
Cookies
We use only the cookies needed to keep you signed in and protect forms. We use no advertising or tracking cookies.