MjengoX Privacy Policy

1. Who we are

MjengoX ("MjengoX", "we", "us", "our") is a construction cost-tracking application operated by Saos Flow Limited. This Privacy Policy explains what personal data we collect through the MjengoX mobile app and website (together, the "Service"), why we collect it, who we share it with, and the rights you have over it.

We are a data controller for the account information you give us directly, and as explained in Section 5, closer to a data processor for certain information you upload about your own projects, such as the names of suppliers or workers that appear in receipts or payment messages. That data is yours; we process it to provide you the Service.

If you have questions about this policy or want to exercise any of the rights described below, contact us at info@mjengox.com.

2. Information We Collect

Account information

• Name, email address, phone number (optional), and WhatsApp number (optional)
• Password, stored as a one-way cryptographic hash; we never see or store your actual password
• Company name, location, and bio, if you choose to add them to your profile

Project and financial information

• Project names, locations, budgets, and currency
• Payments, purchases, and bill-of-quantities (BOQ) line items you record or upload
• Receipts, invoices, and other documents you upload for processing
• Mobile money or bank SMS messages you paste in so a payment can be recorded

Receipts, invoices, and payment SMS messages you upload often contain personal information about people other than you: for example, a supplier's business name, a worker's name, or a mobile money sender/recipient's name and phone number. We process this on your behalf, as part of helping you keep your own project's records. You're responsible for having a lawful basis to record this information about others; ordinarily, this is simply your own ordinary business record-keeping. Files exported by you (such as PDF or Excel reports) become your responsibility once downloaded to your device.

Payment data

Payments made through MjengoX may be processed by third-party payment providers, including Paystack, Apple, and Google, depending on the payment method and platform used. Payment card details, such as your full card number, expiration date, and security code (CVV), as well as other payment or banking credentials, are collected and processed directly by the applicable payment provider through its secure payment systems. MjengoX does not directly collect, process, or store your full payment card details or banking credentials. We may receive limited payment-related information, such as your name, billing country, payment status, transaction identifiers, purchase details, and payment receipts, as necessary to confirm and manage your transactions, subscriptions, or purchases.

The processing of your payment information by these third-party providers is governed by their respective privacy policies: Paystack, Apple, and Google.

Device and usage information

• A push-notification token, used to alert you when document processing finishes
• Basic technical logs (timestamps, error messages, request paths) generated automatically while running the Service

What we don't collect: precise location, contacts-list access, or advertising identifiers. We don't use your data for advertising, and we never sell your personal data.

3. How we use your information

We use the information above to:

• Create and maintain your account, and verify your email address
• Let you record, track, and report on your construction projects' finances
• Extract structured data (amounts, dates, item descriptions) from documents and SMS messages you upload, using the AI processing described in Section 4
• Send transactional emails (verification, password reset) and push notifications (processing status)
• Detect and prevent fraud, abuse, and technical problems
• Meet our own legal and accounting obligations

We do not use your project data to train AI models, ours or anyone else's.

4. AI document processing

When you upload a receipt, quotation, bill of quantities, or payment message, MjengoX uses optical character recognition (OCR) followed by an AI language model to automatically extract structured data: amounts, dates, vendor names, item descriptions. This is currently performed using a couple of AI models.

The text or image content of your document is sent to these providers solely to extract this data. Under our current agreements with them, it is not used to train their models. We go further on our own end too: once extraction succeeds, we discard the raw document text and the AI's raw response entirely; only the structured result (the amount, date, item, etc.) is kept. Raw text is only retained temporarily if processing fails, so we can debug what went wrong, and that too is automatically deleted after 90 days.

AI extraction is not perfect. Always review AI-extracted amounts before relying on them, especially for anything affecting a financial decision. See our Terms of Service for more.

5. Who we share information with

We may share your personal data with trusted third-party service providers who process it on our behalf and only as necessary to provide their services. These providers are required to protect your data, maintain confidentiality, use it only for authorized purposes, and retain it only as permitted by us. The categories of third parties we may use include cloud computing and storage providers, payment processors, web hosting providers, and cookie management services.

We don't share your personal data with anyone else, and we never sell it. We may disclose information if required by law, or to protect the rights, property, or safety of MjengoX, our users, or the public.

Some of these providers process data outside Kenya, including in the United States. Where this happens, we rely on the provider's own compliance with applicable international data-transfer safeguards.

6. How long we keep your information

• Account information is kept for as long as your account is active, and for a short period afterward as described in Section 8.
• Project, financial, and document records are kept indefinitely while your account is active, since they form your own ongoing business records. Archive a project any time to freeze it read-only without deleting it.
• Failed processing logs (which may briefly contain unprocessed document text) are automatically deleted after 90 days.
• Successful processing logs never retain raw document text or the AI's response at all; only the structured result is kept, from the moment processing succeeds.

7. Your rights

Under most global data protection laws, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Object to certain processing
• Request erasure or anonymisation of your personal data
• Data portability: receive your data in a portable format

We respond to any request within 14 days, as required by law. Some requests may be limited where we have a legal obligation to retain information, or where it's needed to establish or defend a legal claim.

To exercise any of these rights, contact us at info@mjengox.com.

8. Account deletion

You can request account deletion from within the app, or by contacting us. See our dedicated Delete Your Account page for step-by-step instructions. When you do:

• Your name, email, phone number, and profile information are anonymised immediately, and your account is deactivated.
• Your project and financial records are retained in anonymised form, with no personal identifiers attached, so your accounting history remains intact for continuity, unless you specifically request full deletion of this data too, which we'll action within 14 days.

9. Security

We use industry-standard measures to protect your information. Connections between your device and our servers are encrypted (HTTPS), uploaded documents and other stored data are encrypted at rest and in transit where supported by our infrastructure providers, passwords are stored encrypted, and access is restricted to personnel who need it to operate the service. No system is perfectly secure, and we cannot guarantee absolute security of information transmitted to us.

We use cookies that are strictly necessary for the app to function: to keep you signed in, to protect against cross-site request forgery, and, if you sign in with Google or Apple, a short-lived cookie those providers' sign-in systems use to verify the request. We do not use cookies for advertising, analytics, or tracking you across other websites, and because these cookies are essential to providing the service, no separate consent is required to use them.

10. Children's privacy

MjengoX is intended for business use by adults (18 years and older) and is not directed at children. We do not knowingly collect personal data from anyone under 18.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we'll notify you by email or through the app before they take effect. The "last updated" date always reflects the most recent version.

12. Contact us

Saos Flow Limited
info@mjengox.com