Privacy Policy

This explains what MBIImix Water Solutions holds about you, why, who else sees it, and what you can ask us to do about it. It is written against the Kenya Data Protection Act 2019.

Who holds your data

MBIImix Water Solutions is the data controller. Your landlord is the party you deal with day to day, and they can see the records for the meters on their property.

What we collect

You give us some of this. The rest comes from your meter and from M-PESA.

• Account: your name, email address and phone number.
• Meter: the meter number linked to you, and which property and landlord it belongs to.
• Usage: daily readings from the meter, including water used, credit remaining, valve state and battery state. Meters without an AMI module report none of this, so for most meters today these are empty.
• Payments: the amount, the M-PESA receipt number, and the phone number that paid. We do not see or store your M-PESA PIN.
• Tokens: the 20 digit tokens issued to your meter, and when.
• Verification: when you link a meter we send a code to the phone number already held against that meter. We store a one way hash of the code, never the code itself, and we delete the hash once it is used or expires.

We do not use advertising trackers, and we do not sell anything about you to anyone.

Why we hold it

• To show you your balance, usage and past tokens.
• To take a payment and issue the token you paid for.
• To prove, if a payment is disputed, what was paid and what was delivered.
• To let your landlord bill correctly and answer your questions.
• Because we have to keep financial records.

Who else sees it

Only the parties needed to actually deliver water credit to your meter.

• Your landlord, for the meters on their property. They cannot see any other landlord's tenants.
• Safaricom, because the payment is an M-PESA transaction.
• Hunan Stron Smart Co., Ltd, the meter vendor, which issues the token. Your meter number and payment amount reach them. They are in China.
• HostPinnacle, a Kenyan SMS provider licensed by the Communications Authority, which delivers codes and tokens to your phone.
• Supabase, which hosts the database.

Where it is held

The database is hosted in London, in the United Kingdom, and token issuing goes to the meter vendor's servers in China. Both are transfers outside Kenya, which the Data Protection Act 2019 treats as something you should be told about plainly rather than find in a footnote.

What stays on your phone

So that a token is readable when you are standing at the meter with no signal, your most recent tokens are saved in your browser on that handset. They are tied to the account that fetched them, and they are deleted when you sign out, when your session expires, or when a different account signs in on the same phone. They are never sent anywhere from there.

We also remember your language and light or dark preference on the same handset. Nothing in browser storage is used to follow you around other websites.

How long we keep it

Verification codes are deleted as soon as they are used or expire, within ten minutes. Payment and token records are kept because a dispute can be raised long after the fact.

Your rights

Under the Data Protection Act 2019 you can ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything that is wrong;
• delete what we are not required to keep;
• stop using it in a particular way;
• explain any decision made about you automatically.

The first three you can do yourself, now, from your account: download a copy of everything we hold, correct your details, or delete what we are not required to keep. You do not have to ask us and wait.

You can also complain to the Office of the Data Protection Commissioner without going through us first.

When a tenancy ends

Your landlord ends the link between you and the meter. From that moment you stop seeing that meter's balance, usage and tokens. The meter's own history stays with the property, because it belongs to the meter rather than to whoever was renting at the time.

Changes

If this changes in a way that affects you, we will say so in the app rather than quietly change the date at the top.