Privacy Policy

1. Scope and contact

OnaNet (“OnaNet”, “we”, “us” or “our”) is a mobile marketplace operated in Kenya by Robinson Mwendwa. It helps clients discover internet packages and request installation from independent internet providers. This policy applies to the OnaNet mobile application and the legal pages at onanet.app.

Robinson Mwendwa is the data controller for information used to operate OnaNet. A provider may separately control information it receives to fulfil an installation request. For privacy questions, rights requests or complaints, contact support@mail.onanet.app. Postal code: 00100, Kenya.

2. Information we collect

2.1 Account and authentication information

• Name, email address, account role and internal account identifiers.
• Phone number and phone-verification status when supplied for an installation request.
• Authentication identifiers, session information and sign-in-provider information processed through Supabase Authentication. OnaNet does not receive or store your raw Google password, and passwords created directly for OnaNet are handled by Supabase rather than stored in OnaNet’s application database.

2.2 Location and installation information

• Location searches and the area selected by the user.
• Precise latitude and longitude when a user chooses current location or intentionally selects a map point.
• Installation address, area, nearby landmark, chosen provider and package, request notes and request status.
• Phone number and status information needed to coordinate installation.

OnaNet requests foreground location only when you use a location feature. It does not collect background location.

2.3 Provider and business information

• Provider and business names, business type, contact details, service areas, coverage coordinates and radius.
• Internet packages, connection types, speeds, prices, installation fees, availability and listing details.
• Provider team-member names, email addresses, roles and access permissions.
• Verification files voluntarily submitted by a provider: national ID front and back, selfie, business-registration document, KRA PIN certificate, business permit and premises photograph.
• Verification status, administrator decisions and rejection reasons.

2.4 Provider subscriptions

• Provider plan, price, Google Play purchase token, transaction status, renewal status and subscription dates.
• Google Play processes billing and payment credentials for Android subscriptions. OnaNet does not receive or store complete card numbers, PINs or CVVs.

2.5 Reviews, reports and support

• Star rating, written review and the completed installation associated with the review.
• Provider or review reports, selected reason, explanation and moderation outcome.
• Emails and information you provide when contacting support or exercising a privacy right.

2.6 Technical information

Our hosting, security and authentication providers may automatically process IP address, request timestamps, authentication tokens, browser or device information and server logs when you connect to OnaNet. Firebase Cloud Messaging processes a device notification token and related delivery information when push notifications are enabled. Firebase Crashlytics processes crash reports and diagnostics such as stack traces, app version, operating-system and device information, timestamps and app-installation identifiers so we can identify and fix reliability problems. Crash reporting is disabled in development builds. The current app does not use advertising SDKs, Facebook Pixel, Firebase Analytics or Google Analytics.

2.7 Information stored on your device

The app stores convenience data locally, including onboarding completion, theme choice, saved providers, preferred location and locally displayed notifications. This is app storage rather than advertising cookies. It can normally be cleared by clearing the app’s data or uninstalling it.

3. How we use information

• Create accounts, authenticate users and protect access.
• Find providers and packages relevant to a selected location.
• Create, route and manage installation requests.
• Give the selected provider the contact, location and request details needed to respond and reach the installation point.
• Verify providers and display their verification status.
• Operate provider subscriptions and verify Google Play purchases.
• Display reviews and investigate reports, fraud, abuse and safety concerns.
• Send OTPs, welcome emails, payment confirmations, verification decisions and support messages.
• Maintain, secure, debug and improve OnaNet and comply with law.

Under Kenya’s Data Protection Act, 2019, processing may be based on performing our agreement with you, your consent (including device permissions), our legitimate interests in operating and securing OnaNet, and compliance with legal obligations.

4. Sharing and service providers

We do not sell or rent personal information. We disclose it only as needed for the following purposes:

We may also disclose information to comply with a lawful request, protect users or the public, investigate abuse, or complete a merger, financing or transfer of OnaNet subject to appropriate safeguards.

5. Retention and deletion

We keep account and service data while the account is active and for as long as reasonably necessary to provide OnaNet. Transaction, security, moderation, dispute and verification records may be retained longer where necessary for fraud prevention, legal claims, accounting or applicable law. Backups and service-provider systems may take a limited period to expire after deletion.

You can permanently delete your account in the app under Account & security → Delete account, or use our external account-deletion page. Deletion removes the account and associated operational data except information we must retain for the limited reasons above. We may retain a minimal deletion record containing identifiers, email, reason and deletion time to enforce the deletion and prevent unauthorized recreation.

Deleting OnaNet does not automatically cancel an active Google Play subscription. Cancel it first in Google Play under Payments & subscriptions to prevent future renewal.

6. Your rights and choices

Subject to applicable law, including Kenya’s Data Protection Act, 2019, you may ask to access, correct, object to or restrict processing of, port, or delete your personal information. You may withdraw consent without affecting earlier lawful processing and may complain to Kenya’s Office of the Data Protection Commissioner.

• Edit supported account details from the app.
• Disable camera, photo or location permission in Android settings. You may enter a location manually instead.
• Delete your account through the in-app self-service flow.
• Email support@mail.onanet.app for another privacy request. We may verify your identity before acting.

7. Security and international processing

We use authentication, encrypted network connections, access controls and restricted document access designed to protect information. No online system is completely secure. Some service providers may process information outside Kenya; where applicable, we use contractual and organizational safeguards appropriate to the transfer.

8. Children

OnaNet is not directed to children under 18 and does not knowingly allow them to create accounts. If you believe a child supplied personal information, contact us so we can investigate and delete it where appropriate.

9. Changes to this policy

We may update this policy when OnaNet’s features, providers or legal obligations change. We will change the date above and provide an in-app or other appropriate notice for material changes.