Dhobiflow Privacy Policy
Version 1.0.0 — Effective 25 September 2026
1. Who We Are
Dhobiflow ("Dhobiflow," "we," "us," or "our") operates a laundry management platform connecting laundry vendors, their customers, and washing/drying machines in Nairobi, Kenya and elsewhere in Kenya.
If you have any question, concern, or request about your personal data, contact us at [email protected]. This is the address to use for every right described in Section 7, and we treat it as our primary channel for data protection matters.
This policy applies to everyone who uses Dhobiflow — whether you are a vendor running a laundry business on our platform, or a customer placing orders with a vendor through Dhobiflow.
2. What We Collect, and Why
We only collect personal data that supports running your account, fulfilling orders, processing payments, and keeping the service reliable and secure. Below is every category of personal data our systems handle today, in plain terms.
2.1 Account identity data
What: Your first name, last name, and phone number. If you don't set an email address, we generate one internally from your phone number so our systems have a unique identifier for you; this internal address is not used to contact you. Why: To create and secure your account, identify you when you sign in, and let vendors and customers recognize each other on orders. Legal basis: Necessary to perform our contract with you (Data Protection Act, 2019, s.30(1)(b)) — we cannot provide the service without knowing who you are.
2.2 Order and location information
What: Addresses or map pins you or a vendor enter for pickup, delivery, or the vendor's premises (with an approximate accuracy value where provided). We do not collect your device's live GPS location — nothing in our mobile app requests background or foreground location-tracking permission. Why: To match customers with nearby vendors, and to know where to collect or deliver laundry. Legal basis: Contract necessity.
2.3 Payment and transaction data
What: M-Pesa transaction details relevant to your orders — the M-Pesa receipt number, amount, the paying phone number and name as they appear on the M-Pesa statement, and the date/time of payment. We reconcile these against your orders automatically. We do not collect, process, or store payment card numbers, card expiry dates, or card security codes — Dhobiflow only supports M-Pesa payments, and we never touch card data. Why: To confirm an order has been paid for, and to give vendors accurate financial records. Legal basis: Contract necessity; also a legal obligation for financial record-keeping (see Section 5).
2.4 Machine usage data
What: For orders placed at vendors using LG-connected washers and dryers, we record which machine was used, when, for how long, and which customer (by phone number) the cycle is linked to. Why: To let vendors confirm orders were run on the correct machine, resolve disputes about cycle usage, and detect maintenance needs on the machines themselves. Legal basis: Contract necessity (for the vendor operating the machine) and legitimate interest in keeping shared equipment maintained and accountable.
2.5 Contacts (if you grant permission)
What: If you choose to grant our mobile app permission to access your phone's contacts, we read your contact list so you can select a contact to add as a customer without retyping their name and phone number. We do not upload or store your full contact list on our servers — only the specific contact you choose to add is saved, as an order/customer record. Why: Convenience for vendors adding customers. Legal basis: Your consent, given at the time your device's operating system asks you to grant the contacts permission. You can decline this permission and still use Dhobiflow; you will just need to type customer details manually.
2.6 Photos
What: If you choose to attach a photo to an order (for example, to document the condition or contents of an item), we store that photo against the order record. Why: To document orders and resolve disputes about item condition. Legal basis: Consent (you choose whether to attach a photo).
2.7 SMS communications
What: We send SMS messages to the phone numbers on file for order status updates, payment confirmations, loyalty point notices, billing reminders, vendor account notices, machine maintenance alerts, and password-reset codes. Why: These messages are how Dhobiflow communicates order and account events that you need to know about. Legal basis: Contract necessity for transactional messages (order/payment/security); legitimate interest for service-quality messages like maintenance alerts to vendors.
2.8 Technical and diagnostic data
What: When the app encounters an error, our error-tracking tool (Sentry) may capture technical details about the device, app state, and the account involved, to help us diagnose the problem. Why: To find and fix bugs. Legal basis: Legitimate interest in keeping the service working correctly.
3. Age Requirement
Dhobiflow is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact [email protected] and we will remove it.
4. Who We Share Your Data With
We do not sell your personal data. We share personal data only with the following categories of service providers, strictly to operate Dhobiflow:
| Category of recipient | What they receive | Why |
|---|---|---|
| Machine platform provider | Machine identifiers and usage cycle data for connected washers/dryers | To read machine status and usage from the machine manufacturer's own cloud platform for machines you or your vendor use |
| SMS and messaging provider | Phone numbers and message content for SMS we send, and authentication-related data | Our SMS delivery and authentication service provider |
| Analytics and app-performance provider | App usage analytics, crash reports, and your device's push-notification token | To send you push notifications, understand app performance, and diagnose crashes |
| Error-monitoring provider | Technical error and diagnostic data, which may include account-identifying details at the time of an error | Error tracking and debugging |
| Accounting-integration provider | Order and payment data, where a vendor has connected their Dhobiflow account to a third-party accounting tool | Vendor-requested accounting integration — only applies to vendors who set this up |
Each of these providers is contractually or by platform terms restricted to using the data only to provide their service to us — we do not permit them to use your data for their own independent purposes.
We may also disclose personal data where required by Kenyan law, to a court or regulator (including the Office of the Data Protection Commissioner), or to protect the rights, property, or safety of Dhobiflow, our users, or the public.
5. Where Your Data Is Stored
Our servers and databases are hosted with reputable cloud infrastructure providers in the United States. This means your personal data is stored and processed outside Kenya. We are telling you this plainly because Kenya's Data Protection Act requires us to disclose transfers of personal data outside Kenya. We take reasonable steps to make sure our hosting and service providers protect your data to a standard consistent with Kenyan law, and we keep this under review as our infrastructure evolves.
6. How Long We Keep Your Data
We keep your account and order data for as long as your account is active. If you close your account, we retain order and payment records for up to 5 years after closure, because Kenyan tax law (the Tax Procedures Act, 2015) requires businesses to keep financial records for at least that long — and Dhobiflow's vendors rely on us to keep their transaction history intact for that period. Where a longer retention period is required by another law, or is needed to resolve an ongoing dispute or legal claim, we will keep the relevant data for as long as that requires.
7. Your Rights Under Kenya's Data Protection Act
Under the Data Protection Act, 2019, you have the right to:
- Be informed of how your personal data is used (this policy is part of how we meet that duty).
- Access the personal data we hold about you.
- Request correction of inaccurate or outdated personal data.
- Request deletion of personal data we no longer have a lawful reason to keep.
- Object to processing of your personal data in certain circumstances.
- Request restriction of how we process your personal data in certain circumstances.
- Data portability — ask us for your personal data in a structured, commonly-used format.
To exercise any of these rights, email [email protected] with your request and enough detail for us to identify your account. We will respond as promptly as we reasonably can. If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya.
8. Security
We apply reasonable technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including access controls on our systems and encrypted connections between our apps and our servers. No system is completely secure, and we cannot guarantee absolute security, but we take our responsibility to protect your data seriously and continually review our practices.
9. Changes to This Policy
If we change what we collect, how we use it, or who we share it with, we will update this policy, increase its version number, and update the effective date at the top of this page. The current version is always available at this page and reflected in our mobile app, so you can always see exactly what applies to you.
10. Contact Us
Questions, concerns, or requests about this policy or your personal data: [email protected].
Dhobiflow — Nairobi, Kenya.