1. The Principle of Progressive Consent Disclosure
Unlike commercial swipe apps, Mpendwa does not maintain a public catalog, searchable directory, or browsable gallery of users. Your profile, photographs, and identity are never exposed to the public.
Information is disclosed in four strict stages:
- Stage 1 (Double-Blind Card): Candidates review only high-level values, faith, education, and lifestyle. Names, employers, and photos are strictly hidden.
- Stage 2 (Mutual Interest): Photos and detailed reflections unlock only if both candidates click "Accept Proposal".
- Stage 3 (Private Video Date): Introductions occur in encrypted, in-app video rooms. Direct phone numbers remain shielded.
- Stage 4 (Contact Release): Personal WhatsApp or phone numbers are released only when both parties independently submit a "YES" on their post-date feedback form.
2. Minimal KYC Retention
Identity verification helps prevent impersonation; it does not establish marital status. Mpendwa does not store raw identity documents or selfie media in its databases. Approved providers process automated verification under their own disclosed retention terms; staff-assisted verification is always available.
We retain only the verification method, provider job/reference, result code, timestamps, reviewer and a salted identifier hash. The single-status declaration is a separate, versioned statement.
3. Automated Double-Blind PII Sanitizer
In East Africa's urban centres (Kampala, Nairobi) and tight-knit diaspora communities (London, Toronto), individuals are frequently separated by just two degrees of connection. Our proprietary sanitization engine intercepts and abstracts identifying data before any profile proposal is generated.
4. Internal Matchmaker Role Separation
Our human concierge matchmakers triage candidates using pseudonymized member IDs (e.g., #UG-408).
The matching workspace does not expose raw telephone numbers or ID documents. Authorized admissions, verification and support staff can access the application or contact details required by their roles. Verification staff may inspect your ID during a private live check; Mpendwa does not store raw ID media. Pseudonymization reduces exposure but does not make your record anonymous or eliminate all risk of disclosure.
5. Statutory Framework & Regional Compliance
Mpendwa operates under strict adherence to national and international privacy statutes governing our home and diaspora corridors:
- Uganda: Data Protection and Privacy Act (DPPA), 2019.
- Kenya: Data Protection Act (DPA), No. 24 of 2019.
- United Kingdom & European Union: UK GDPR / EU GDPR (Regulation 2016/679) for our cross-border diaspora corridors.
6. Your Data Subject Rights (Erasure & Portability)
You maintain full sovereignty over your personal data at all times. As a verified applicant or active member, you hold:
- The Right to Erasure ("Right to be Forgotten"): You may request complete deletion of your application and matching dossier at any point. All records are permanently erased within 48 hours.
- The Right to Restrict Processing: You may pause your profile without penalty if you enter a courtship or need personal time.
- The Right to Rectification: You may update your faith preferences, location, or relationship goals directly through your concierge.
Matching choice and optional staff note
Your matching choice and optional staff note are private service data. You can change the choice and edit or clear the note. The note is not shown to a partner or used for ranking, AI or research. Authorized matching staff see a filtered version that removes known identifying references; this filter does not guarantee anonymity, so leave identifying details out. We clear the note and matching-preference details when your account erasure is carried out.