🔒 Privacy Policy

1. Who is responsible for your data

Merik Sokoni (sokoni.merikagency.com) is the data controller for the personal data described here. This policy is written to meet the Kenya Data Protection Act, 2019.

Until those details are published, send any data question to support@merikagency.com and it will reach the right person.

2. What we collect

When you create an account

• Full name, username, email address, phone number
• Password (stored only as a one-way hash — we never see the real one)
• Profile photo, short bio and town or area, if you add them
• If you sign in with Google: your name, email address and Google profile picture
• Your Merik account is shared across Merik websites, so the same profile is used by other Merik services that run on it

If you list services as a provider

• Business name, business description, service category and the town or neighbourhood you work in
• The coordinates of your business location, if you drop a pin on the map
• Extra phone numbers you add for your business
• Working hours, payment methods you accept, listing titles, prices and photos
• Payment records for plans and boosts — amount, method, gateway reference and status

When you book or fulfil a job

• Which service, which provider, the agreed price and any counter-offers
• Answers to the provider's questions about the job, plus any notes you type
• Delivery address and any addresses you choose to save for next time
• Your phone number, which is copied to the order so the provider can reach you
• Your GPS coordinates at the moment you book, if you allow location access
• The provider's live GPS while the job is in progress
• The chat messages between you and the other party, including reactions
• The one-time code we email you to confirm the job is done
• Scheduling messages, cancellations and the reason given
• Your rating and review afterwards, and the provider's public reply

Automatically, as you use the site

• Which provider profiles were viewed and where the visit came from
• Last login time and last activity time, and failed login attempts (to stop password guessing)
• Server logs kept by our host
• Your browser's push notification address, if you turn on notifications

When you contact support

• The name and email you type into the support chat, the full transcript, and any rating you give
• If the chat becomes an email ticket, the ticket and every message on it

3. Your location — read this one

• Sharing your location is optional. The booking form lets you type an address instead. If you say no to your browser's location prompt, you can still book.
• If you do share it, the coordinates are saved with that one order.
• Only two logged-in accounts can ever read them back: you, and the provider doing that job. The endpoint that serves them checks your session and refuses everyone else.
• To turn a pin into a readable street name, the coordinates are sent to OpenStreetMap's Nominatim service. Nominatim receives the coordinates. It does not receive your name, phone number or account.
• A provider's live location is only shared while a job is in progress, is only visible to that job's customer, and stops being shown if it has not updated for five minutes.
• Providers are told in the Terms that a customer's address and coordinates are for that job only and may not be kept, reused or passed on.

4. Why we use it, and our legal basis

We do not sell your personal data. We do not run advertising profiles on you.

5. Who else sees your data

We only pass data to the companies we need to run the service. Each gets the minimum for its job.

We will also hand over data if a court, the Office of the Data Protection Commissioner, or another lawful authority requires it, or where we must to protect someone from harm.

6. What other users see

• Everyone, logged in or not: a provider's business name, photo, bio, category, town, listings, prices, average rating and public reviews.
• A provider you booked: your name, your phone number, your delivery address, your job notes, your coordinates if you shared them, and your chat with them.
• A customer who booked you: your business name and profile, plus your live location while that job is in progress.
• Reviews are public and show the reviewer's name.
• Merik staff can see order records, chat transcripts and support tickets when handling a problem or a report.

7. Cookies and what your browser stores

We use no advertising or tracking cookies. There are two cookies:

• Session cookie — keeps you logged in while you browse. It is scoped to .merikagency.com so the same login works across Merik sites, and it is marked Secure, HttpOnly and SameSite=Lax.
• Remember-me cookie (sk_rm) — only set if you tick "remember me". It lasts 30 days and holds a random token, not your password. Logging out deletes it and cancels the token on our side.

Your browser also keeps a few small settings on your own device, which never reach our server: your light or dark theme choice, whether you dismissed the "install app" bar, whether your push registration is current, and your current support chat session.

8. How long we keep things

• Account details — while your account exists, and then as described below.
• Orders, chat and reviews — kept while your account exists, because they are the shared record of a job between two people and the basis of a provider's rating.
• Payment records for plans and boosts — kept for at least seven years, because tax and accounting law requires it. This is the one thing we cannot delete on request.
• Live provider GPS — the last position is overwritten by the next one, and it stops being served five minutes after the last update.
• Support chats and tickets — kept so we can look back at a dispute.
• Login and failed-login records — kept only for a short period, long enough to stop password guessing, then cleared.

When you ask us to delete your account we remove or anonymise your personal details. Reviews you wrote may stay up without your name, so a provider's rating history is not rewritten.

9. Your rights under the Data Protection Act

Under the Kenya Data Protection Act, 2019 you can ask us to:

• Tell you what we hold about you, and give you a copy.
• Correct anything that is wrong. Most of it you can fix yourself in your profile.
• Delete your data, where we do not have to keep it by law.
• Stop a particular use, for example marketing emails or location sharing.
• Object to processing we do on the basis of legitimate interest.
• Receive your data in a portable format.

Email support@merikagency.com from the address on your account and say clearly what you want. We reply within 30 days. There is no charge, unless a request is repetitive or excessive.

To stop location sharing right now, turn off location permission for this site in your browser settings. To stop push alerts, turn off notifications for this site. To stop marketing email, use the unsubscribe link at the bottom of it.

If you are not happy with how we handled your request, you can complain to the Office of the Data Protection Commissioner (ODPC) of Kenya.

10. How we protect it

• The whole site runs over HTTPS.
• Passwords are stored as one-way hashes. Nobody at Merik can read your password.
• Login attempts are rate limited and accounts lock after repeated failures.
• Every state-changing request from a logged-in user carries an anti-forgery token.
• Database queries use bound parameters, so account and order data cannot be pulled out through a crafted search.
• The location endpoint checks that the caller is either the customer or the provider on that exact order before returning any coordinates.
• No system is perfect. If a breach ever affects you, we will tell you and the ODPC as the law requires.

11. Data leaving Kenya

Our servers and email are hosted by IONOS in Europe, and several of the services listed above are outside Kenya. That means some of your data is processed abroad. We only use providers that commit to appropriate safeguards for personal data.

12. Children

Merik Sokoni is for people aged 18 and over. We do not knowingly collect data about children. If you believe a child has an account, tell us and we will remove it.

13. Changes and contact

If this policy changes, the date at the top changes with it. For anything important we will also tell you on the site or by email.

Questions, corrections or a deletion request: support@merikagency.com, or open the support chat from the Contact page.