How we protect Soko Mashinani
This page is maintained by the Soko Mashinani team to answer common security and privacy questions about how the platform handles your data. It describes practices currently in place and is updated as we evolve. It is not an independent certification.
Account access & authentication
- Every account is protected by an email + password sign-in, with optional Google sign-in.
- Phone numbers are verified via one-time codes (OTP) before sensitive actions like payouts.
- Admin, agent, provider and customer roles are stored and enforced server-side — never trusted from the browser.
- Sessions are managed by Lovable Cloud (powered by Supabase Auth) and can be signed out at any time.
Where your data lives
- Soko Mashinani runs on the Lovable Cloud platform, which uses managed Postgres databases with encryption at rest and in transit.
- Row-level security policies are enabled on user-facing tables so people can only see records they are authorised to see.
- Verification documents are stored in a private bucket and only visible to the uploader and verification officers.
- Public profile photos and provider media are served from public buckets — only upload images you are comfortable sharing publicly.
What we collect & why
- Customers: name, phone, location, and search/booking history to connect you with the right providers.
- Providers: business profile, services, location, verification documents and payment details to be discoverable and get paid.
- Agents: identity and KYC details to issue commissions and payouts.
- We do not sell personal data. Marketing communications are opt-in and can be unsubscribed at any time.
Cookies & analytics
We use essential cookies for sign-in sessions and limited product analytics to understand which features people use. We do not run third-party ad-tracking pixels.
Subprocessors we rely on
- Lovable Cloud (Supabase): database, authentication, storage and serverless functions.
- Safaricom M-Pesa: mobile-money payments and payouts.
- WhatsApp Business / Meta: messaging notifications and search-by-WhatsApp.
- Google Maps: location lookup and map previews.
Retention & deletion
Account data is retained while your account is active. To request deletion of your account or specific personal data, contact us using the details below and we will respond within a reasonable timeframe.
Reporting a security issue
If you believe you have found a security vulnerability, please email security@sokomashinani.com with details and steps to reproduce. Please do not publicly disclose the issue until we have had a chance to investigate.
Contact
General questions: hello@sokomashinani.com. You can also reach us via the WhatsApp channel on the home page.
Last updated 6 August 2026. This page is informational and not a substitute for legal advice.