Privacy Policy

1. Introduction

Welcome to Medueti, the super-app connecting the African diaspora worldwide — a social network with communities, an Afroshop marketplace, local services, shipping logistics between senders and travelers, home-cooked kitchens, short-term sublets, events, news, and a creator program.

The protection of your personal data is our priority. This Privacy Policy explains how we collect, use, store, share, and protect your information when you use the Medueti application ("the App") on mobile devices or web platforms.

By downloading, installing, or using Medueti, you acknowledge that you have read and understood this Privacy Policy and agree to the practices described herein.

2. Data Controller Identity

• Company Name: Medueti
• Contact Email: support@medueti.com
• Privacy Contact: privacy@medueti.com
• Administrative Headquarters: Hamburg, Germany
• Data Controller: Medueti Team
• Website: https://medueti.com

For privacy-related inquiries, contact privacy@medueti.com.

3. Data We Collect

Medueti collects data necessary to provide and improve our services:

3.1 Account Registration Data

• Email address (required)
• Phone number (optional, for verification)
• Full name (required)
• Password (stored hashed)
• Date of birth, gender, profession, languages (optional)

3.2 Profile Information

• Profile photo, username/handle, bio
• Country of residence, city/town, address

3.3 User-Generated Content

• Social posts (text, images, videos, location tags)
• Direct messages between two people (end-to-end encrypted with AES-256)
• Comments, reviews, ratings
• Events, service listings, marketplace product listings
• Kitchen menus and meal orders, sublet listings and bookings
• Shipping requests, portfolio items

3.4 Transaction Data

• Order history, booking history (marketplace, services, kitchens, sublets, shipping, events)
• Event credits balance
• Transaction metadata (amount, date, type)

3.5 Device & Technical Data

• Device model & OS version
• App version, push notification tokens (FCM)
• Device advertising ID (for ads, with consent)
• IP address, crash logs, biometric capability

3.6 Location Data

• Country/city (user-provided)
• GPS coordinates (with permission, for nearby features)

Location data is collected only when you grant permission.

3.7 Usage & Analytics Data

• Screen views, interactions, search queries
• Content engagement (likes, shares)
• Session duration, feature usage patterns

4. How We Use Your Data

• Service Provision: Account management, social features, messaging, marketplace, services, shipping, kitchens, sublets, and events
• Personalization: Content recommendations, localized content, relevant search results using ML
• Orders & Bookings: Record the orders, bookings, and event credits you create
• Communications: Notifications, security alerts, customer support, marketing (with consent)
• Safety & Security: Identity verification, fraud detection, policy enforcement
• Analytics & Improvement: Usage analysis, research, performance monitoring
• Advertising: Display ads, measure performance, personalized ads (with consent)
• Legal Compliance: Law compliance, respond to legal requests

5. Legal Basis for Processing (GDPR)

For users in the EEA, UK, and Switzerland:

• Contract Performance: Account creation, service delivery, messaging
• Legitimate Interests: Security, fraud prevention, analytics, app improvement
• Consent: Marketing, personalized advertising, location access
• Legal Obligation: Tax records, responding to legal requests

You may withdraw consent at any time by adjusting your settings or contacting us.

6. Data Sharing and Third-Party Services

We do NOT sell your personal data. We share information only in these circumstances:

6.1 Service Infrastructure

• Google Firebase: Backend, database, file storage, authentication
• Google Cloud Platform: Cloud functions, hosting

6.2 Analytics

• Firebase Analytics: Anonymized usage data
• Firebase Performance: App performance metrics
• Firebase Crashlytics: Crash reports

6.3 Authentication

• Google Sign-In: Social login
• Sign in with Apple: Social login

6.4 Advertising

• Google AdMob: Mobile advertising
• SKAdNetwork Partners (iOS): Ad attribution (26+ networks)

6.5 Location Services

• Nominatim (OpenStreetMap): Address autocomplete
• Photon (Komoot): City search

6.6 Machine Learning

• Google ML Kit: Image labeling for visual search

ML Kit processing occurs on-device; images are not sent to Google servers for this purpose.

6.7 Creator Payouts

• PayPal: Used solely to pay approved Creator Program members their ad-revenue share. See Section 17.

6.8 Other Sharing

• Legal Requirements: To comply with laws
• Safety & Security: To protect against fraud
• Business Transfers: In case of merger/acquisition (you will be notified)
• With Your Consent: When you authorize sharing

7. Advertising and Personalization

Google AdMob

• May collect device advertising ID, IP address, ad interactions
• By default, you may see personalized ads based on interests

Opt-Out of Ad Personalization

• iOS: Settings → Privacy → Tracking → Disable tracking
• Android: Settings → Google → Ads → Opt out

iOS App Tracking Transparency (ATT)

On iOS 14.5+, we request permission before tracking for advertising purposes.

SKAdNetwork (iOS)

We work with 26+ SKAdNetwork partners for ad attribution (Google, Facebook, Unity, AppLovin, etc.).

8. Device Permissions

Medueti requests the following permissions:

8.1 Android Permissions

• INTERNET: Connect to servers (required)
• ACCESS_NETWORK_STATE: Check connectivity (required)
• CAMERA: Take photos/videos (optional)
• READ_MEDIA_IMAGES / READ_MEDIA_VIDEO: Access media (optional)
• ACCESS_FINE / COARSE_LOCATION: Nearby features (optional)
• POST_NOTIFICATIONS: Push notifications (optional)
• READ_CONTACTS: Find friends (optional)
• USE_BIOMETRIC: Fingerprint/face auth (optional)
• FOREGROUND_SERVICE: Background messaging (required)

8.2 iOS Permissions

• Camera: Take photos for posts/profile
• Photo Library: Access/save photos
• Location: Find nearby services
• Contacts: Find friends
• Face ID: Biometric authentication
• Tracking: Ad tracking (ATT prompt)

All optional permissions can be denied without blocking basic app access.

9. Cookies and Tracking Technologies

Mobile App

• Firebase Analytics: Anonymized usage data with device identifiers
• Firebase Remote Config: Feature flags and A/B tests
• Local Storage: User preferences, cached data, auth tokens

Web Platform

• Essential cookies: Required for functionality
• Analytics cookies: Website traffic analysis
• Preference cookies: Remember settings

Managing Cookies

• Mobile: Adjust tracking in device privacy settings
• Web: Use browser settings to manage cookies

10. Data Security

Technical Measures

• Encryption in Transit: HTTPS/TLS for all data
• Encryption at Rest: Data stored encrypted on Google Cloud
• End-to-End Encryption: Direct messages between two people are encrypted with AES-256
• Password Hashing: Secure one-way hashing
• Firebase App Check: Device attestation
• Rate Limiting: Protection against attacks

Access Controls

• Restricted access (need-to-know basis)
• Multi-factor authentication for admin access
• Regular security audits

Biometric Authentication

• Face ID/Touch ID/Fingerprint supported
• Biometric data is processed and stored only on your device
• Never transmitted to our servers

Data Breach Response

• Notification within 72 hours as required by GDPR
• Immediate mitigation steps

11. Data Retention

• Account data: Until deletion + 30 days grace period
• User content: Until deleted by user or account deletion
• Chat messages: Until deleted or account deletion
• Transaction records: 7 years (legal/tax requirements)
• Analytics data: 26 months (anonymized)
• Security logs: 12 months
• Push notification tokens: Auto-cleaned when invalid
• Support tickets: 3 years after resolution

Automatic Cleanup

• Expired notifications: Deleted after 7 days
• Typing indicators: Cleaned via scheduled process
• Deleted messages: Hard-deleted after 30-day retention

12. Your Rights (GDPR)

• Right of Access: Request a copy of your data
• Right to Rectification: Correct inaccurate data
• Right to Erasure: Delete your data ("right to be forgotten")
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive data in machine-readable format
• Right to Object: Object to legitimate interest processing
• Right to Withdraw Consent: Withdraw consent at any time
• Right to Lodge a Complaint: File with a supervisory authority

How to Exercise Your Rights

• In-App: Settings → Privacy → Export My Data / Delete Account
• Email: privacy@medueti.com (response within 30 days)

Account Deletion

1. 30-day grace period (recovery possible)
2. After 30 days: permanent deletion/anonymization
3. Some data retained for legal compliance

13. International Data Transfers

Your data may be processed outside your country of residence:

• Google Cloud/Firebase: USA, EU — protected by Standard Contractual Clauses (SCCs)

We ensure all transfers comply with GDPR through:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions where applicable
• Additional safeguards as required

14. Children's Privacy

• Medueti is intended for users aged 16 and over
• We do not knowingly collect data from children under 16
• If we discover a minor's account, it will be immediately deleted
• Parents/guardians should contact privacy@medueti.com if concerned

15. User-Generated Content

Content Moderation

We reserve the right to remove content that is:

• Contrary to applicable laws
• Hateful, discriminatory, violent, or pornographic
• Violating privacy or intellectual property
• Spam, scams, or fraudulent

Reporting System

• In-app reporting available
• Human moderation review
• Appeals process available

Public vs. Private Content

• Public content is visible to other users
• Private messages are encrypted and visible only to participants

16. Account Verification

Business accounts may submit verification documents:

• Government ID (identity verification)
• Proof of address (location verification)
• Business registration (legitimacy)
• Professional certifications (service providers)

Document Handling

• Reviewed by authorized personnel only
• Stored securely with encryption
• Deleted after verification (unless legally required)
• Not shared with third parties

17. Payments & Creator Payouts

Medueti does not process payments between users, and therefore holds no user-to-user payment data:

• No card numbers, bank details, or payment credentials are ever collected, stored, or transmitted by Medueti for transactions between users
• There is no payment processor for marketplace, services, kitchens, sublets, shipping, or event purchases
• There are no subscriptions and no in-app purchases
• Business and creator status is granted by Medueti, not sold
• Event Credits are granted by Medueti; they cannot be bought

Users arrange and settle payments directly between themselves, outside the app. Medueti is not a party to those transactions and has no visibility into them. We do record transaction metadata you create in the app — the order or booking itself, its amount, date, and status — because that is what makes your order history work.

18. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights:

Your CCPA Rights

• Right to Know: What personal info we collect, use, disclose
• Right to Delete: Request deletion of your info
• Right to Opt-Out: Opt out of "sale" of personal info
• Right to Non-Discrimination: No penalty for exercising rights

Categories of Personal Information Collected

• Identifiers: Name, email, phone, IP, device ID
• Personal Information: Account info, creator payout email
• Commercial Information: Order and booking history
• Internet Activity: Browsing, search, interactions
• Geolocation Data: Location (with permission)
• Sensory Data: Photos, videos, audio (user-uploaded)
• Inferences: Preferences, behavior patterns

"Sale" of Personal Information

We do NOT sell personal data traditionally. Sharing with ad partners may constitute "sale" under CCPA. Opt out by disabling ad personalization in device settings, or contact privacy@medueti.com.

Exercise Your CCPA Rights

Email privacy@medueti.com with subject "CCPA Request".

19. Changes to This Policy

• We may update this policy to reflect changes in practices, legal requirements, or features
• The "Last updated" date at the top indicates the most recent revision
• For minor changes (e.g. clarifications with no new data use), we update the date and notify you in-app
• For material changes (e.g. new categories of data, new purposes, new third parties), we notify you in advance via in-app notification and email, and where the change relies on your consent (Section 5), we ask for that consent again before it takes effect

We recommend reviewing this policy periodically.

20. Contact Us

For questions, concerns, or requests regarding privacy or your data:

• General Support: support@medueti.com
• Privacy Inquiries: privacy@medueti.com
• Data Protection Officer: dpo@medueti.com
• Website: https://medueti.com
• Mailing Address: Medueti, Hamburg, Germany