Privacy Policy

We collect the data we need to run the platform — your email, anything you post, who you message, and basic usage data so the site keeps working. We don't sell your data. We keep it on servers run by reputable providers, and you can delete your account at any time.

The full detail is below.

Malawi Living Hub is the data controller for personal information you share with us. Contact us at info@malawilivinghub.com.

You give us directly:

• Account info — email, name, password (hashed), phone, profile photo.
• Listings — titles, descriptions, prices, photos, location.
• Messages — anything you send to other users via the inbox.
• Verification documents — if you choose to verify, the ID photos you upload. Stored encrypted; visible only to admin reviewers.
• CV / seeker profile — if you build one, the employment history, skills, education and references you add.
• Reviews and reports — feedback you leave about other users or listings.

We collect automatically:

• Usage data — pages visited, search terms, listings clicked. Used to improve the product and produce aggregate analytics.
• Device / network data — IP address, browser, device type. Used for security and rate-limiting.
• Approximate location — inferred from IP, or precise location if you grant permission to use the map.
• Cookies — only what's needed for sign-in (a session cookie) and your saved preferences (language, currency). We don't use third-party advertising trackers.

• Run the platform — show your listings, deliver your messages, send password resets, keep you signed in.
• Keep it safe — detect spam and scams, enforce the Terms, investigate reports.
• Make it useful — show you saved-search matches, suggest similar listings, send the daily digest (only if you opt in).
• Improve the product — aggregated, non-identifying analytics about what people search for and click on.
• Comply with the law — respond to lawful requests from Malawi authorities, or handle tax obligations on paid services.

We don't sell your data. We do share specific data with:

• Other users — your public profile, listings, reviews and the messages you choose to send them.
• Supabase (hosting / database) — stores everything above on secure servers.
• Vercel (hosting / CDN) — runs the website and stores access logs.
• Resend (email) — delivers transactional emails (welcome, verification, digest).
• OpenStreetMap (maps) — your map interactions hit their tile servers.
• AI providers — if you use the “AI describe” button when posting, your draft is sent to an AI service. Don't paste anything sensitive into that field.
• Payment processors — only if and when we add paid features. Card data goes directly to them; we never see it.
• Law enforcement — when legally required by a valid Malawi court order.

• Account — until you delete it.
• Listings — until you delete them, or until they expire by inactivity.
• Messages — until either party deletes their account.
• Verification documents — kept while your account is verified; deleted within 90 days of un-verification or account deletion.
• Server logs — 30 to 90 days, depending on the provider.
• Backups — a copy may remain in the owner's secure offline backup, which is purged within 30 days of deletion.

• All connections use HTTPS / TLS.
• Passwords are hashed (never stored in plain text).
• Sensitive files (ID documents) are kept in private, access-restricted storage with row-level security.
• Your phone number and email are not publicly readable — a buyer only receives your number when you choose to share it in a chat (Safe Connect).
• Production data is only accessible to a small number of authorised staff.
• We rate-limit auth and write endpoints to slow down brute-force and spam attacks.

No system is 100% secure. If we ever detect a breach affecting your data, we'll notify you without unreasonable delay.

You can:

• See your data — most of it is visible to you when signed in (profile, listings, messages, saved searches).
• Correct your data — edit your profile and listings anytime.
• Download your data — get an instant copy any time from your profile → “Download my data”, or email info@malawilivinghub.com.
• Delete your data — see how to delete your account & data, or email us. Some content (e.g. delivered messages, reviews) may remain because others rely on it.
• Withdraw consent — turn off email digests anytime from notification settings.
• Complain — email us first, then to the appropriate regulator if you're not satisfied.

The platform is not directed at children under 13. We don't knowingly collect data from children under 13. If you believe a child has signed up, email us and we'll remove the account.

Our servers are operated by Supabase and Vercel and may be located outside Malawi. Where data crosses borders, we rely on providers that use industry-standard encryption and contractual safeguards.

We use a small number of strictly-necessary cookies:

• Session cookie — to keep you signed in.
• Preferences — currency and theme.

We do not use third-party advertising trackers, Facebook Pixel, Google Analytics or similar. Aggregated usage metrics stay on our own servers.

If we change this policy materially, we'll show a notice on the site and update the “Last updated” date above.

Privacy questions, requests, or complaints — email info@malawilivinghub.com.