Privacy Policy

Summary

Makaani is a community platform connecting members with local brands, restaurants, mentors, and exclusive experiences. We collect only the personal data we need to run the service. We don’t sell your data, we don’t share it with advertising networks, and we don’t track you across other apps or websites.

This page explains what we collect, how we use it, who we share it with (a short list), how long we keep it, and how you can access, export, or delete it.

Who we are

“Makaani” refers to the company operating the Makaani website (makaani.world), the Makaani Dashboard at dashboard.makaani.world, and the Makaani iOS app distributed on the App Store. We are the data controller for personal data collected through any of these surfaces.

For privacy questions, write to privacy@makaani.world. For everything else, hello@makaani.world.

What we collect

The information below is the complete list. If you can think of something not on it, we don’t collect it.

Information you give us directly

• Account details — name, email address, and a password hash. Required to sign in.
• Profile content — optional profile photo, phone number, company name, website, and bio.
• Account type and membership tier — whether you signed up as a member, business, or community partner; whether you’re on the Pro or Enterprise plan.
• Listings, events, discounts, and submissions — anything you publish or submit for review on the platform, including titles, descriptions, photos, location, and tags.
• Reservations and booking history — items you reserve and the venues they’re tied to.
• Support correspondence — anything you send us through email or a contact form.

Information we collect automatically

• Authentication tokens — short-lived JWTs stored in your device’s secure keychain so you stay signed in.
• Push notification token (iOS) — if you opt in to notifications, your APNs device token. Used only to deliver transactional alerts (review queue items, system updates). We don’t use it for marketing pushes.
• Server logs — IP address, request URL, user agent, and timestamp. Kept short-term for security monitoring and to debug bugs.
• Stripe customer ID — if you subscribe. The card number and full payment details live with Stripe; we never see them.

What we do not collect

• Precise location (we don’t request that permission).
• Contact list, calendar, or photos beyond what you explicitly upload.
• Cross-site browsing or third-party tracking identifiers.
• Microphone or camera input outside the in-app upload flow.

How we use it

• To run the platform — authentication, publishing your content, processing reservations, sending you transactional notifications.
• To communicate with you about your account, security, and changes to the service.
• To prevent fraud, abuse, and to enforce our terms.
• To meet legal obligations (tax records, lawful requests).

We don’t use your data for advertising. We don’t profile you or sell behavioral data.

Who we share it with

A short list of processors, each bound by a data-processing agreement and used only for the purpose noted:

• Stripe — payment processing for subscriptions. Subject to Stripe’s privacy policy.
• Resend — transactional email delivery (verification codes, password resets).
• MongoDB Atlas — managed database hosting our application data.
• Apple — push notification delivery via APNs (iOS only).

We don’t share your data with any other third party except when legally required (e.g. court order) or to protect against fraud.

Where it’s stored

Application data is stored on European Union infrastructure. Some processors (Stripe, Apple, Resend) operate globally; cross-border transfers happen under standard contractual clauses or equivalent safeguards.

How long we keep it

• Account data — for the lifetime of your account.
• Listings and submissions — for the lifetime of your account or until you delete them, whichever comes first.
• Server logs — up to 30 days.
• Backup snapshots — up to 30 days after deletion before being purged.
• Records we’re legally required to keep (e.g. invoicing) — for the period required by law.

Your rights

Under GDPR (and similar regimes), you have the right to access, correct, export, restrict, or delete your personal data, and to object to certain processing. To exercise any of these, write to privacy@makaani.world. We respond within 30 days.

Deleting your account

You can delete your account at any time directly inside the app — open the More tab and tap Delete Account. This permanently removes your profile, listings, reservations, and member record from our active database. Backup snapshots are purged within 30 days.

If you don’t have access to the app, email us at privacy@makaani.world from the address on your account and we’ll process the deletion manually.

Children

Makaani isn’t directed at children under 16 and we don’t knowingly collect data from them. If you believe a child has signed up, contact us and we’ll remove the account.

Security

Authentication tokens are stored in your device’s secure keychain. Passwords are hashed with bcrypt before storage. Traffic between your device and our servers is encrypted with TLS. We don’t expose internal database IDs or tokens in URLs.

Despite reasonable safeguards, no system is perfectly secure. If you suspect unauthorized access to your account, email privacy@makaani.world and we’ll investigate immediately.

Changes to this policy

When we make material changes we’ll update the “last updated” date above and notify you in-app or by email. Continued use of the service after a change constitutes acceptance of the revised policy.

Contact

Privacy questions: privacy@makaani.world
General contact: hello@makaani.world