Cottlink Privacy Policy

Last updated: 12 October 2026

Cottlink (cottlink.com and the Cottlink Android app) is a business directory and blog with listings in Kenya and the USA. It is run by the Cottlink team in Nairobi, Kenya ("Cottlink", "we", "us"). This policy explains what personal data we collect, why, and your choices. We handle data under the Kenya Data Protection Act, 2019. Where they apply, we also follow the main principles of the EU GDPR and California's CCPA.

1. Data we collect

When you create an account: your name, email address, phone number, password (stored only as a one-way hash, never in plain text), account type, region and city, and whether you asked for a verification badge.

When you list a business: business name, description, category and subcategory, country, city, town and location, business phone and email, opening hours, contact-button settings, and any photos, logo or verification documents you upload. Listing details are shown publicly on cottlink.com so customers can find and contact you.

When you buy a listing package: the package, the amount, and the payment status and reference. Payments are processed by Paystack. We do not see or store your card or mobile-money details.

When you use the contact form: your name, email, phone, subject and message.

Automatically: basic usage data through Google Analytics (pages visited, device and browser type, approximate location, and a cookie-based ID), plus standard server logs (IP address, time, page requested) kept by our host.

Contacting a business: when you tap Call, WhatsApp or Email on a listing, your phone or WhatsApp app opens directly. We don't receive the contents of that conversation.

2. Why we use it

• To run your account and show your listings (this is our contract with you).
• To process package payments and keep payment records (contract and legal duties).
• To answer messages and support requests.
• To keep the site secure and prevent fraud or fake listings (legitimate interest).
• To understand how the site is used and improve it (legitimate interest or consent, where required).

We do not sell your personal data, and we do not use it for third-party advertising.

3. Who we share it with

• Paystack: payment processing.
• Google (Analytics and Search Console): site statistics and search performance.
• Hostinger: website and database hosting.
• The public: listing details you choose to publish.
• Authorities: when the law requires it.

Some of these providers store data outside Kenya. We rely on their standard safeguards for such transfers, as the Data Protection Act requires.

4. Cookies

We use:

• an essential login/session cookie to keep you signed in ("remember me" keeps it longer);
• Google Analytics cookies to measure traffic.

You can block or delete cookies in your browser. If you block the login cookie, you won't be able to sign in.

5. How long we keep data

• Account and listing data: while your account is active, and deleted within 30 days of a deletion request.
• Payment records: kept for up to 7 years for tax and accounting.
• Contact messages: up to 12 months.
• Analytics data: per our Google Analytics retention settings (up to 14 months).
• Backups: may hold deleted data for a short period, up to 30 days.

6. Your rights

You can ask to access, correct, delete or export your data. You can also object to or restrict how we use it, and withdraw consent. Write to cottlink.tech@gmail.com and we'll reply within 30 days. In Kenya you may complain to the Office of the Data Protection Commissioner (www.odpc.go.ke). In the EU or UK, you can complain to your local regulator. California residents have the CCPA right to know and delete, and we do not sell or "share" personal data for cross-context advertising.

7. Delete your account and data

This applies to the website and the Cottlink Android app (com.cottlink.app).

1. Email cottlink.tech@gmail.com from the email address on your Cottlink account, with the subject "Delete my account".
2. Include your account email and the name(s) of any business listings.
3. We'll confirm we got your request, may ask you to verify you own the account, and will delete it within 30 days.

What gets deleted: your account, profile, business listings, uploaded photos and documents.

What we keep: payment records needed by law (see section 5).

You can also ask us to delete only some data, such as one listing, without closing your account. There is currently no self-service delete button; deletion is handled by email request to cottlink.tech@gmail.com.

8. Security

The site uses HTTPS encryption, and access to admin tools is restricted. No system is completely secure, so please use a strong, unique password.

9. Children

Cottlink is not intended for children under 18, and we do not knowingly collect their data. If you believe a child has given us data, contact us and we'll delete it.

10. Changes

We may update this policy. We'll change the "Last updated" date, and for major changes we'll post a notice on the site.

11. Contact

The Cottlink Team, Nairobi, Kenya

Email: cottlink.tech@gmail.com

Phone: 0704625414

Cottlink complies with the Kenya Data Protection Act, 2019.