Privacy
What Mboni keeps about you, why we keep it, and how you can ask us about it.
Last updated 24 October 2026.
Who We Are
Mboni is run by Vibrant Consult.
We are only the app. We provide the software that lets an organisation issue IDs to its people and lets anyone check one. We are not the organisation that issued an ID, and we are not the employer, agent, partner or guarantor of anyone shown in a check. We are not part of any dealing between you and that person or organisation.
What We Keep
If you hold an ID. Your name, role, relationship to the organisation, photo if one was added, phone number, email if one was added, the organisation, what you are authorised to do, the dates the ID is valid, a PIN stored only in scrambled form, and a record of each check and of the codes and notices sent to you.
If you lock your ID to your phone. Your phone checks your fingerprint or face itself. We never receive or keep it. We keep a public key that proves the check came from your phone, an ID for that key, and the dates it was set and last used. You can ask your organisation to remove it.
If you check someone. You need no account. We keep the code you typed, the time, the result, and how you checked (web, QR code or USSD). We keep a scrambled form of your network address, only to limit abuse. If you choose to share your location when you report an impostor, we keep an approximate spot, about 100 metres. Reports hold what you type into them.
If an organisation keeps a file about you. An organisation that issued you an ID may, where we have switched this on for it, store documents about its relationship with you, such as a contract, an authority letter or a copy of an ID. Those files are encrypted, and only that organisation and our managers can open them. The organisation decides what to keep and for how long, and is responsible for it. Ask the organisation first if you want a file corrected or removed.
If you work for an organisation that uses Mboni. Your name, email, role, and a record of your sign ins.
If you ask to buy. When you send an order, we keep the name, phone, email and message you give us, to contact you about it. If you do not become a client, we remove it after a year.
What Other People See
A person who checks an ID sees only a name, role, photo, organisation and what the person is authorised to do, and only after the code matches. We never show a phone number or email to the public. The organisation that issued an ID sees the checks made on its people.
Why We Keep It
To run checks, send the codes and notices that go with them, tell organisations about checks and impostor reports, bill organisations, keep the service secure, and meet the law.
Who We Share It With
The services that send our texts and emails, the payment service we use to bill organisations, and our hosting provider handle data on our behalf, and only to do that job. We do not sell personal data. We may share it where the law requires us to.
How Long We Keep It
Check records and approximate locations are removed after 180 days. Codes are removed from our message log after a day, and the rest of the message log after 90 days. An ID record stays while the ID or its organisation is active.
Cookies
We set a cookie to remember your language, and cookies that keep staff signed in. We use no advertising or tracking cookies.
Your Rights
You can ask what we hold about you, ask us to correct it, and ask us to delete it, as the Data Protection Act 2024 of Malawi allows. You can also complain to the Malawi Communications Regulatory Authority (MACRA), which is the data protection authority. To ask us, contact us through the contact details on the help page.
Changes to This Page
If we change this page, the new version replaces this one and the date at the top changes.