Privacy Policy

1. In short

We record what we need to run your account, deliver the data you pay for and keep the platform secure. We do not sell your data, we do not show advertising, and we do not use advertising or tracking cookies. You can ask to see, correct or delete what we hold about you at any time.

2. Who we are

Lenga Maps operates lengamaps.com and is responsible for the personal data described here. For anything about your data, email support@lengamaps.com.

3. Wherever you are

Lenga Maps is based in Zambia and used by people across Africa, Europe and beyond. We give everyone the same protections described here, whatever their country. The laws that apply include the Data Protection Act 2021 of Zambia and, where they cover you, the EU and UK General Data Protection Regulation (GDPR), South Africa's Protection of Personal Information Act (POPIA), Kenya's Data Protection Act 2019, Nigeria's Data Protection Act 2023, Ghana's Data Protection Act 2012 and similar laws elsewhere. Where the law of your country gives you more rights than this policy describes, you have those rights too.

4. What we record

• Your account. Name, email address, country, sector and organisation, and your team and role if you join one. Passwords are handled by our sign in provider and stored only in hashed form; we never see them.
• Payments. Your plan, the amount, the payment method (mobile money or bank transfer), the reference and the payment screenshot you upload so we can verify it.
• Downloads. Each time you download a file, from the website, the dashboard or the API, we record the dataset, the country, the format, the size, how it was downloaded and when. We use this to apply your plan, to show your team its download history, to warn you before you download the same file twice and to understand which data people need.
• Workspace. Projects, the files you upload, layers, comments, voice notes, saved views and the change history of each project.
• API use. The API keys you create and how many requests and how much data each one uses per month.
• Messages to us. What you send through the contact, quote and data request forms, and your email address if you subscribe to our newsletter.
• Technical data. Your IP address is used briefly to limit abusive traffic. Our hosting provider counts page visits without cookies and without identifying you. Error logs may include the page and time of an error.

5. Why we use it

• To provide the service you signed up for: your account, your plan, downloads, the workspace and the API.
• To verify payments and keep the records that accounting and tax law require.
• To keep the platform secure and prevent misuse, including unauthorised redistribution of datasets.
• To answer your questions and send service emails, such as payment confirmations and team invitations.
• To improve the platform, using totals such as which datasets and countries are downloaded most.
• To send the newsletter, only if you subscribed. You can unsubscribe from any newsletter email.

We rely on the contract between us for the first four, our legitimate interest in running and improving the platform for the fifth, and your consent for the newsletter.

6. Who can see it

• Your team. If you are on a team, its members can see the team's download history and the projects, comments and voice notes shared with them.
• Lenga Maps staff, only as needed to verify payments, support you and keep the platform running.
• Our service providers, who process data only on our instructions: Supabase (database, sign in and storage), Cloudflare (file storage), Vercel (hosting and visit counts) and Resend (email). Section 7 says where they keep it.

We do not sell, rent or trade personal data, and we only disclose it to authorities where the law requires it.

7. Where your data is stored

Our database is hosted in London, United Kingdom. The website runs on servers in Cape Town, South Africa. Files are stored on Cloudflare's network and emails are sent through Resend in the United States. This means your data may be stored or processed in a country other than your own. Each provider is bound by a data processing agreement that limits what it may do with your data and requires it to keep the data secure; for data leaving the European Economic Area or the United Kingdom, those agreements include the standard contractual clauses approved for such transfers.

8. Files you upload

Files, boundaries and imagery your team uploads stay in your team's private storage. They are used only to show your project to the people you invite. They are never shared, sold or published, and never added to the Lenga database. An NDA is available on request.

9. How long we keep it

• Account data is kept while your account is open.
• When you delete your account, your profile and API keys are deleted. Your download records are kept without your name or email, as anonymous counts. Comments and layers you added to shared team projects stay with that team.
• Uploaded files are deleted when the project or team they belong to is deleted, or when you ask us.
• Payment records are kept for as long as accounting and tax law requires.

10. Cookies

We use only the cookies needed to keep you signed in. There are no advertising or cross site tracking cookies, so there is nothing to accept or decline.

11. Your rights

Wherever you live, you can ask us to:

• show you the personal data we hold about you and give you a copy in a common format;
• correct it if it is wrong or incomplete;
• delete it;
• stop or limit a particular use of it, including any use based on our legitimate interests;
• withdraw your consent to the newsletter at any time.

You can delete your account yourself from your dashboard, or email support@lengamaps.com and we will respond within 30 days. We will not charge you, and we may ask you to confirm your identity first. If you are not satisfied with our answer, you can complain to the data protection authority where you live or work, for example the Office of the Data Protection Commissioner in Zambia, the Information Regulator in South Africa, the Office of the Data Protection Commissioner in Kenya, or your national authority in the EU or the UK.

12. Security

Data is encrypted in transit, files are stored in private storage reached only through short lived signed links, and staff access is limited to the people who need it. No system is perfectly secure; if a breach affects your data, we will tell you and the regulator as the law requires.

13. Children

Lenga Maps is a professional service and is not directed at children under 16.

14. Changes

If we change what we record or why, we will update this page and email active customers about material changes. See also our Terms & Conditions.