Privacy Policy

1. Who We Are

Strictly Moris is a Mauritius-focused directory app that connects people with local businesses, service providers and activity hosts.

The app is operated by Strictly Zenko Ltd, a company incorporated in the Republic of Mauritius. Strictly Zenko Ltd is the controller of the personal data described in this policy: it decides why and how that data is used.

Strictly Zenko Ltd is registered with the Data Protection Office of Mauritius as a controller, registration number C24896, valid from 1 August 2026 to 31 July 2029. Anyone can inspect the Data Protection Register free of charge at the Data Protection Office.

We have designated a data protection officer, responsible for our compliance with data protection law. You can reach them at support@strictlymoris.mu with "Data protection" in the subject line.

View our certificate of registration as a controller (PDF)

2. Information You Give Us

When you create an account, build a listing, use the app or send a listing from our website, you give us:

• Account details: your name, your email address and your password, which is stored only as a secure hash and never in plain text. If you sign in with Google or Apple, we receive your name and email address from them, and your Google profile photo if you have one; Apple may give us a private relay address instead of your email address.
• A phone number, if you choose to add one to your profile.
• Listing content, if you are a provider: your business or service name, description, categories, address and map location, town, contact details (phone, WhatsApp, email, website), social media links (Instagram, Facebook, TikTok), opening or working hours, keywords, qualifications, certifications, years of experience, rates, events, classes, catalogue items, photos (up to five per listing) and one PDF document.
• A listing we prepare for you: with your permission, we may create your listing from the details you give us, and send a link to claim it to the listing’s phone number by WhatsApp.
• A listing you send from our website, without the app: your email address, which we confirm with a code we email to it, your phone number, and the listing details above with its photos and document. We check whether that email address or phone number is already on Strictly Moris, to tell you, to avoid duplicate listings and, if the email address belongs to an account with no listing, to add the listing to that account. Until we have checked the listing, it is kept apart from the app and only our team can see it.
• Messages you send to other users, and the quick replies you save.
• Reports and blocks you submit, with any reason you give.
• Your choices in the app: saved listings, notification settings, and the conversations you mute or hide.
• Your agreement to our Terms of Service, this policy and our User and Provider Policies, recorded with the date and the version you agreed to.
• Anything you write to us by email.

3. Information Collected Automatically

When you use the app or our website, we also collect:

• Location: your device’s location while the app is open, and only if you allow it, and, if you set one, a place you choose as your location in Account. Either is sent with your searches and lists to show the nearest results first, and neither is stored on our servers. The place you choose stays on your device until you remove it; your device’s location is not stored. Without either, results are shown newest first.
• Account activity: when you were last active (shown as "Online" or "last seen" to the people you have a conversation with), read receipts on messages, and when you agreed to our policies.
• Listing statistics, if you are a provider: how many times your listing was viewed, saved and shared, and how often its call, WhatsApp, email and website buttons were tapped. These are counts; they do not tell anyone who viewed or tapped.
• Your push notification token, if you allow notifications, so that we can deliver alerts to your device.
• Technical data: your IP address and the details of each request, kept briefly by our hosting provider and used to protect the service (for example, to limit how often one device can count a view).
• Error reports: when the app crashes or something fails, a report with the device model, operating system, app version and your account ID (never your name, email address or phone number) is sent to Sentry so that we can fix the problem.
• The history of changes to a listing: which fields were changed, by which account and when — not the old or new values.
• On our website’s listing form: your IP address, to limit how many attempts come from one network — we keep it only as a one-way code (a hash), for up to two days after the last attempt — and the signals Cloudflare Turnstile reads from your browser to check that you are a person and not a bot. Cloudflare receives your IP address too (section 9).

4. Information We Do Not Collect

We do not collect:

• Advertising identifiers or cross-app tracking data
• Your contacts, calendar, SMS, call logs or browsing history
• Your location while the app is closed
• Biometric data
• Payment card details — Strictly Moris takes no payments

We do not ask for special categories of personal data, such as health, religion or political opinions. Please do not include them in a listing or a message.

5. What We Use Your Data For, and Our Legal Basis

The Data Protection Act 2017 allows us to use personal data only on a lawful basis. We use yours:

• To provide the app you signed up for — your account and sign-in, publishing and managing your listing, messaging, saved items, and notifications about your account, your listings and your messages. Legal basis: the performance of our contract with you (our Terms of Service).
• To check and publish a listing you send from our website, to email you about it, and to call you or message you on WhatsApp on the number you gave if we need to check something. Legal basis: the steps you ask us to take before entering into a contract with you, then the performance of that contract (our Terms of Service).
• To use your location and to send you push notifications. Legal basis: your consent, given through your device’s permission prompt, which you can withdraw at any time in your device settings.
• To keep the service safe and working — reviewing listings before they go live, handling reports and blocks, limiting requests, the robot check on our website, preventing fraud and abuse, fixing errors and keeping a record of moderation decisions. Legal basis: our legitimate interest in running a safe and reliable directory, which we balance against your rights.
• To show providers statistics about their own listing. Legal basis: the performance of our contract with the provider.
• To send you announcements or marketing about Strictly Moris. Legal basis: your consent. You can withdraw it, or object to direct marketing, at any time (see section 15).
• To comply with the law — for example, to answer a lawful request from the police or a court. Legal basis: compliance with a legal obligation.

6. What You Must Give Us, and What Is Optional

To create an account, you must give a name, an email address and a password, or sign in with Google or Apple. Without them we cannot create your account. You can browse as a guest without giving us any of these.

To publish a listing, you must give the details the listing form marks as required — a category, a name, a description, keywords, an address confirmed on the map (on our website, you can type it instead, and we place it on the map), at least one photo, at least one way to contact you, your hours where they apply, and your agreement to the Provider Policy. Without them we cannot publish the listing. Everything the form marks "Optional" is up to you.

To send a listing from our website, you must also give an email address, which we confirm with a code, and a Mauritius phone number, and pass the robot check. Without them we cannot accept the listing.

In the app, the phone number on your profile, your location and notifications are optional. Saying no only means that the related feature is not available — for example, results cannot be sorted by distance without your location or a place you choose.

7. What Is Public and What Is Private

Everything in a published listing — photos, description, address and map location, contact details, social links, hours, rates and documents — is public. Anyone can see it in the app, including people browsing without an account, and on the listing’s page on our website, which anyone with the link can open and search engines may find. Treat a published listing as public information.

A listing you send from our website is not public until we have checked and published it. It then shows the phone number you gave; your email address appears on it only if you ticked the box to show it.

Your name and profile photo are shown to the people you exchange messages with, together with when you were last active. If you own an approved listing, other signed-in users may also see your name and profile photo.

Your email address, the phone number on your profile, your password, push token, private messages, saved items, settings and listing statistics are private.

8. Who We Share Your Data With

We do not sell or rent your personal data. We share it only:

• With other users, through the public parts of your listing and the messages you choose to send.
• With the companies that process data for us (section 9), on our behalf and only to run Strictly Moris.
• With our moderation team, who can read a conversation only when it has been reported to us; every time they open one is logged.
• With the police, a court or a regulator, when the law requires it and after we have checked the request.
• With a buyer or successor, if Strictly Zenko Ltd is merged, acquired or restructured. We will tell you before your data is transferred.

9. Companies That Process Data for Us

These companies process personal data on our behalf:

• Supabase — hosts our database, sign-in, file storage and real-time messaging, and sends sign-in emails such as password resets. Our data is stored in its Mumbai, India region.
• Google — Google Maps and Places for maps and address search (what you type in an address field is sent to Google), Google Sign-In if you choose it, Google’s document viewer to display PDF documents on Android, and Firebase Cloud Messaging to deliver notifications to Android phones.
• Apple — Sign in with Apple if you choose it, and the Apple Push Notification service to deliver notifications to iPhones.
• Expo — passes push notifications on to Apple and Google, including the sender’s name and the first 100 characters of a new message.
• Sentry — receives the error reports described in section 3.
• Vercel — hosts our website, including its listing form, and our internal administration tools.
• Cloudflare — Turnstile, the robot check on our website’s listing form. It receives your IP address and signals from your browser.
• Resend — delivers our emails.
• ImprovMX and Google (Gmail) — forward and store the emails you send to support@strictlymoris.mu.
• WhatsApp — carries the messages we send you about your listing, including the link to claim a listing we prepared for you when we send it there.

Each provider handles the data under its terms of service with us and has its own privacy policy.

10. Transfers Outside Mauritius

Our providers store and process data outside Mauritius. Our database and files are stored in India (Mumbai), and Expo, Sentry, Vercel, Resend, Cloudflare, ImprovMX, Google, Apple and WhatsApp process data in the United States and in other countries where they operate.

These countries may not protect personal data to the same standard as Mauritius. We transfer your data to them because it is necessary to provide the app you asked for, or to check and publish the listing you sent from our website, and we protect it through the providers’ commitments on security and confidentiality, encryption in transit, and access rules that limit who can read it.

11. Messages, Reports and Moderation

Messages are visible only to you and the person you are writing to. We do not read private messages, except when a conversation is reported to us — our moderation team can then read it, and the report keeps a copy of up to the last 50 messages as evidence — or when the law requires it.

"Delete for me" hides a message from you only; the other person still has it. You can block any user, and a blocked user cannot message you.

To prevent spam, one account can send at most 30 messages a minute and 10 reports an hour.

12. Automated Decisions

We do not make decisions about you based solely on automated processing, and we do not profile you. Every listing is reviewed by a person before it goes live. Search results are ordered by how well they match your search, whether a listing is featured, and distance — not by anything we infer about you. Automatic limits only protect the service, and none of them is final: the message and report limits above; the robot check on our website; and the website form’s checks, which stop a listing when its email address already has a listing, belongs to an account we have suspended, is already a listing’s contact or has already sent a listing, or when the email address or phone number has sent 3 listings in 30 days. The form tells you why, and if you email us, a person looks at it.

13. How Long We Keep Your Data

We keep personal data only for as long as we need it:

• Your account, profile and listings: until you delete them or your account.
• Messages: for as long as the conversation exists. Deleting your account deletes your conversations.
• Notifications: 13 months. The records of save and view milestones, which stop the same alert being sent twice, are kept while your account exists.
• Listing statistics: daily figures for 13 months, then one total per month, for as long as the listing exists.
• Records used to limit requests (an account ID, an IP address, or a one-way code made from an IP address or an email address): up to two days after the last attempt.
• A listing you send from our website: if you do not finish it, about a week after you last asked for a code, confirmed your email address or added or removed a file. While it waits for our check, until we decide. Once we publish it, the photos and document we held for review and the form you sent are deleted; the record of our decision (your email address and phone number, and which listing it became) is kept for 90 days, and the listing itself until you ask us to remove it — or, once it is in your app account, until you delete it. If we reject it, its photos and document are deleted at once and the rest is kept for 90 days. If your email address was already on Strictly Moris, the record, with any photos and document you had uploaded, is kept for 90 days. You can ask us to delete it sooner (section 15).
• The codes our website’s listing form emails you: they work for 10 minutes. A used code is deleted at once, an expired one within a day.
• Error reports: a limited period set by Sentry, at most 90 days.
• Backups: deleted data can remain in our encrypted database backups for up to 30 days before they are replaced.
• Emails you send us: as long as we need them to deal with your request.

When you delete your account, everything tied to it is deleted at once: your profile, your listings with their photos, documents, events, catalogue items and classes, your conversations, saved items and notifications, the reports you submitted and your edit requests. We keep only the reports other users made about you or your listings, with any messages they captured, and our record of moderation decisions — for as long as needed to keep the service safe and to deal with possible legal claims.

Our record of a listing you sent from our website is not part of your account: it is kept as described above, whether or not you have one.

14. Security and Data Breaches

Data is encrypted in transit between your device and our servers, and passwords are stored only as secure hashes. Our database applies access rules to every request, so each account can reach only its own private data, and our administration tools require two-step sign-in.

No system is perfectly secure. If a personal data breach happens, we will notify the Data Protection Commissioner without undue delay and, where feasible, within 72 hours, and we will tell you directly if the breach is likely to put your rights and freedoms at high risk.

15. Your Rights

Under the Data Protection Act 2017, you have the right to:

• Access: ask whether we hold personal data about you and receive a copy, together with what we use it for, who receives it and how long we keep it.
• Rectification: have inaccurate or incomplete data corrected. You can edit most of it yourself in the app, or ask us.
• Erasure: have your data deleted. You can delete your account yourself at any time from Account → Delete Account, or ask us by email (see strictlymoris.mu/delete-account).
• Restriction: ask us to limit how we use your data while a question about it is being resolved.
• Objection: object at any time to our use of your data based on our legitimate interests, and to direct marketing. We stop direct marketing as soon as you object.
• Withdrawal of consent: withdraw your consent at any time, without affecting what we did before. Location and notifications can be switched off in your device settings and in Account → Notifications.
• Complaint: lodge a complaint with the Data Protection Commissioner (see section 19).

To use any of these rights, email support@strictlymoris.mu from the address on your account, or the one you used on our website. We may ask for information to confirm your identity. We will reply in writing within one month, or within two months for a complex request, and tell you why if we cannot act on it. It is free, unless a request is manifestly excessive.

Someone else can act for you with your written authorisation, and a parent or guardian can act for a minor.

16. Children

Strictly Moris is not for children under 16. The Data Protection Act 2017 does not allow us to process the personal data of a child under 16 without the consent of a parent or guardian, so you must be 16 or older to create an account or to send a listing from our website. If we learn that an account, or a listing sent from our website, belongs to a child under 16, we will delete it. If you believe a child has created an account, please contact us.

17. On Your Device, and Our Website

The mobile app does not use browser cookies or advertising trackers. It keeps a few things on your device: your sign-in session, your theme, recent searches, recently viewed listings, unsent drafts (including copies of the photos you picked for a listing), the home area you choose in your profile, and some data for offline use. Signing out removes your session; deleting the app removes the rest.

Our website, strictlymoris.mu, uses no analytics or advertising cookies. If you reset your password there, the reset session is kept only in the page’s memory. Our hosting provider records technical logs, such as IP addresses, to deliver and protect the site.

The website’s listing form sets two cookies, both needed for it to work: one links the code we email you to your browser (30 minutes), the other keeps you signed in to the form once your email address is confirmed (24 hours). What you type in the form, with your email address and phone number, is kept in your browser so that reloading the page loses nothing. Sending the listing removes it and the cookies; otherwise the typed draft stays until you clear this site’s data, so on a shared computer use a private window. The form also loads Cloudflare Turnstile, the robot check.

18. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you inside the app and update the "Last Updated" date above.

19. Contact Us and Complaints

Strictly Zenko Ltd, operator of Strictly Moris, Republic of Mauritius. Email: support@strictlymoris.mu — put "Data protection" in the subject line to reach our data protection officer.

If you are not satisfied with our answer, you can lodge a complaint with the Data Protection Commissioner: Data Protection Office, SICOM Tower, Wall Street, Ebene, Mauritius · dpo@govmu.org · +230 460 0251 · dataprotection.govmu.org