Legal
Privacy Policy
In effect from .
MoneyWave is a free, publicly scored directory of China–Africa sourcing agents, operated by The Walker Ledger Limited, a company registered in Nairobi, Kenya. To browse it we ask for nothing. A free account needs only an email address — there is no password to lose. We never see or store a card number. We publish information about listed businesses that we gathered from their own public posts, and anyone listed can have that corrected or removed by emailing us.
What we collect from you
Only what a feature actually needs, and nothing to browse. The list below is exhaustive for the directory.
| What | When | Why |
|---|---|---|
| Email address | When you create a free account | It is your identity here — there is no username or password |
| A one-time sign-in code | Each time you sign in | Stored only as an irreversible hash and deleted after 10 minutes |
| A session record | While you are signed in | So you stay signed in; expires automatically |
| Your WhatsApp number | When you create a free account | To keep one account to one person. Never shown to sellers, never published, and not used to message you unless you separately ask us to |
| A one-time verification code | When you verify your number | Sent to you on WhatsApp. Stored only as an irreversible hash and deleted after 10 minutes |
| Your Google profile | Only if you sign in with Google | Your name, profile picture, language setting and Google account id, sent to us by Google as part of the sign-in |
| Your ratings and written reviews | When you rate or review a seller | To show the community total and your own review back to you |
| Your saved sellers | When you star a listing | Visible only to you |
| A billing customer reference | If you subscribe | Held by Stripe; we store only their reference to it |
| Your IP address | When you request a sign-in code | To stop one address requesting thousands of codes. Not retained as a profile |
| How you found us | Once, when you create an account | The ad, campaign or website that brought you here, so we know which advertising is worth paying for |
| Recipient and transfer details | Only if you use the payment widget | Passed to the payment provider to make the payment |
We never ask you to type your name, your address or your date of birth. We do ask for your WhatsApp number, and it is the one thing here you cannot skip. An email address takes seconds to create, so an account identified only by one is not really an account — it is a queue ticket anybody can take twice. A WhatsApp number is harder to duplicate, which is what lets us keep the directory to one account per person. We send a six-digit code to it once, and that is the whole of it.
Being able to reach you is a separate question, asked separately, with the box unticked. Verifying your number does not put you on any list. If you never tick that box we will never message you on WhatsApp — the number simply sits against your account as proof it is yours. You can change the number, or withdraw the messaging consent, at any time from your account page.
One thing arrives without us asking. If you choose Continue with Google, Google sends your name, profile picture, language setting and its own account reference along with your email address — that is part of how the button works, not a separate question we put to you. We keep it with your account and it is deleted with your account. Signing in with an emailed code instead means we never receive any of it.
Your profile picture is the one piece of that we show back to you, in the circle at the top right of every page. It is loaded straight from Google rather than copied onto our servers, which means Google can see that your account is active each time a page of ours loads it. We send that request without telling Google which page you are on. If you would rather it did not happen at all, signing in with an emailed code means there is no picture to load.
“How you found us” is a single snapshot taken the first time you arrive — the advertisement you clicked, or the name of the site that linked to you, plus the page you landed on. It is attached to your account only if you go on to create one, and it is never updated afterwards.
Remembering which sellers you open
Only if you say yes. We ask once, we keep it for 90 days, and you can see or delete it whenever you like.
If you agree, we keep a list of which seller pages you open and when. That is the whole list — the seller and the time. We do not record how long you stayed, how far you scrolled, what you searched for, or which pages you visited anywhere else.
Nothing is recorded until you agree. We ask once, when you sign in, and you answer yes or no before going any further. Until you answer yes, we store nothing at all — and saying no deletes anything already collected.
Browsing you do before signing in is not recorded, because you have not been asked yet. The list starts from the moment you say yes. If you decline, or you never sign in, no such list exists for you.
It is kept for 90 days and then deleted automatically. You can see everything we hold, or erase all of it, from your account. Erasing it also switches the recording off.
We use it to show you your recently viewed suppliers, and to understand which listings people find useful so we can improve the directory. We do not sell it, and it is never shared with the sellers themselves— a seller is never told who looked at their page.
Lookups, purchases, and reminders
We keep a record of the suppliers you have unlocked, what you bought, and — if you started a purchase and did not finish — that you did, for up to 60 days.
Opening a supplier costs a lookup. So we keep which suppliers you have unlocked and how many lookups you have left. That record is what makes a supplier you have already paid for open again for free, so unlike the list above it is not optional and it is not deleted on a timer — it is what you bought.
We keep your orders too: which pack, the amount, the currency and the payment method. Card and bank details never reach us — those are entered on the payment provider’s own page, and what comes back to us is whether the payment succeeded.
If you reached the payment screen and did not finish, we note that — the time, and which supplier you were trying to open. It is one line, it is replaced rather than added to each time, and it is deleted the moment you pay. If you never come back it is deleted automatically after 60 days.
We use that one line to send you a reminder about your own unfinished purchase — at most two, roughly half an hour and a day afterwards, and never again for the same visit. Every reminder email carries a one-click unsubscribe link that works without signing in, and we send them on WhatsApp only to people who have separately agreed to be messaged there. You can turn both off from your account, and telling us to stop stops all of it — we do not treat “unsubscribe from the newsletter” as permission to keep sending these.
A receipt is different and is not marketing. When a payment succeeds we email you a confirmation of what you bought, and message it to you on WhatsApp if you have given us a number. That one is part of the purchase, so it is not something you can opt out of while still buying — you would have no record of what you paid for.
What we never hold
Three things worth stating explicitly, because people reasonably assume otherwise.
- No card numbers. Subscription payments go through Stripe's own hosted checkout. Card details are entered on Stripe's page and never reach our servers.
- No passwords. There are none to steal. Signing in sends a code to your email, and even that code is stored only as a hash that cannot be reversed back into the code we sent you.
- No reading of your private messages. Everything in the directory comes from posts and comments that were already public. We have no access to anyone's DMs, WhatsApp groups or private orders, and nothing in the trust signal is derived from them.
People and businesses we list
This is the part of the directory that involves information about people who did not sign up for it, so it is set out in full.
The directory describes sourcing agents, importation coaches and suppliers who advertise publicly on TikTok, Instagram, YouTube and LinkedIn. Some are companies; some are individuals trading under their own name or handle. Either way, we treat what we publish about them as personal information and hold ourselves to the rules below.
| What we publish | Source |
|---|---|
| Display name, handle, platform, and a link to the profile | The public profile itself |
| Category, product type, and the countries served | Assessed from public posts |
| Contact details | Only where the seller published them publicly, e.g. in a bio |
| Quotes from buyer comments | Public comments left under the seller’s own public posts |
| Two or three images | The seller’s own public posts, republished with a link back to each |
| A trust signal from 1 to 5 | Computed from the above — an observation, never an endorsement |
No seller pays to be listed, and no seller can pay to rank. Listing is not a commercial relationship and never has been. We sample public posts and the comments underneath them, and we re-check the directory weekly.
Our lawful basis is legitimate interest — helping buyers in a market with a well-documented fraud problem assess who they are about to send money to, using only information the trader chose to publish. We have weighed that against the interests of the people listed, which is why the directory carries no private information, no unverified allegation, and no contact detail the seller did not publish themselves.
If you are listed and want something changed or removed, email support@madhousewallet.com from an address or account we can tie to the listing. You can ask us to correct a fact, remove a specific quote or image, or take the listing down entirely. We do not require a reason, and we do not charge for it. Removal means the listing stops being served — we keep a record of the request itself so the weekly refresh cannot quietly put it back.
Cookies and what is stored on your device
One cookie is essential. The rest are analytics and advertising, and they are switched off by default for visitors in the UK and EEA.
| Name | Type | Purpose |
|---|---|---|
| mw_sess | Essential cookie | Keeps you signed in. Not readable by scripts. Expires on sign-out |
| mw_directory_view | Stays on your device | Remembers your filters and page so the Back button returns you to the same view |
| _ga, _gcl_* | Analytics / advertising | Google Analytics and Google Ads measurement |
| reCAPTCHA cookies | Security | Only where reCAPTCHA is enabled, to tell people from bots |
We use Google Consent Mode. For visitors in the UK and the European Economic Area, advertising and analytics storage are denied by default before any Google tag runs. We do not currently advertise to those regions; if that changes, a consent banner will appear before anything is set.
Analytics and advertising
We measure which pages bring people to the directory and whether they sign up. We do not sell anything about you, and we never have.
We use Google Analytics and Google Ads. Where you create an account or subscribe, we report that to Google Ads as a conversion so we know which advertising is worth keeping. To match that conversion to a click, Google supports sending a customer identifier.
We send your email address only as an irreversible SHA-256 hash, computed in your browser. The raw address is never placed where an advertising tag can read it. Google cannot recover the address from the hash; it can only compare it to a hash of an address it already had.
While you are signed in we also send Google Analytics an account number — never your name, and never your email address. It is the internal reference for your account on our own systems, and it is meaningless to anyone who does not hold our database. We send it so that a return visit on your phone and on your laptop counts as one person rather than two, which is the only way we can tell whether people come back. Alongside it we record whether a visit is signed in or signed out, so we can see which pages members read. Both stop the moment you sign out.
Two things we deliberately do not send: nothing about the amount or destination of any payment, and no paid directory content. Reviews and sentiment behind the subscription never leave our servers for an advertising platform.
Who else processes it
Every company below is a service we run the site on. None of them is given your information to use for their own purposes.
| Who | What for | What they receive |
|---|---|---|
| Stripe | Subscription billing and identity checks | Your email and payment details you enter on their page |
| Amazon Web Services | Hosting, sign-in email, image delivery | Your email address, to send you a code |
| MongoDB Atlas | The database | Everything described above, stored |
| Sign-in, analytics, advertising, reCAPTCHA | Usage data; your account number while signed in; a hashed email on a conversion; and, if you use the Google sign-in button, the fact that you signed in here | |
| Trustpilot | Inviting you to review MoneyWave, once, if you buy lookups | Your email address, blind-copied on your purchase receipt |
| Madhouse Wallet | The payment rail, if you use it | What a payment needs: amount, recipient details, your contact details |
The payment rail is operated by a separate company and handles your payment information under its own privacy policy and its own regulatory obligations. MoneyWave is a customer of that product, not the provider of the payment service.
How long we keep it
Everything with a natural expiry has one set in the database rather than left to a cleanup job someone remembers to run.
- Sign-in codes — deleted automatically 10 minutes after they are issued, and immediately once used.
- Sessions — deleted automatically when they expire, and on sign-out.
- Your account, reviews and saved sellers — until you ask us to delete them.
- Subscription records — kept while the subscription is active and afterwards for as long as tax and accounting rules require.
- Payment records — retained by the payment provider under its own regulatory obligations, which are longer than ours and which we cannot shorten.
Your rights, and how to use them
Email us and we will do it. You do not need to cite a regulation and we will not ask you to.
- See what we hold about you.
- Correct anything wrong.
- Delete your account and everything tied to it.
- Object to a listing that describes you or your business.
- Take your data with you, in a machine-readable form.
- Complain to your local data protection authority if we get it wrong.
Write to support@madhousewallet.com. We aim to answer within 30 days. Deleting your account removes your reviews from public view; the seller's total review count is recalculated so nothing is left pointing at a person who is gone.
How it is protected
The design does more of the work here than any promise could.
- Sign-in codes are stored only as keyed hashes, so a copy of the database cannot be replayed into anyone’s account.
- The session cookie cannot be read by scripts running on the page.
- Paid directory content is filtered out on the server before a page is sent, so it is absent from the page rather than hidden in it.
- Everything travels over an encrypted connection.
No system is perfect. If you believe you have found a security problem, email support@madhousewallet.com and we will take it seriously.
Where your information goes
We are based in Nairobi, Kenya, our servers and service providers are primarily in the United States, and the directory serves readers across Africa, Europe and elsewhere.
Using the site means your information is processed in countries that may have different data protection rules from your own. Where information moves out of the UK or the European Economic Area, we rely on the standard contractual protections our providers offer for those transfers.
Children
This is a service for businesses. It is not directed at anyone under 18, and we do not knowingly collect information from them.
If you believe a child has created an account, tell us and we will remove it.
Changes to this policy
When we change something that matters, we update the date at the top of this page and, for material changes, tell account holders by email before it takes effect.
Contact us any time at support@madhousewallet.com.