Security Practices

Genuine Sugar Mummies Kenya Security

How We Protect Your Account and Data

This page explains what we do to keep accounts and payments safe. It also covers the things we will never ask for. If a message claiming to come from us contradicts anything below, that message did not come from us.

Last reviewed August 2026

Encrypted Connection

We serve every page over HTTPS with a valid certificate. This encrypts everything you send us in transit. Your browser shows a padlock throughout the site, including at login and payment.

If you reach a version without that padlock, or on a domain that looks nearly but not quite like ours, close it immediately. Our only official address is genuinesugarmummies.co.ke.

Admin Account Protection

  • We restrict administrative access to only the accounts that need it.
  • Admin passwords are long, unique to this site, and not reused anywhere else.
  • The server bans IP addresses that brute-force the SSH port or flood the site with requests.
  • Web and server access logs are kept, so an incident can be traced back through them.

Installing the Genuine Sugar Mummies app Safely

We distribute the Genuine Sugar Mummies app as a direct download from this website, not through an app store. Android warns you before installing it. That warning is normal for apps outside the Play Store. However, it also means you must be careful about where the file comes from.

  • Only download from genuinesugarmummies.co.ke directly.
  • Check the address bar reads genuinesugarmummies.co.ke before tapping.
  • Turn “install from unknown sources” back off after installation.
  • An APK sent to you on WhatsApp or Telegram did not come from us.

Payment Security

Payments run through M-Pesa and Airtel Money using their own systems. You enter your PIN on your phone, never on our site. We never see or store your PIN.

Admin Mary G confirms payment using the transaction ID you send. The official numbers appear on the Payment Instructions page. Therefore, always check any number against that page before sending anything.

What We Will Never Do

  • Ask for your password or M-Pesa PIN under any circumstances.
  • Ask you to pay a personal number not listed on our payment page.
  • Contact you from a personal social account demanding money.
  • Threaten to expose your information unless you pay.

If anyone does any of the above, they are impersonating us. Report them through the scam report page immediately.

Your Security Responsibilities

  • Use a password you do not use on any other website or app.
  • Never share a verification code with anyone, including anyone claiming to work for GS.
  • Keep first meetings in public places. Read our Trust and Safety guide.
  • Stay cautious around anyone who avoids verification or rushes you off the platform.

Reporting a Security Problem

If you think someone gained access to your account, or you found a weakness in this site, write to [email protected] right away.

Security researchers are welcome here. We will not pursue anyone who reports a genuine issue responsibly and without accessing other members’ data.

Report a Security Issue

Quick check: The only official GS domain is genuinesugarmummies.co.ke. The only official Telegram is @GSADMINMARYGAGENCY. Any other page, group, or account claiming to represent GS is fake. Report it through our scam report page.

Compliance: whose law this runs under

The section above is about keeping your account and your money safe. This one is about the rules the site itself works under, and what you can require of us — in Kenya, elsewhere in Africa, and from further afield.

Those describe how this site operates, each linking to the page that sets it out. They are not certifications, and nobody has audited them. If you see a trust seal or a certification badge on a site like this one, ask who issued it before you believe it.

Kenya — where this site is run from

The site is published from Kenya and every listing on it is for a Kenyan town or county. Personal data is processed here, under the Data Protection Act, 2019. The lawful basis is consent: a listing goes live only after the person it describes has given their details and agreed to publication, and an enquiry is passed on only when both sides have agreed to it.

Under that Act you may ask what we hold about you, ask for it to be corrected, and ask for it to be deleted. Those requests go through the data deletion page and are answered by the same desk. The privacy policy sets out what is collected and how long it is kept.

Two further Kenyan laws matter here. The Computer Misuse and Cybercrimes Act, 2018 covers impersonation and fraud — which is what someone is committing when they pose as this desk and ask you for money, and why the report page exists. The Sexual Offences Act, 2006 is why the age rule here is absolute: adults aged 18 and over, both sides, no exceptions.

East Africa and the rest of the continent

Requests are taken from outside Kenya — the pricing page has a tier for exactly that. Wherever you write from, your data is processed in Kenya under the Act above, and the rights described there are the ones you can exercise.

If you are reading from an East African Community country — Uganda, Tanzania, Rwanda, Burundi, South Sudan, Somalia or the DRC — your own country has its own data law, and several read closely on consent and deletion: Uganda’ s Data Protection and Privacy Act, 2019, Tanzania’ s Personal Data Protection Act, 2022, and Rwanda’ s Law No. 058/2021. Elsewhere on the continent the comparable laws are Nigeria’ s Data Protection Act, 2023, South Africa’ s POPIA, 2013 and Ghana’ s Data Protection Act, 2012.

We do not claim to be registered or certified under any of them. What we do is simpler, and you can hold us to it: we ask before we publish, we do not publish anyone’ s contact details, and we delete on request — whichever country the request comes from.

Reading from the UK, the EU, the UAE or the United States

The same applies. A request to see, correct or delete your data is answered the same way whether it arrives from Nairobi, London, Dubai or Houston, and that is the substance of the access and erasure rights the UK GDPR, the EU GDPR, the UAE’ s Federal Decree-Law No. 45 of 2021 and the various US state privacy laws each give their own residents.

Be clear about what this site is, though: the listings are in Kenya, and an introduction is arranged between people who can actually meet. If you are outside the country, the international tier exists to coordinate that — not to offer a service operating where you are.

Money, and what is published before you pay

Every amount is published on the pricing page in Kenya Shillings before anything is paid, together with what it covers. Payment runs through the mobile-money providers’ own systems, so your PIN is entered on your own phone and never reaches this site. The payment instructions carry the only receiving details we use; a number that reaches you any other way is not ours.

What happens when an introduction is not as described is written out in the refund and cancellation policy, limits included — read it before you pay, not after.

Something here out of date, or a right you want to exercise? Write to the desk through the support page, or use the data deletion form directly.