1. What Cookies Are

A cookie is a small text file stored on your device by your browser when you visit a website. Cookies let a site remember things between page loads, such as the fact that you are signed in. Some are essential for a site to work at all. Others are optional and are used to understand how a site is being used.

We also use closely related technologies, such as your browser's local storage, in the same way and for the same purposes. Where this policy says "cookies", it covers those too.

2. Cookies We Set

2.1 Strictly necessary cookies

These are required for the Service to function. Without them you cannot sign in, stay signed in, or submit a form safely. They cannot be switched off, and we do not ask for consent to set them because the Service cannot be delivered without them.

• nyumba-session — keeps you signed in as you move between pages, and holds temporary state such as form messages. Expires after 2 hours of inactivity. This cookie cannot be read by scripts in your browser.
• XSRF-TOKEN — protects forms and requests against cross-site request forgery, so that another website cannot act on your behalf while you are signed in. Expires after 2 hours.

2.2 Functional cookies

• nyumba_tenant_device — set only on the tenant portal, and only if a tenant chooses to have their device remembered when signing in. It lets that tenant return without receiving a one-time SMS code every time, which also keeps SMS costs down for their landlord. It lasts up to 180 days, and the period restarts each time it is used. It stores a random token, not the tenant's phone number or any personal information. A tenant can clear it by signing out, or by clearing cookies in their browser.

2.3 Analytics cookies

We use Google Tag Manager on our public pages, including the homepage and sign-up pages, to understand how visitors find and use the site. Google Tag Manager does not itself store cookies, but the tools it loads may set their own, typically to recognise a returning visitor and to group page views into a single visit. Where analytics cookies are set, they can last up to two years.

These cookies are not essential. They are not used inside the landlord dashboard or the tenant portal, and they are not used to build a profile of you or to target advertising.

3. Third Parties

Some cookies are set by services we rely on rather than by us directly:

• Google — for the analytics described above. Google's own privacy notice is available at policies.google.com/privacy.
• Firebase (a Google service) — used for account sign-in and email verification. It may store authentication state in your browser so you are not asked to sign in repeatedly.

We do not sell your data, and we do not use advertising or cross-site tracking cookies.

4. Managing Cookies

You can delete or block cookies through your browser settings. Every major browser lets you view what has been stored, remove individual cookies, and refuse new ones.

Please be aware that blocking strictly necessary cookies will stop you from signing in. Blocking the tenant device cookie is safe, but tenants will then receive an SMS code on every login.

5. Your Rights

Under the Kenya Data Protection Act, 2019, you have rights over your personal information, including the right to access it, correct it, and object to certain uses. Those rights and how to exercise them are set out in our Privacy Policy.

If you are a tenant, note that your landlord or property manager is the data controller for your tenancy records. Requests about that information should go to them first.

6. Changes to This Policy

We may update this policy as the Service changes or as we add or remove tools. When we do, we will update the date shown at the top of this page. Significant changes will be communicated to account holders directly.

7. Contact

Questions about this policy can be sent to info@nyumbapc.co.ke, or by WhatsApp on 0705 056 343.