1. Introduction

This Privacy Policy explains how Nyumba ("Nyumba", "we", "us", "our") collects, uses, shares, and protects personal information in connection with our property and tenant management platform ("Service"), in line with the Kenya Data Protection Act, 2019 and its regulations.

2. Who This Applies To

This Policy covers two categories of people:

• Account Users — landlords, property managers, and caretakers who create and use a Nyumba account directly.
• Tenant Users — tenants whose information is entered into the Service by their landlord/property manager, and who may access a limited self-service tenant portal.

Where an Account User enters information about their tenants, that Account User is the data controller for that tenant's information, and Nyumba acts as a data processor providing the platform on their behalf. Questions about a specific tenant's data should generally be directed to their landlord or property manager in the first instance.

3. Information We Collect

3.1 Account information

• Name, email address, phone number, and password/authentication details (managed via our authentication provider, Firebase).
• Business details such as company/account name, county/location, and logo, where provided.
• Subscription and billing information, including M-Pesa transaction references (we do not store your full M-Pesa PIN or banking credentials — payments are processed directly by Safaricom).

3.2 Tenant information (entered by Account Users)

• Tenant name, phone number, alternate phone number, ID number, and email address, where provided.
• Lease details: unit, rent amount, deposit, move-in/move-out dates, and lease terms.
• Financial records: invoices, payments, balances, and utility charges associated with the tenancy.
• Maintenance and move-out requests submitted through the tenant portal.

3.3 Usage & device information

• Log data such as IP address, browser/device type, and pages visited, collected automatically as you use the Service.
• Cookies and similar technologies, including session cookies required for login, and analytics cookies (Google Tag Manager/Google Analytics) on our public marketing pages, used to understand how visitors find and use our website.
• For the tenant portal, an optional "remember this device" cookie that allows a returning tenant to skip re-entering a one-time passcode for a limited period.

4. How We Use Information

• To provide, operate, and maintain the Service, including generating invoices, tracking payments, and enabling communication between landlords and tenants.
• To authenticate users and secure accounts, including via one-time passcodes (OTP) sent by SMS for tenant portal login.
• To send transactional SMS messages on behalf of Account Users, such as rent reminders, payment confirmations, and account notifications.
• To process subscription payments and manage billing.
• To monitor, maintain, and improve the performance, security, and reliability of the Service.
• To understand usage of our public website for product and marketing purposes (via analytics tools), separate from data entered inside the authenticated application.
• To comply with legal obligations and respond to lawful requests from public authorities.

5. How Information Is Shared

We do not sell personal information. We share information only as necessary to operate the Service, including with:

• Safaricom / M-Pesa — to process rent and subscription payments.
• Africa's Talking (SMS gateway) — to deliver SMS messages, including OTP codes and tenant notifications; this involves sharing the recipient's phone number and message content with the gateway for delivery purposes.
• Firebase / Google — for authentication and account security infrastructure.
• Hosting and infrastructure providers — to store and run the Service securely.
• Where required by law, regulation, court order, or to protect the rights, property, or safety of Nyumba, our users, or the public.

Within an account, tenant data entered by a landlord is visible to that landlord and to any managers/caretakers the landlord has explicitly assigned to the relevant property — access is restricted by property assignment where configured.

6. Data Security

We apply reasonable technical and organisational measures to protect personal information, including encrypted connections, access controls tied to user roles, and secure password/OTP handling. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we work to continuously improve our safeguards.

7. Data Retention

We retain account and tenant information for as long as the relevant account remains active, and for a reasonable period afterward to meet legal, accounting, or dispute-resolution obligations. An account owner may request deletion of their account and associated data, subject to any records we are legally required to retain (e.g. financial transaction records).

8. Your Rights

Under the Kenya Data Protection Act, 2019, individuals have rights including the right to:

• Be informed of the use of their personal data;
• Access their personal data held by a data controller;
• Request correction of inaccurate or outdated data;
• Request deletion of data that is no longer necessary, subject to legal retention requirements;
• Object to processing of their data in certain circumstances;
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya.

Account Users can exercise these rights directly within the Service (editing or removing tenant records, for example) or by contacting us. Tenant Users should first contact their landlord/property manager, since they control the record; if that is not possible, you may contact us directly and we will assist where we are able to.

9. Children's Privacy

The Service is intended for use by adults (18 years and older) in a landlord-tenant context. We do not knowingly collect personal data from children. If you believe a child's data has been submitted to the Service, please contact us so we can address it.

10. International Data Transfers

Some of our service providers (such as Firebase/Google and our hosting provider) may process or store data on servers located outside Kenya. Where this occurs, we rely on those providers' own security and compliance measures, and take reasonable steps to ensure your information continues to be protected consistently with this Policy.

11. Cookies

We use essential cookies required for login sessions and core functionality, and, on our public marketing pages, analytics cookies (via Google Tag Manager and Google Analytics) to understand visitor behaviour. These marketing analytics cookies are not used inside the authenticated dashboard or the tenant portal. You can control cookies through your browser settings, though disabling essential cookies may prevent you from logging in.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to the Service or applicable law. Material changes will be communicated through the app or by other reasonable means, and the "Last updated" date at the top of this page will be revised accordingly.

13. Contact Us

If you have questions about this Privacy Policy or how your data is handled, reach us on WhatsApp at +254 705 056 343.