Privacy Policy

Section 1

What data we collect

When you create an account, we collect:

• Your email address (used for authentication)
• Your display name
• Your role (renter, landlord, or agent)
• Contact information you choose to share (phone number, WhatsApp number, contact email). Landlords only, and only information you explicitly enable

When landlords post listings, we collect the listing content they provide, including photos uploaded to our storage.

We log listing views and contact enquiries (which listing was viewed or contacted, by which account) to help landlords gauge interest in their properties.

Section 2

Why we process your data

We process your data on the basis of your consent (given when you create an account and use the platform) and our legitimate interest in operating a functioning, secure listings service. Specifically, we use your data to create and manage your account, display or match listings, power the contact reveal feature, send account-related emails, and prevent fraud or abuse on the platform.

By enabling contact details on a listing, landlords consent to that information being revealed to logged-in renters through the reveal feature described in Section 4. Contact details revealed this way must only be used to inquire about the relevant listing.

Section 3

How data is stored

All data is stored via Supabase, a hosted backend platform. Data is stored in a PostgreSQL database and Supabase's object storage for uploaded images. Supabase is hosted on AWS infrastructure. Account emails (e.g. verification, password resets) are sent through Brevo, our transactional email provider.

These providers may process or store data outside Kenya. Where this happens, we only share the minimum data necessary for them to perform their function, and take reasonable steps to keep your data protected to a standard consistent with Kenya's Data Protection Act.

Section 4

Who can see your contact information

For landlords: the contact details you enable (phone, WhatsApp, email) are only shown to logged-in users. Anonymous visitors cannot see your contact details.

For renters: your account information is not displayed publicly. Your email is not shared with landlords through the platform.

Section 5

Cookies and tracking

We use a session token (stored in your browser's local storage) to keep you logged in. We do not use third-party advertising cookies or tracking pixels.

Section 6

Data sharing

We do not sell or share your personal data with third parties, except where required by Kenyan law or necessary to operate the platform (e.g. Supabase and Brevo, as described in Section 3).

Section 7

Data retention and deletion

You can delete your account and associated data by contacting us at tuzama@zohomailcloud.ca. We will process deletion requests within 30 days, except where we're required to retain certain data for legal, security, or fraud-prevention purposes.

Section 8

Your rights

Under Kenya's Data Protection Act, 2019, you have the right to:

• Know what personal data we hold about you
• Request a copy of your data
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict certain processing
• Withdraw consent at any time (this may limit your ability to use parts of tuzama)
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe your data has been mishandled

To exercise any of these rights, contact us at tuzama@zohomailcloud.ca.

Section 9

Children

tuzama is not intended for anyone under 18. We do not knowingly collect data from minors.

Section 10

Changes to this policy

We may update this policy from time to time. We will post the updated policy on this page with a revised date.

Section 11

Questions

Privacy questions or deletion requests? Contact us. We're a small team and we read everything.