Privacy Policy

This page describes, at a high level and in plain language, what information KejaSmart collects, why, and who it is shared with. It reflects how the platform actually works today, not a general legal template. It is not a statement of compliance with any specific law.

• Account information: your phone number (used to sign in), and email address if you provide one.
• Profile information: for landlords, a business profile and, where you choose to complete identity verification, your national ID/passport number and KRA PIN. Only the last four characters of these are ever shown back to you or an admin — the full value is never included in any admin activity log.
• Verification documents: images you upload to support landlord identity or property verification. These are stored privately and are never publicly accessible — only you and an admin reviewing your submission can view them.
• Listing and property information: everything a landlord submits about a property and its units, plus property photos.
• Search and location preferences: the county, town, campus, price range, and similar filters you search with, and properties you favourite or add to a comparison cart.
• Inquiries and messages: messages you send a landlord through the platform, and viewing requests.
• Booking and reservation records: which unit you held, the reservation's status, and — once online payments are enabled — payment records. Payments are currently disabled platform-wide (see the Terms of Service), so no real payment data is processed today.
• Reports and disputes: content you submit when flagging a listing, landlord, or booking, or opening a dispute.
• Security and audit information: a record of high-risk actions (like verification decisions or account suspensions) taken by admins, for accountability — never including your full ID number or document contents.
• Technical information: standard request-level information (like IP address and timestamps) that a web application ordinarily receives while serving requests, used for security, rate-limiting, and diagnosing problems.

• To authenticate you and keep your account secure.
• To operate the marketplace — listings, search, favourites, inquiries, reservations.
• To review and approve landlord and property verification submissions.
• To detect and prevent fraud, abuse, and security threats.
• To provide support and respond to reports and disputes.
• To send account-related notifications (e.g. one-time codes, booking status updates).

KejaSmart does not sell your data. It is shared only with:

• Other users, where the platform is designed to show it— a landlord sees the contact details of a student who inquires about their property; a student sees a landlord's public profile and verification badges (never a landlord's full ID number).
• Service providers KejaSmart runs on — cloud hosting and database infrastructure, private object storage for photos and documents, an SMS provider for one-time codes, and (once enabled) an email provider for notifications. These providers process data on KejaSmart's behalf and do not use it for their own purposes.
• A payment processor, once online payments are enabled — not active today. When it is, this page will be updated with specifics before payments go live.
• Law enforcement or legal process, only where KejaSmart is legally required to respond.

KejaSmart does not currently use third-party advertising or analytics/tracking services, and does not share your data with advertisers.

KejaSmart uses one cookie for authentication: a secure, HttpOnly session cookie that keeps you signed in. It cannot be read by JavaScript on the page and is only ever sent over HTTPS. KejaSmart does not use advertising cookies, tracking cookies, or third-party marketing cookies.

KejaSmart retains information only for as long as reasonably necessary to operate the service, keep accounts secure, prevent fraud, resolve disputes, and meet any legal or accounting obligation that applies. Concretely, today:

• One-time login codes are deleted automatically after use or expiry.
• Notification records don't store the actual text of an SMS or email — only that one was sent.
• Everything else — verification documents, audit logs, booking and payment records, reports — is retained; KejaSmart has not yet finalized specific retention time limits for these categories. This is flagged internally as a product and legal decision that KejaSmart intends to make and publish here before it treats any retention period as final.

You can review and update your own profile information from within the app. If you want your account closed, use the report mechanism to reach an admin — an automated self-service deletion flow does not exist yet.

This page will be updated as KejaSmart's product changes — most notably once online payments and a production email sender are enabled. Material changes will be reflected by an updated date at the top of this page.