Privacy Policy

1. Who we are

RentFlow Kenya (“RentFlow”, “we”, “us”) runs the rentfloor.rentals website and the RentFlow mobile app. They help tenants find vacant rooms, and help landlords, caretakers, agents and onboarding agents manage properties, rent and reservations in Kenya. This policy explains what personal data we collect, why, who sees it, and the choices you have. It applies to the website and the app. We handle personal data in line with Kenya’s Data Protection Act, 2019.

2. Data we collect

What we collect depends on how you use RentFlow.

• Account details: first and last name, email address, phone number, password (stored only as a one-way hash), role, optional username and profile photo.
• Passkey PIN: the 4-digit PIN that unlocks the app on your device (stored as a hash).
• Identity and business details (some roles only): for onboarding agents and landlords who verify their accounts (KYC) — ID number, a photo of your ID, business name, KRA PIN and payout details. Tenants may give an ID number and an emergency contact’s name and phone number.
• Property and listing content: property and room details, photos, rent and deposit amounts, and the location pin of a property. If you tap “use my location” while adding a property, your device location is used once to place that pin.
• Rental activity: reservations, tenancy and move-in details, maintenance requests, support tickets and receipts.
• Payments: the M-Pesa phone number you pay or get paid with, amounts, dates, receipt numbers and wallet balances. We never see or store your M-Pesa PIN or card details.
• Social and messages: posts, stories, comments, likes, follows and chat messages you send inside the app.
• AI assistant: what you type into the chat assistant. It is answered on our own servers and is not sent to any outside AI provider.
• Technical data: IP address, browser and device type, pages viewed, and security logs (such as failed sign-ins).
• Push notification data: a device token if you allow notifications.

3. How we use it

• To create and secure your account, sign you in, and keep you signed in until you sign out.
• To show listings, handle reservations, viewing passes and rent, and issue receipts.
• To process M-Pesa payments and wallet transactions.
• To send verification codes, receipts, reminders and notifications by email, SMS and push.
• To verify identity for onboarding agents and landlords, pay commissions, and prevent fraud and abuse.
• To moderate content and enforce our Terms of Service.
• To keep the service running, fix problems and understand how it is used.
• To meet legal, tax and accounting duties.

We do not sell your personal data and we do not show third-party advertising.

4. Who sees your data

• Other users: your name, photo, username and posts are visible to other users as the feature you use requires. When you reserve a room, the landlord of that property receives your name, phone number and message. A property’s name, contacts, photos and exact map pin are shown to visitors only after they pay the viewing fee, and landlord contacts are shared only with people who unlock a listing.
• Service providers who process data for us: Safaricom (M-Pesa payments), Africa’s Talking (SMS), our email service, our web hosting provider, and map and code libraries loaded from OpenStreetMap and jsDelivr (these receive your IP address when your device loads them).
• Authorities: where the law requires it, or to protect people’s safety and rights.

Providers may only use the data to provide their service to us.

5. Cookies and on-device storage

We use cookies and browser storage that are needed for the service to work: a session cookie, a security (CSRF) token, a “stay signed in” cookie that lasts up to one year or until you sign out, and settings such as light/dark theme, PIN set-up status and the chat button position. We do not use advertising or cross-site tracking cookies.

6. How long we keep data

We keep your data while your account is open. When you delete your account, your name, contact details, photo, PIN, ID documents, posts, messages, notifications and signed-in devices are erased or made anonymous. We keep payment and wallet records, and security logs, for as long as tax, accounting and fraud-prevention rules require. After deletion these are no longer linked to your name.

7. Your rights and how to delete your account

You can ask to see, correct or delete your personal data, to object to how we use it, and to withdraw consent. Most of this is available in your account settings.

Delete your account: sign in and open your profile menu, then Delete account, or go to https://rentfloor.rentals/delete-account.php. If you cannot sign in, email us from the address on your account and we will act within 30 days. You can also complain to Kenya’s Office of the Data Protection Commissioner (odpc.go.ke) if you are not satisfied.

8. Security

We protect data with encrypted connections (HTTPS), hashed passwords and PINs, access controls, sign-in attempt limits and activity logs. No online service is completely secure, so please use a strong password and keep your PIN private.

9. Children

RentFlow is for people aged 18 and over. We do not knowingly collect data from children. If you think a child has an account, contact us and we will remove it.

10. Changes to this policy

We may update this policy. When we make an important change we will post the new date here and, where appropriate, tell you in the app or by email.

11. Contact us

Questions or requests about your data: support@rentfloor.rentals · Phone / WhatsApp: +254115900068 · Website: rentfloor.rentals