Privacy Policy

By registering for or using the Service, you acknowledge that you have read this Privacy Policy. Where the law requires consent for specific processing, we will ask for it separately (for example, at registration or before optional marketing).

If you access HomeSpot as a tenant or staff member of a property organisation, your landlord or property manager may also act as a data controller for tenancy records. In those cases, we process data on their instructions as a data processor, while still applying the safeguards described here.

This policy applies to:

• The HomeSpot website and web application (all role-based portals).
• Marketplace listing, inquiry, and verification flows.
• Communications we send you (email, SMS, and in-app notifications).
• Support, billing, and security interactions with G3 Labs Limited.

It does not apply to third-party websites, payment wallets, or apps linked from HomeSpot(for example, Safaricom M-Pesa or KRA iTax), which have their own privacy terms.

Depending on how you use the Service, we may collect:

• Identity and contact data — name, email address, phone number (including numbers in 2547XXXXXXXX format), profile photo, and role (owner, manager, tenant, lister, etc.).
• Account and security data — hashed passwords, session tokens, two-factor authentication settings, login timestamps, IP addresses, and device/browser metadata used for fraud prevention.
• Tenancy and property data — organisation and building details, unit assignments, lease terms, move-in/move-out records, visitor passes, and gate logs.
• Financial data — rent invoices, payment amounts, M-Pesa transaction references and callback metadata, receipt records, payout configuration, and optional tax identifiers you or your organisation choose to store for commercial rent or MRI filing.
• Maintenance and communications — maintenance tickets, messages, notices, and bulk communication history.
• Marketplace data — listing content, photos, location fields, inquiries, verification documents, and abuse reports.
• Usage and audit data — actions taken in the app, audit logs, support tickets, and feedback you submit.
• Consent records — whether you accepted this policy and the Terms, and the version accepted.

We do not intentionally collect special categories of personal data unless you voluntarily provide them (for example, in a maintenance description). Please avoid submitting sensitive information unless necessary.

We use personal data to:

• Provide, operate, and improve the Service.
• Create and manage accounts, organisations, buildings, and user permissions.
• Process rent collection via M-Pesa STK Push and generate PDF receipts.
• Support landlords with MRI tax estimates and related accounting exports.
• Send transactional messages (payment confirmations, invites, password resets, ticket updates).
• Moderate marketplace listings and investigate reports of fraud or abuse.
• Comply with legal obligations, respond to lawful requests, and enforce our Terms.
• Monitor security, prevent fraud, and maintain service reliability.

We rely on one or more of the following grounds, as applicable:

• Contract — processing necessary to provide the Service you or your organisation requested.
• Legal obligation — retaining certain financial records, responding to regulators or courts, and cooperating with lawful investigations.
• Legitimate interests — securing the platform, preventing misuse, and improving features, balanced against your rights.
• Consent — where required for optional processing (such as certain marketing or non-essential cookies). You may withdraw consent at any time without affecting lawfulness of prior processing.

We may share personal data with:

• Your organisation's authorised users — owners, managers, and staff with role-based access within the same organisation.
• Service providers (processors) who help us run HomeSpot, including cloud hosting, email delivery (Resend), SMS (Celcom Africa), payment orchestration (Safaricom M-Pesa Daraja), file storage, analytics, and customer-support tools. These providers may only process data on our instructions and subject to contractual safeguards.
• Professional advisers — lawyers, auditors, or insurers where reasonably necessary.
• Authorities — when required by law, court order, or to protect rights, safety, and security.
• Business transfers — in connection with a merger, acquisition, or sale of assets, with notice where the law requires it.

We do not sell your personal data.

Your data may be processed in Kenya and, where we use cloud infrastructure, in other countries. When personal data is transferred outside Kenya, we implement appropriate safeguards under the KDPA (such as standard contractual clauses, adequacy decisions, or your explicit consent where applicable).

We use essential cookies and local storage to keep you signed in, remember preferences, and protect against cross-site attacks. We may use analytics cookies to understand how the Service is used. You can control non-essential cookies through your browser settings; disabling essential cookies may prevent parts of the Service from working.

We retain personal data only as long as necessary for the purposes described above, including:

• Active account duration plus a reasonable period after closure for backup and dispute resolution.
• Financial and receipt records for periods required by Kenyan tax and commercial law.
• Security and audit logs for a limited period to investigate incidents.
• Deletion requests — we aim to complete erasure within 30 days where no legal hold applies.

We apply technical and organisational measures including encryption in transit (HTTPS), hashed credentials, role-based access control, organisation-level data isolation, rate limiting, session expiry, and audit logging. No method of transmission or storage is completely secure; please use a strong password and enable two-factor authentication where offered.

If we become aware of a personal data breach likely to pose a risk to your rights, we will notify affected users and the Office of the Data Protection Commissioner within the timeframes required by law.

Under the KDPA, you may have the right to access, rectify, erase, restrict, or object to certain processing, and to data portability where technically feasible. You may also withdraw consent and lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe your rights have been violated.

To exercise your rights:

• Tenants — use the in-app privacy tools at Tenant → Privacy to export or request deletion of your data.
• All users — email support@homespot.ke with your request. We may need to verify your identity before responding.

We will respond within the timeframe required by the KDPA (ordinarily within one month, extendable where permitted).

The Service is not directed at children under 18. Accounts for minors should be created only with parental or guardian involvement through a responsible organisation or landlord. If you believe we have collected a child's data without appropriate authority, contact us and we will delete it.

We may send product updates or offers where permitted by law. You can opt out of non-essential marketing emails using the unsubscribe link or by contacting support@homespot.ke. Transactional messages related to your account, payments, or security cannot be opted out while you remain an active user.

HomeSpot may compute operational scores or risk indicators (for example, payment or engagement metrics) to help landlords manage portfolios. These are assistive tools and do not, by themselves, produce legal effects against you. Contact us if you wish to understand or contest a score used in a decision that significantly affects you.

We may update this Privacy Policy from time to time. Material changes will be notified via the Service or email where appropriate. The "Last updated" date at the top indicates the current version. Continued use after changes take effect constitutes acceptance where the law allows; otherwise we will seek renewed consent.

Data protection enquiries and rights requests:

G3 Labs Limited
Email: support@homespot.ke