Privacy Policy

Nyumbisha is a rent and property management service for landlords and managing agents in Kenya, provided by Astralyn (“we”, “us”). This policy explains what personal data we collect, why, who we share it with, and the choices you have. We process personal data in line with the Kenya Data Protection Act, 2019.

We are reviewing this policy with our lawyers and will publish any changes on this page.

1. Who is responsible for your data

For landlords, agents and their staff who sign up, Astralyn is the data controller for your account details.

For tenants, your landlord or managing agent decides what is recorded about your tenancy and is the data controller. We process that data on their behalf, to run the service they use. Questions about your tenancy records are best sent to your landlord first; we will help them answer.

2. What we collect

• Account details: your name, phone number, email address, business name and the plan you choose.
• Property and tenancy records that landlords enter or import: buildings, units, tenant names and phone numbers, national ID numbers where given, leases, rent, deposits, invoices, receipts, maintenance requests and notices.
• Payment information: M-Pesa transaction details such as the amount, reference, time and the paying phone number and name, used to match payments to tenants. We do not see or store M-Pesa PINs.
• Messages: WhatsApp and SMS messages sent through Nyumbisha, including payment confirmations tenants forward to us.
• Enquiries: what you send through our contact form.
• Technical data: logs of requests to our servers, used to keep the service secure and working.

3. How we use it

• To provide the service: send bills, reminders and receipts, match payments, and keep records.
• To bill you for your plan and send invoices.
• To support you and answer enquiries.
• To keep the service secure, prevent fraud and meet our legal obligations.

We process data because it is necessary to provide the service you asked for, because the law requires it, or for our legitimate interest in running a secure and reliable service. We do not sell personal data, and we do not use it for third-party advertising.

4. Who we share it with

Only the service providers we need to run Nyumbisha:

• Meta (WhatsApp) and SMS providers, to deliver messages.
• Safaricom (M-Pesa), to send payment prompts and receive payment confirmations.
• Zoho, to send email.
• Our hosting provider, which stores the service’s data.
• Where a landlord turns it on, an AI text service reads forwarded payment messages that our own reader cannot. Phone numbers are removed before the message is sent, and no other account or tenancy data is shared.

Some of these providers process data outside Kenya. Where they do, we rely on the safeguards the Data Protection Act requires. We may also disclose data where the law requires it.

5. Rent money

Rent paid through Nyumbisha goes directly to the landlord’s own M-Pesa or bank account. We never hold it. We only see that a payment cleared, so we can record it.

6. How long we keep it

We keep account and tenancy records while the account is open, and for as long afterwards as the law requires for financial records. Landlords can export their records at any time, on every plan. When data is no longer needed, we delete or anonymise it.

7. Your rights

Under the Data Protection Act, you can ask us to:

• tell you what personal data we hold about you, and give you a copy;
• correct data that is wrong;
• delete data we no longer have a reason to keep;
• stop or limit some processing, or object to it.

Tenants can also stop WhatsApp or SMS messages at any time by asking their landlord, who can switch them off, or by writing to us. To use any of these rights, write to [email protected]. If you are not satisfied with our answer, you can complain to the Office of the Data Protection Commissioner of Kenya.

8. Cookies and storage

We use a cookie to keep you signed in, and your browser’s storage to remember preferences such as light or dark mode and the sidebar layout. We do not use advertising or tracking cookies.

9. Security

Data travels over encrypted connections, and access is limited to the people and services that need it. No system is perfectly secure; if a breach affects your data, we will tell you and the Data Commissioner as the law requires.

10. Changes

We will post any changes to this policy here and update the date at the top. If a change is significant, we will tell account holders by email or WhatsApp.