1. Introduction
KéjaLink ("we", "our", or "us") operates a verified house listings platform connecting tenants with landlords across Kenya. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website at kejalink.co.ke and related services.
By using KéjaLink, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use our services.
2. Information we collect
2.1 Information you provide directly
- Account information — name, email address, phone number when you sign up or complete onboarding
- Landlord application — county, location, number of properties and units when applying to list properties
- Property details — property name, location, unit types, prices, descriptions and amenities
- Communications — messages you send to us via support channels
2.2 Information collected automatically
- Usage data — pages visited, features used, time spent on listings
- Device information — browser type, operating system, IP address
- Cookies — session cookies for authentication and preference cookies for your settings
2.3 Information from third parties
- Google OAuth — if you sign in with Google, we receive your name, email and profile picture from Google
- Mpesa — when you make payments, we receive transaction confirmation from Safaricom (we do not store your Mpesa PIN or full account details)
3. How we use your information
We use your information to:
- Create and manage your account
- Verify landlord identities and property listings
- Connect tenants with verified landlords
- Process contact unlock requests
- Send important account notifications (approvals, rejections, updates)
- Detect and prevent fraud, suspicious activity and platform abuse
- Improve our platform based on usage patterns
- Comply with Kenyan legal obligations
We do not sell your personal information to third parties. We do not use your data for advertising profiling.
4. Who we share your information with
4.1 Landlords (upon contact unlock)
When you unlock a landlord's contact, your intent to contact them is logged. The landlord's phone number, email and address are revealed to you. We do not share your personal details with landlords automatically.
4.2 Service providers
We use the following trusted service providers who process data on our behalf:
- Clerk — authentication and user management (USA)
- Supabase — database and backend services
- Cloudinary — image storage and delivery
- Vercel — website hosting (USA)
- Safaricom (Mpesa) — payment processing (Kenya)
Each provider is bound by their own privacy policies and data processing agreements.
4.3 Legal requirements
We may disclose your information if required by Kenyan law, court order, or government authority, including the Office of the Data Protection Commissioner (ODPC).
5. Data retention
We retain your data for the following periods:
- Account data — for the duration of your account plus 2 years after deletion
- Property listings — 3 years after a property is removed
- Activity logs — 2 years for fraud prevention purposes
- Payment records — 7 years as required by Kenyan tax law
6. Your rights under the Kenya Data Protection Act 2019
Under the Kenya Data Protection Act (DPA) 2019, you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — request correction of inaccurate data
- Erasure — request deletion of your data (subject to legal retention requirements)
- Portability — receive your data in a machine-readable format
- Object — object to processing of your data for certain purposes
- Withdraw consent — where processing is based on consent
To exercise any of these rights, email us at privacy@kejalink.co.ke. We will respond within 21 days as required by the DPA.
7. Security
We implement technical and organisational measures to protect your data including encrypted connections (HTTPS), access controls, and regular security reviews. However, no internet transmission is 100% secure. See our Security page for details.
Security page
8. Cookies
We use essential cookies for authentication and optional cookies for preferences. See our Cookie Policy for full details.
Cookie Policy
9. Children
KéjaLink is not directed at persons under 18 years of age. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us immediately.
10. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or prominent notice on our website at least 14 days before they take effect.