Privacy Policy

Effective July 17, 2026 · Designed in line with Kenya's Data Protection Act, 2019

1. Who We Are

JiraniHub Ltd. is a Kenyan company. We build the platform your estate uses to manage visitors, maintenance, payments, and community life. We handle your personal data in line with Kenya's Data Protection Act, 2019. Questions: privacy@jiranihub.co.ke

2. What We Collect

Your phone number, name, estate and house/unit number, and role (resident, admin, security, or vendor). The records you create: visitor passes, maintenance tickets, payments and M-PESA references, RSVPs, votes, bookings, and messages. Your location only when you press the emergency (SOS) button — never in the background. Basic device and session data to keep your account secure.

3. Why We Collect It

Only to run the platform: letting your visitors in, fixing what's broken, collecting the levy, and keeping your estate informed and safe. We never sell your data. We never share it for advertising. There are no third-party trackers in this app.

4. Who Can See Your Data

Your estate's admin and security staff see only what they need for their job, and only for your estate — never other estates. Safaricom processes M-PESA payments. Africa's Talking delivers SMS. Netlify and Supabase host our platform and database. Law enforcement gets access only with a valid Kenyan court order.

5. How Long We Keep It

Your account: while it's active, plus 30 days after you delete it. Payment records: 7 years (Kenyan tax law requires this). Audit logs: 2 years. Visitor records: name and phone number are automatically anonymized after 90 days. Error logs: 90 days.

6. Your Rights

Under the Data Protection Act you can: see all data we hold on you (Settings → Download My Data), correct it, delete your account (Settings → Delete Account), export it, and object to processing. We answer every request within 30 days. If you're not satisfied, you can complain to the Office of the Data Protection Commissioner (ODPC) at complaints@odpc.go.ke.

7. How We Protect It

Everything travels over HTTPS. Passwords are hashed with bcrypt — we cannot read them. Access is role-based and estate-scoped. Sensitive actions are recorded in an audit trail. Payment callbacks are restricted to Safaricom's servers. Login attempts are rate-limited.

8. Cookies

One session cookie, HTTP-only, valid 30 days, used purely to keep you signed in. No advertising cookies, no third-party tracking of any kind.

9. If Something Goes Wrong

If a data breach puts your rights at risk, we notify the Data Commissioner within 72 hours as the Act requires, and we tell you promptly by SMS, in-app notice, or both — including what happened and what we're doing about it.

10. Where Your Data Lives

Our database is hosted with Supabase in the European Union, on infrastructure that meets the Data Protection Act's requirements for transfers outside Kenya. We only use processors that meet that bar.

11. Contact Us

Privacy questions: privacy@jiranihub.co.ke · General support: support@jiranihub.co.ke · Data Commissioner (ODPC): complaints@odpc.go.ke

Your Data Protection Rights

✓

Right to Access

Request a copy of all your data. Visit Settings → Download My Data or email privacy@jiranihub.co.ke

✓

Right to Correct

Fix inaccurate info in your profile settings anytime.

✓

Right to Erase

Delete your account. Visit Settings → Delete Account. Some data retained per law (7-year payment records).

✓

Right to Data Portability

Export your data as JSON/CSV. Visit Settings → Export My Data.

✓

Right to Object

Opt-out of analytics/marketing. Visit Preferences → uncheck 'Analytics'.

✓

Right to Restrict

Request processing limitation during disputes.