Privacy Policy

Makazi Ltd ("Makazi", "we", "us") operates the verified real estate marketplace at makazi.app. We are registered in Nairobi, Kenya, and registered as a data controller with the Office of the Data Protection Commissioner (ODPC). For privacy questions, or to reach our Data Protection Officer, write to info@makazi.app.

This policy explains what personal information we collect from you, why we collect it, how long we keep it, and what rights you have over it under the Kenya Data Protection Act 2019 (KDPA) and, where applicable, the EU General Data Protection Regulation (GDPR).

When you create an account: name, email, phone number, and an avatar if you set one.

When you publish a property as a private owner: a hashed (one-way) representation of your national ID number, passport number, or alien registration number, whichever you provide. The raw number is never stored on our servers; we keep only the hash. We also collect the property title deed and any supporting documents you upload.

When you publish on behalf of an agency: agency name, EARB registration number, KRA PIN, and director identity documents. These are used only to verify the agency before its listings go live.

When you browse: standard server logs (IP, browser string, page viewed, timestamp) for security and uptime. If you accept analytics in our cookie banner, we also use PostHog to record anonymised usage patterns.

• To run the service. Show you listings, sign you in, and save your bookmarks.
• To verify trust. Confirm that owners actually own the property they list, and that agencies are legally registered.
• To handle payments and tax. Record paid transactions in line with Kenya Revenue Authority requirements.
• To improve the product. Only if you opt in to analytics via the cookie banner.

Profile data: for as long as your account is active. When you delete your account, your name, phone, avatar, and ID hash are removed immediately.

Listings: we keep historical listings in an archived state so the public record of past activity stays queryable. Personal identifiers attached to them are stripped at account deletion.

Payments and legal engagements: kept for 5 years after the end of the relevant tax period, as required by the Kenya Tax Procedures Act 2015 (s.23). At account deletion we anonymise these rows. Your name, email, and phone are overwritten, but the financial record is kept until the retention period lapses, after which it is purged.

Server logs: 90 days.

Under the KDPA and GDPR you can, at any time:

• Access a copy of the data we hold about you. Use the data export tool.
• Correct any data that is wrong. Edit it from your account page.
• Delete your account from the delete account flow. Some records survive in anonymised form to meet tax law. See the retention section above.
• Object to analytics processing. Toggle it off in the cookie banner or from your account.
• Lodge a complaint with the Office of the Data Protection Commissioner Kenya at odpc.go.ke.

We use a small number of cookies. Essential cookies (sign-in session, CSRF protection) are always on. Analytics cookies (PostHog) and marketing cookies are off by default. You choose on your first visit, and can change your mind later from your account page. For more detail, see our Cookie Policy.

We share the minimum necessary with the following service providers:

• Supabase: database and authentication (EU region).
• Vercel: application hosting and CDN.
• Paystack: payment processing (Kenya).
• Resend: transactional email delivery.
• PostHog: privacy-friendly product analytics (only if you opt in).

We do not sell your personal data, and we do not share it with third parties for their own marketing.

We may produce aggregated, anonymisedstatistics from activity on Makazi. For example, "median rent for a 2-bedroom in Kilimani rose 8% this year." Once data has been aggregated and stripped of anything that could identify you, it is no longer personal data under the KDPA, so we may publish, use, or share these insights, including commercially. These insights can never be traced back to you. That is exactly why deleting your account severs the links between you and any records we are required to keep.

We only use your personal data for the purposes described in this policy. If we ever want to use it for a materially different purpose, for example a future Makazi product, we will ask for your explicit, specific opt-in first and will not proceed without it. You can withdraw that consent at any time. Any direct marketing is opt-in only, with a one-click way to opt out in every message (Kenya Data Protection (General) Regulations 2021).

Some of our service providers operate from outside Kenya (Supabase EU, Vercel US, Resend US). When we send your data to them, we rely on standard contractual clauses or equivalent safeguards required under KDPA section 48.

We encrypt data in transit (TLS) and at rest (AES-256). Identity documents are stored in private buckets with row-level security. Access to administrative tools is restricted to named staff with two-factor authentication.

When we make material changes, we increment the version above and ask you to re-consent on your next visit. Minor wording changes are noted with a new effective date but no re-consent.

For any privacy question, including data subject requests, complaints, or general clarification, reach our Data Protection Officer at info@makazi.app. We aim to reply within 7 business days.