Privacy Policy

1. Who we are

Hodi Homes Ltd ("Hodi", "we", "us") operates the Hodi Homes mobile application and website. We are committed to protecting your personal data in accordance with the Kenya Data Protection Act 2019.

2. Data we collect

We collect the following categories of personal data:

• Identity data: Full name, government ID document (front and back), for identity verification.
• Biometric data (sensitive): A live facial image (selfie) captured during verification and used solely for identity and liveness checks. This is sensitive personal data under the Kenya Data Protection Act 2019 and is processed only with your explicit consent.
• Contact data: Kenyan mobile number (required for OTP sign-in).
• Profile data: Role (tenant / landlord / mover), profile photo (optional).
• Location data: Your approximate device location, only when you choose "listings near me" (processed on your device; not stored on our servers).
• Usage data: Listings viewed, searches performed, viewing bookings.
• Device data: Push notification token, device type (for app notifications).

We do not collect payment card details. Rent and deposit payments are made directly between users.

3. How we use your data

We use your data to:

• Verify your identity via SMS OTP and process your account registration.
• Facilitate viewing bookings and connect tenants with landlords.
• Send in-app and push notifications about your bookings and listings.
• Improve the Platform through anonymised usage analytics.
• Comply with applicable Kenyan law and resolve disputes.

4. Sharing your data

We share limited contact information (phone number) between a tenant and a landlord only after a viewing is confirmed by both parties. We do not sell your personal data to third parties.

We may share data with:

• Supabase — our backend infrastructure and database provider.
• Twilio — our SMS OTP provider.
• Google — for maps and location services within the app.

5. Staff access & moderation

To keep Hodi safe, authorised Hodi staff may access account information, listings, and — where necessary to investigate a report, fraud, or a safety concern — message conversations. Such access is restricted to staff with an administrator role and every access is recorded in an internal audit log. We access message content only when there is a legitimate safety, legal, or support reason to do so, never for advertising or profiling.

6. Data retention

We retain your personal data for as long as your account is active. If you delete your account, we will remove your personal data within 7 days, except where retention is required by Kenyan law.

7. Your rights

Under the Kenya Data Protection Act 2019, you have the right to:

• Access a copy of the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data ("right to erasure").
• Object to processing of your data for marketing purposes.
• Lodge a complaint with the Office of the Data Protection Commissioner.

To exercise any of these rights, contact us via WhatsApp at +254 700 000 000.

8. Security

We use industry-standard encryption (TLS in transit, AES-256 at rest) and row-level security on our database. OTP tokens expire within 60 seconds and are never stored in plain text.

9. Children

Hodi is not directed at persons under 18. We do not knowingly collect personal data from minors.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes via SMS or in-app notification. The "Last updated" date at the top of this page reflects the most recent revision.

11. Contact

Data protection queries: +254 700 000 000 or see our Help centre.