Overview
Nyumba254 ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains what personal information we collect when you use Nyumba254, how we use it, and what choices you have.
This policy applies to all users of Nyumba254 — including buyers, renters, sellers, and landlords — accessing the platform via any device.
By using Nyumba254 you agree to the collection and use of information as described in this policy. If you do not agree, please stop using the platform.
Data we collect
We collect personal data in the following ways:
| Data type | What we collect | When |
|---|---|---|
| Account info | Full name, email address, phone number, password (hashed) | When you register as a seller |
| Listing info | Property details, photos, price, area, contact phone number | When you post a listing |
| Enquiry info | Buyer name, phone number, and message content | When a buyer sends an enquiry |
| Payment info | M-Pesa phone number, transaction reference, amount paid | When you pay a listing fee |
| Usage data | Pages visited, search queries, browser type, IP address | Automatically when you use the site |
| Communications | Emails or messages sent to our support team | When you contact us |
We do not collect your national ID number, bank account details, or any sensitive personal data beyond what is listed above.
How we use your data
We use the personal data we collect for the following purposes:
- To run the platform — creating and managing your account, publishing your listings, and delivering buyer enquiries to you
- To process payments — verifying M-Pesa transactions and activating listings after payment confirmation
- To communicate with you — sending listing confirmation emails, payment receipts, and important platform updates
- To improve the platform — analysing how people use Nyumba254 so we can make it better
- To detect and prevent fraud — identifying suspicious listings or accounts and protecting other users
- To comply with legal obligations — responding to lawful requests from Kenyan authorities where required
Who we share data with
We share your data only in the following limited circumstances:
- Other users (limited): When you post a listing, your contact phone number and listing details are visible to buyers on the platform. Buyers who send you an enquiry share their name, phone number, and message with you.
- Safaricom M-Pesa: Payment processing is handled by Safaricom. We share your phone number and payment amount with Safaricom to process the STK Push. We do not store your M-Pesa PIN — this is handled entirely by Safaricom.
- Legal authorities: We may disclose personal data to Kenyan authorities if required by law, court order, or to protect the rights and safety of our users.
We do not sell, rent, or trade your personal data to any third party for marketing purposes. We do not use advertising networks that track you across other websites.
Data storage & security
Your data is stored with a reputable cloud infrastructure provider on servers located in the EU (Ireland). Our infrastructure provider maintains SOC 2 compliance and encrypts data both at rest and in transit.
We take the following measures to protect your data:
- All data transmitted between your browser and our servers uses HTTPS encryption
- Passwords are hashed using industry-standard bcrypt — we cannot see your password
- Your M-Pesa PIN is never passed through our systems — it goes directly to Safaricom
- Database access controls ensure sellers can only access their own listings and enquiries
- Admin access to the database is protected by strong authentication
Cookies
Nyumba254 uses a small number of cookies and local storage items to make the platform work. We do not use advertising cookies or third-party tracking cookies.
| Cookie / storage | Purpose | Duration |
|---|---|---|
| Login session | Keeps you logged in to your seller account | 7 days or until you sign out |
| Search preferences | Remembers your last search filters | Session only |
| Google Fonts | Loads the Inter and Playfair Display fonts from Google | Cached by browser |
You can disable cookies in your browser settings, but this may prevent you from logging in or using some features of the platform.
We use Google Maps embeds on individual listing pages to show approximate location. Google Maps may set its own cookies subject to Google's Privacy Policy.
M-Pesa & payments
When you pay a listing fee via M-Pesa, here is exactly what happens with your data:
- You provide your M-Pesa phone number on our platform
- We send your phone number and the payment amount to Safaricom's Daraja API
- Safaricom sends an STK Push directly to your phone
- You enter your M-Pesa PIN on your phone — this PIN is never seen or stored by Nyumba254
- Safaricom confirms the payment to us with a transaction reference number (e.g. QF12AB3CD4)
- We store the transaction reference, amount, and payment status in our database linked to your listing
How long we keep your data
| Data type | How long we keep it |
|---|---|
| Account information | Until you delete your account, plus 30 days for recovery |
| Active listings | For the duration of the listing (60 or 90 days), then archived |
| Expired listings | 12 months after expiry, then permanently deleted |
| Buyer enquiries | 90 days after the listing expires |
| Payment records | 7 years (required for financial record-keeping under Kenyan law) |
| Usage / access logs | 90 days, then automatically deleted |
| Support emails | 2 years from the date of the last communication |
When data is deleted, it is permanently removed from our systems and cannot be recovered. Payment records are the exception — we are required by Kenyan tax and financial regulations to retain these for 7 years.
Your rights
You have the following rights over your personal data. To exercise any of them, email us at hello@nyumba254.co.ke and we will respond within 7 business days.
We will process all requests free of charge. In some cases we may be unable to delete certain data (such as payment records required by law) and will explain this clearly.
You can also update or delete your own profile information directly from your seller dashboard at any time.
Children's privacy
Nyumba254 is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children under 18.
If you believe a child under 18 has provided us with personal information, please contact us at hello@nyumba254.co.ke and we will delete that information promptly.
Third-party links
Nyumba254 may contain links to external websites — for example, links to WhatsApp, Google Maps, or other services. This Privacy Policy does not apply to those websites.
We encourage you to read the privacy policies of any external websites you visit. We are not responsible for the privacy practices of third-party sites.
When you click a WhatsApp link on a listing page, you are opening WhatsApp directly and your conversation with the seller is subject to WhatsApp's and Meta's privacy policies.
Changes to this policy
We may update this Privacy Policy from time to time. When we make significant changes, we will update the "Last updated" date at the top of this page and notify registered sellers by email.
We encourage you to review this policy periodically. Your continued use of Nyumba254 after any changes constitutes your acceptance of the updated policy.
Contact us
If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us:
- Email: hello@nyumba254.co.ke
- Subject line: "Privacy Request — [your name]"
- Response time: Within 7 business days
- Head office: Kisumu, Kenya — serving sellers and buyers nationwide
For M-Pesa payment disputes specifically, contact Safaricom directly on 234 (free from Safaricom lines) as we do not have access to change M-Pesa transaction records.
Questions about your privacy?
We take privacy seriously. Email us and we'll respond within 7 business days.
hello@nyumba254.co.ke