Your data, handled plainly.
What we collect, why we collect it, who we share it with, and how you stay in control. No legal fog.
Last updated 16 October 2026
01Who we are
Renty360 Ltd (“Renty360”, “we”, “us”) is a company based in Nairobi, Kenya. We provide property management software for landlords, property managers and tenants through our website, web app and mobile apps (together, the “Service”).
This policy explains how we handle personal data under the Kenya Data Protection Act, 2019 and its regulations. Questions about it can go to privacy@renty360.com.
02Our role: controller and processor
For landlords and property managers who sign up for an account, we are the data controller for your account and billing information.
For tenants, your landlord or property manager decides what information about you is added to Renty360 (for example your name, unit and lease). For that information we act as a data processor on their behalf, and they are the controller. When you create your own tenant account, we are the controller for your login details and how you use the app.
03Data we collect
Information you give us
- Account details: name, phone number, email address, password (stored hashed) and role.
- Property and tenancy records: properties, units, leases, rent amounts, invoices, receipts, deposits and notes.
- Payment details: M-Pesa phone numbers, transaction references, amounts and dates. We never receive your M-Pesa PIN.
- Maintenance requests: descriptions and any photos you upload.
- Messages: what you send to us through support, the contact form or email.
Information collected automatically
- Usage and device data: IP address, browser or device type, operating system, app version, pages visited and timestamps.
- Logs: security and audit logs of important account actions, such as changes to payment settings or roles.
- Cookies: essential cookies to keep you signed in and secure. See Cookies.
Information from others
- Safaricom (M-Pesa Daraja API): payment confirmations used to reconcile invoices.
- Your landlord or property manager, if you are a tenant.
04How we use it
| Purpose | Lawful basis |
|---|---|
| Create and run your account, and deliver the Service | Performance of a contract |
| Process rent payments and reconcile them to invoices | Performance of a contract |
| Send invoices, receipts, reminders and service SMS or email | Performance of a contract |
| Keep the Service secure, prevent fraud and fix problems | Legitimate interests |
| Improve the product using aggregated usage data | Legitimate interests |
| Keep financial records required by Kenyan tax law | Legal obligation |
| Send product news and marketing | Consent, which you can withdraw at any time |
06Where your data is stored
We host the Service on Amazon Web Services in the Africa (Cape Town) region. Some service providers, such as email delivery or error monitoring, may process limited data outside Kenya. When that happens we rely on the safeguards the Data Protection Act requires, such as contractual protections and providers with appropriate security standards.
07How long we keep it
- Account data: while your account is active. After you delete it, we remove or anonymise it within 30 days.
- Payment, invoice and receipt records: for at least 5 years, as required by the Kenya Tax Procedures Act. After that they are deleted.
- Backups: kept for up to 30 days, then overwritten.
- Security logs: up to 12 months.
You can find out how to delete your account on the account deletion page.
08Your rights
Under the Kenya Data Protection Act you have the right to:
- be told how your personal data is used;
- get a copy of your personal data;
- correct data that is wrong or out of date;
- have your data deleted, subject to the legal record-keeping described above;
- object to processing, including for direct marketing;
- receive your data in a portable format.
To use any of these rights, email privacy@renty360.com from the email address or phone number linked to your account. We will respond within 30 days. If you are a tenant and your request is about records your landlord manages, we will help you pass it to them.
If you are unhappy with how we handled your data, you can complain to the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.
09Security
We encrypt data in transit with TLS and encrypt sensitive fields at rest. Access is restricted by role and important changes are recorded in an audit log. No system is perfectly secure. If we learn of a breach that affects your data, we will notify you and the Data Protection Commissioner as the law requires. More detail is on our Trust & Security page.
11Children
The Service is not intended for anyone under 18, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact privacy@renty360.com and we will delete it.
12Changes to this policy
We may update this policy from time to time. When we make significant changes, we will tell you by email, SMS or a notice in the app before they take effect. The date at the top of this page shows when it was last updated.
13Contact us
Renty360 Ltd, Nairobi, Kenya. Email privacy@renty360.com, or reach us through the contact page.