Privacy policy

Kodara ("we", "us") provides software that lets Kenyan landlords collect rent via M-Pesa and manage properties, tenants, and maintenance. Kodara is a data controller for the account and business data described below, and a data processor for tenant personal data that landlords collect through the platform, under the Data Protection Act, 2019.

Depending on whether you use Kodara as a landlord or a tenant, we process:

• Account details: full name, email or phone number, and password.
• Property and tenancy records: properties, units, rent amounts, and billing dates.
• Payment records: M-Pesa transaction identifiers, phone numbers, amounts, and timestamps needed to reconcile rent payments.
• Tax records, where a landlord connects eTIMS: KRA PIN and registered device identifiers, used solely to issue that landlord's own rent invoices to KRA.
• Maintenance requests and photos submitted by tenants.

We process this data to operate the core service: matching M-Pesa payments to the correct tenancy, showing landlords their portfolio in real time, routing maintenance requests, and, where a landlord has connected their KRA credentials, issuing that landlord's legally required rent invoices. We do not sell personal data, and we do not use tenant data for advertising.

Payment data is shared with Safaricom to process M-Pesa transactions. Where a landlord connects eTIMS, invoice data is shared with the Kenya Revenue Authority under that landlord's own KRA registration. We do not share personal data with any other third party except where required by law.

Every landlord and tenant can only reach their own data — this is enforced at the database layer, not just in the app, so a request crafted to bypass the interface still can't reach another account's records. Payment and tax credentials are stored encrypted and are never visible to us in plain text after you enter them.

Under the Data Protection Act, 2019, you can ask us to:

• Confirm what personal data we hold about you and provide a copy of it.
• Correct inaccurate or outdated data.
• Delete data we no longer have a lawful reason to keep.
• Object to or restrict specific processing.

To exercise any of these rights, contact us at privacy@kodara.app.

We retain tenancy and payment records for as long as an account is active and for a reasonable period after, to satisfy landlords' own tax and record-keeping obligations. You can request deletion of your account data at any time, subject to records we are required to keep by law.

If you have a concern about how your data is handled, or believe your data may have been affected by a security incident, contact privacy@kodara.app. You may also lodge a complaint with the Office of the Data Protection Commissioner of Kenya.