1. Who this policy applies to
This policy applies when you visit the BomaSasa website, create or use a landlord account, receive a tenant onboarding link, use the tenant portal, make or record a rental payment, or contact us for support.
BomaSasa determines how account, website and support information is processed. A landlord or property manager generally determines why tenant and tenancy information is entered into BomaSasa, while BomaSasa processes that information to provide the service.
2. Information we process
- Names, telephone numbers, email addresses and account credentials.
- Property, unit, lease, deposit and emergency-contact information.
- Tenant identification details and documents submitted during onboarding.
- Invoices, balances, payment references, M-Pesa receipt details and payment status.
- Maintenance requests, descriptions, photographs and service history.
- Support messages and basic technical information needed for security and reliability.
BomaSasa does not ask for or store your M-Pesa PIN. M-Pesa authorisation takes place through Safaricom-controlled channels.
3. Why we use information
- To provide landlord, caretaker and tenant features.
- To generate invoices, reconcile payments and issue receipts.
- To send onboarding links, reminders, notices and service messages.
- To respond to support requests and protect accounts from misuse.
- To maintain, troubleshoot and improve the reliability of BomaSasa.
- To meet legal, accounting and regulatory obligations.
4. Cookies and browser storage
BomaSasa uses essential cookies and similar browser storage for secure sign-in, signed tenant sessions, interface preferences and fraud prevention. We do not currently use third-party advertising cookies on the website.
5. Lawful and fair processing
We process personal data where it is necessary to provide the service, carry out an agreement, comply with law, protect legitimate operational and security interests, or where valid consent has been provided. We aim to process only information that is relevant to a clear and legitimate purpose.
6. Service providers and transfers
BomaSasa uses trusted providers for application hosting, databases, email, messaging and payment connectivity. These may include Vercel, Neon, Resend, Africa's Talking and Safaricom. A landlord may also connect service providers needed to run their property.
Some providers may process information outside Kenya. Where that happens, we take steps to use providers and arrangements with appropriate contractual, organisational and technical safeguards consistent with applicable Kenyan data-protection requirements.
7. Retention and security
We retain information only for as long as reasonably necessary for the service, legal obligations, dispute resolution, fraud prevention and legitimate record keeping. We use access controls, encrypted connections, signed tenant links and restricted administrative access to protect information. No online system can promise absolute security, so suspected incidents should be reported promptly.
8. Your data-protection rights
Subject to Kenyan law, you may ask to be informed about how your data is used, access your personal data, object to certain processing, correct inaccurate or misleading data, request eligible deletion, or request portable data in a commonly used format. Some requests may be limited where records must be kept by law or are needed to protect another person's rights.
9. Contact and complaints
To ask a privacy question or exercise a data right, email robamanwa@gmail.com. We may need to verify your identity and, for tenant records, coordinate with the landlord or property manager responsible for that information.
You may also raise a concern with Kenya's Office of the Data Protection Commissioner through odpc.go.ke.
10. Changes to this policy
We may update this notice as BomaSasa develops or legal requirements change. The current version and its revision date will remain available on this page.