Privacy policy

Effective date: 3 October 2026

This policy explains how Brick Bit Ltd, the company that operates Maskani Yetu ("we", "us", or "our"), collects, uses, shares, and protects your personal data when you use the Maskani Yetu website and services (the "Service"), and the rights you have. We process personal data in line with the Data Protection Act, 2019 (the "Act") and the regulations made under it. Brick Bit Ltd is the data controller for the personal data described here, except where this policy says a Lister acts as an independent controller (section 5).

1. Personal data we collect

Data you give us

• Account details: name, email address, mobile number, username or public handle, password (stored only in hashed form), profile photo, and team or organisation details.
• Lister profile: business or agent details you choose to publish, such as specialties, fee structure, availability for viewings, contact methods, and social media links.
• Listings: property descriptions, location, pricing, photographs and other media, and any documents you upload.
• Enquiries and tour requests: your name, email address, phone number, message, and preferred viewing date and type.
• Reviews: your ratings and comments about a property or Lister, and whether you marked other reviews as helpful.
• Reports and support: reports of suspicious listings (including your email address) and messages sent through our contact form.
• Waiting list: your email address, whether you are a property owner or a seeker, and a record of the consent wording you agreed to.

Data from third parties

• Social sign-in: if you sign in with Google, Facebook, or TikTok, we receive your name, email address (where the provider shares it), profile picture, account identifier, and the sign-in tokens that provider issues from that provider. We do not receive your password for those services and we do not post to them on your behalf.

Data collected automatically

• Technical data: IP address, browser and device type (user agent), pages requested, and error and performance logs.
• Usage data: searches and filters, saved (favourite) properties, and the marketing campaign link that brought you to us (for example, "utm" tags).
• Cookies and similar technologies: see section 8.

We do not ask for your national ID or passport number, and we do not collect payment card or M-Pesa details. We do not intentionally collect sensitive personal data (such as health, ethnic origin, or religion); please do not include it in listings, messages, or reviews.

2. How we use your data and our lawful basis

The Act requires a lawful basis for each use of personal data. We rely on the following:

• To create and run your account, publish your listings and profile, and deliver enquiries and tour requests to Listers — performance of our contract with you (our Terms).
• To verify your email address and secure sign-in (one-time codes, two-factor authentication), detect and prevent fraud, spam, and abuse, moderate listings and reviews, and investigate reports — our legitimate interest in keeping the Service safe and trustworthy.
• To send service messages (such as security codes, enquiry notifications, and changes to our Terms) — contract and legitimate interest. You cannot opt out of these while you have an account.
• To send launch updates and marketing emails — your consent. You can withdraw consent at any time using the unsubscribe link in any email or by contacting us.
• To understand how the Service is used and improve it, including aggregated, non-identifying statistics about property demand — legitimate interest.
• To comply with the law, respond to lawful requests from authorities, and establish, exercise, or defend legal claims — legal obligation and legitimate interest.

Where we rely on legitimate interest, we have considered your rights and you may object (section 7). We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

3. What is public

Some information is visible to anyone using the Service: your listings; your Lister profile (name or business name, public handle, profile photo, and the contact methods you choose to show); and reviews you post together with your name as displayed on your account. Think carefully before including personal details in public content.

Before a review, or a Lister's reply to a review, is saved, we automatically remove phone numbers, email addresses, M-Pesa transaction codes, KRA PINs, and national ID numbers from its text. This check is automated and may not catch everything, so please do not include anyone's personal details in a review. How reviews work explains how reviews are checked and published.

4. Who we share data with

We do not sell your personal data. We share it only as follows:

• Listers — when you send an enquiry or tour request (section 5).
• Service providers (data processors) who process data on our instructions under contracts requiring confidentiality and security:
  • cloud hosting and infrastructure providers, which store our servers and backups;
  • Resend — sending email;
  • Cloudflare (Turnstile) — distinguishing people from bots on our forms;
  • Google (Maps) — showing property locations on maps;
  • Google (Analytics, through Google Tag Manager) — measuring how the Service is used, only if you agree to analytics cookies;
  • Laravel Nightwatch — application error and performance monitoring.
• Sign-in providers (Google, Facebook, TikTok) — only when you choose to use them.
• Authorities — the police, courts, the Office of the Data Protection Commissioner, or other regulators where the law requires it, or where necessary to prevent fraud or protect someone's safety.
• Professional advisers (advocates, auditors, insurers) under a duty of confidentiality.
• A successor business — if Maskani Yetu is reorganised, merged, or sold, subject to this policy.

5. Listers are responsible for data they receive

When you contact a Lister through the Service, the Lister receives your details and uses them independently to respond to you. From that point the Lister is a separate data controller and is responsible for complying with the Act. This includes hosts of short-stay (BnB) listings: any booking, guest registration, identity check, or payment details you give a host are collected by the host, not by us. Our Terms require Listers to use your details only to respond about the relevant property. If you have a concern about how a Lister has used your data, please tell us.

6. International transfers

Some of our service providers (including those listed in section 4) store or process data outside Kenya, including in the United States and the European Union. We transfer data only where the Act permits it — for example, where the recipient provides appropriate safeguards for the security and protection of the data, or where the transfer is necessary to perform our contract with you — and we choose providers that apply recognised security standards.

7. Your rights

Under the Act you have the right to:

• be informed about how your personal data is used;
• access the personal data we hold about you;
• have inaccurate or misleading data corrected;
• have data deleted where we no longer have a lawful reason to keep it;
• object to processing, including processing for direct marketing (which we will then stop);
• withdraw consent at any time, without affecting processing already carried out;
• receive your data in a structured, commonly used, machine-readable format (data portability);
• not be subject to a decision based solely on automated processing that significantly affects you.

You can update most account details yourself from your profile settings. To delete your account, or for anything else, email [email protected]. We may need to verify your identity before acting, and we will respond within the time limits set by the Data Protection (General) Regulations, 2021. Exercising your rights is free.

8. Cookies and similar technologies

We use only the cookies and storage needed to run the Service:

• Essential cookies — to keep you signed in, remember you if you tick "remember me", and protect forms against cross-site request forgery. The Service cannot work without them.
• Security — Cloudflare Turnstile may use cookies or similar signals to check that a form is being submitted by a person.
• Maps — where a page shows a Google map, Google may set its own cookies, governed by Google's privacy policy.
• Analytics (only with your consent) — if you choose "Accept analytics", Google Analytics sets cookies (named _ga and _ga_…) so we can count visits and see which pages, searches and features are used. We send it the pages you view and actions such as searching, saving a listing or sending an enquiry. If you are signed in, we also send your account number on our system and whether you use the Service as a member or a Lister, so that visits from the same account on different devices are counted once; Google cannot tell from these who you are. We do not send your name, email address, phone number or messages. Analytics data is kept for 14 months. Until you choose, and if you choose "Only essential", no analytics cookies are set; Google may still receive a cookieless signal that a page was viewed, which it uses only to estimate totals. You can change your choice at any time with "Cookie settings" at the bottom of every page.
• Preferences — your browser's local storage remembers display choices, such as which panels you have opened or closed.

We do not use advertising or cross-site tracking cookies.

9. How long we keep data

• Account, profile, and listings: while your account is active. When you delete your account we delete your account data, or anonymise it, except where we must keep specific records longer as described below.
• Reviews: while they are displayed. If you delete your account, your reviews are deleted or anonymised.
• Enquiries, tour requests, reports, and contact messages: for as long as needed to handle them and for up to 24 months afterwards, so we can deal with follow-up questions, disputes, and fraud.
• Waiting list: until you unsubscribe or the list is closed. After you unsubscribe, we keep your email address and consent record only to make sure we do not email you again and to show we had your consent.
• Server and security logs: for a limited period, usually no longer than 90 days, unless needed to investigate an incident.
• Backups: deleted data may remain in encrypted backups until those backups are overwritten in the normal cycle.
• Legal requirements: where the law requires us to keep records (for example, tax records for paid services), or where data is needed for a legal claim, we keep it for the required period only.

10. How we protect your data

We use technical and organisational measures appropriate to the risk, including encryption of data in transit (HTTPS), hashed passwords, optional two-factor authentication, one-time email verification codes, bot protection on public forms, and access to personal data restricted to staff who need it. No system is completely secure. If a personal data breach is likely to put your rights and freedoms at risk, we will notify the Data Protection Commissioner within seventy-two (72) hours of becoming aware of it and inform affected users without undue delay, as the Act requires.

11. Children

The Service is intended for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We review this policy at least once a year and whenever we change how we use personal data. We will post the updated policy here with its effective date and email registered users when we publish it. If a change means using your personal data for a new purpose that needs your consent, we will ask for that consent before using your data that way.

13. Contact us

For privacy questions or to exercise your rights, email [email protected] or write to:

Data Protection Officer
Brick Bit Ltd (Maskani Yetu)
P.O. Box 960-00232, Ruiru, Kenya

If you are not satisfied with our response, you have the right to complain to the Office of the Data Protection Commissioner.