Privacy Policy

Information we collect

We collect information directly from you, from third parties you authorize (such as Google when you sign in with OAuth), and automatically as you use the service:

• Account details: full name, email address, telephone number, password (stored as a bcrypt hash), and optional profile image.
• Identity verification: one-time codes sent during email confirmation and password reset.
• Organization and property records: organizations you own or belong to, properties, property units, vacancy status, property groups and features.
• Tenant and lease data: tenant records, lease agreements, contract templates, generated and uploaded contract PDFs.
• Operational records: maintenance requests you submit or approve, announcements you publish, payments you record or confirm, and payment method details.
• Communications: chat messages exchanged with other members of organizations you belong to, and invitations you send or receive.
• Authentication data: session records, signed session cookies, OAuth provider identifiers (such as your Google account ID and email) when you sign in with a third-party provider.
• Technical data: IP address, browser type, device information, and basic request logs needed to operate the service securely. All traffic reaches us through Cloudflare's network, which sees your IP address and request metadata so it can block attacks and bots before they reach our servers.
• Push notification tokens: if you install the Android app and enable notifications, the device token that Google's Firebase Cloud Messaging issues for that device, so we can deliver notifications to it.
• Error reports: when something breaks, a report with your user ID and the request that failed (never your password) goes to our error-monitoring provider so we can fix it.

How we use information

We use the information above only for purposes that are necessary to run the service or that you would reasonably expect:

• Authenticate you, keep your session active, and recover access to your account.
• Provide the core functionality: managing properties, units, tenants, lease agreements, payments, maintenance requests, announcements, and chats.
• Send transactional emails such as account confirmations, password resets, invitations, and notifications, and push notifications to the Android app when you enable them.
• Generate documents on your behalf, such as lease agreements produced from contract templates.
• Detect and prevent abuse, fraud, and unauthorized access; investigate incidents.
• Respond to your support requests and improve the product.

We do not sell your personal information, and we do not use it for advertising.

Cookies and similar technologies

We use a small number of strictly necessary cookies. We do not use cookies for advertising or third-party tracking.

• A signed, HTTP-only session cookie that keeps you logged in.
• Short-lived cookies used during sign-in, OAuth callbacks, and CSRF protection.
• A Cloudflare bot check on the sign-in, sign-up, password-reset, and invitation forms, which may store a short-lived token in your browser, used only to tell people from bots.

How we share information

We share information only with the third parties that help us operate the platform, and only to the extent they need to perform their function on our behalf:

• Cloud hosting and database providers that store the data backing your account.
• Transactional email delivery providers used to send confirmations, password resets, invitations, and notifications.
• File storage providers used to host uploaded contract PDFs, profile images, and other attachments.
• Identity providers (such as Google) when you choose to sign in with OAuth, we receive your name, email, and the provider's unique account ID.
• Mobile-money providers (MTN Mobile Money Cameroon) when rent is collected through the platform: the payer's mobile-money number and the amount are sent to them to carry out the charge.
• Cloudflare, whose network sits in front of the site: every request passes through it, and its bot check runs on our sign-in, sign-up, password-reset, and invitation forms. It processes your IP address and request metadata for security only.
• Google's Firebase Cloud Messaging, which delivers push notifications to the Android app when you enable them: it receives your device token and the title and text of each notification.
• Our error-monitoring provider (Sentry), which receives error reports that may include your user ID and the request that failed.

We may also disclose information when required by law, to protect the rights and safety of users, or in connection with a corporate transaction such as a merger or acquisition.

How we protect information

We use industry-standard safeguards to protect your data, including TLS in transit, bcrypt password hashing, signed cookies, scoped data access by organization, and access controls based on roles within each organization. No system is perfectly secure, so please choose a strong password, keep your credentials private, and tell us right away if you suspect unauthorized access.

Data retention

We keep personal data only for as long as it serves the purpose it was collected for, then delete it on a schedule:

• Sign-in sessions: end 30 days after sign-in, or after 3 days without activity; you simply sign in again.
• One-time verification codes: valid for 5 minutes; stored code hashes are cleared within a day.
• Change-history (audit) records: deleted after 2 years.
• Push notification tokens: removed with the sign-in session they belong to, and cleared as soon as the device stops accepting notifications.
• Error reports: kept by our error-monitoring provider for its standard retention window of 90 days.
• Account details: kept while your account exists, and erased when you delete it (see "Your rights and choices" below).
• Lease, invoice, and payment records: retained by the organizations that manage them for as long as bookkeeping and rental obligations require, even after the people involved delete their accounts; personal details are removed from them at deletion.

Your rights and choices

Cameroon's Law No. 2024/017 of 23 December 2024 on the protection of personal data grants you rights of access, rectification, erasure, objection, and portability over your personal data. Within the platform:

• Access and update most of your information from your account and organization settings.
• Export or download contract PDFs and other documents you uploaded.
• Remove members from organizations you own, or leave organizations you belong to.
• Delete your account yourself from Account settings → Edit → Delete account. If no lease, billing, or organizational records reference your account, it is permanently deleted outright; otherwise your name, contact details, and sign-in are permanently removed and the retained records continue without them.
• Request a copy of your data, corrections we cannot fulfill in-app, or any other right under the law using the contact details below, we answer within the time the law prescribes.

These rights can also be exercised by your heirs after your death, as the law provides. Contact us using the details below to exercise any right we cannot fulfill directly through the application.

Children's privacy

The service is intended for use by adults managing rental properties. We do not knowingly collect personal information from anyone under 18. If you believe we have collected information from a minor, contact us so we can delete it.

International data transfers

The service is operated from Cameroon, but the infrastructure behind it runs abroad: our application and database servers are hosted in Germany, uploaded files are stored with Amazon Web Services in Frankfurt, Germany (eu-central-1), and our email-delivery, push-notification (Google Firebase), error-monitoring, and sign-in providers process limited data in the European Union and the United States. All traffic also passes through Cloudflare, a United States company, whose edge network processes your IP address and request metadata at locations around the world, including in the European Union.

We maintain an inventory of these transfers and contractual safeguards with each provider, and will register the processing with Cameroon's data protection authority as soon as its registration procedures open.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the date at the top of this page and, where appropriate, notify you in the application or by email. Your continued use of the service after changes take effect constitutes acceptance of the updated policy.

Contact us

If you have questions about this Privacy Policy or how we handle your information, contact us at [email protected].