Privacy policy

Last updated October 16, 2026

Rentipay helps landlords in Kenya manage rentals: tenants, rent, M-Pesa payments, repairs and messages. This policy explains what personal data we handle, why, who we share it with, how long we keep it and your rights under Kenya's Data Protection Act, 2019.

1. Who is responsible for your data

• Landlords' account data. For the details landlords give us about themselves (name, email, login), is the data controller.
• Tenants' data. Each landlord decides which tenant details to keep and why, so the landlord is the data controller for their tenants' data. is the data processor: we store and process it on the landlord's behalf and only to provide the service. Tenants with questions about their data should first contact their landlord; we will help them respond.

2. What we collect

• Landlords: name, email address, username, password (stored only as a secure hash), business details such as property names and addresses, M-Pesa account settings (the Daraja keys are stored encrypted), and your Rentipay bills and payments (amounts, dates, and the M-Pesa code and phone number you paid with).
• Tenants (entered by their landlord): name, phone number, email address (optional), national ID or passport number (optional, stored encrypted), the unit rented, rent and lease details, charges, payments and their M-Pesa receipt numbers, repair requests, complaints and messages, and the announcements and SMS messages sent to them.
• M-Pesa payment notifications from Safaricom, which can include the payer's name and phone number.
• Technical data: IP addresses (to stop password guessing and spam, kept for up to an hour in our rate-limiting records), and security logs of who changed what in a landlord's records.

We do not sell personal data, use it for advertising, or build marketing profiles.

3. Why we use it, and on what basis

• To provide the service landlords sign up for: billing rent, recording payments, sending reminders, receipts and announcements, and handling repairs and complaints (performance of a contract).
• To keep accounts and payments secure, prevent fraud and fake payment notifications, and keep an audit trail of changes (legitimate interests, and our security obligations under the Act).
• To meet legal duties, such as keeping financial records.
• To reply when you contact us.

Landlords are responsible for having a lawful basis to collect their tenants' data and for telling tenants how it is used. They can point tenants to this policy.

4. Who we share it with

Only the service providers we need to run Rentipay, each bound to protect the data:

• Safaricom (M-Pesa), to request and confirm payments.
• Africa's Talking, to send SMS messages.
• Anthropic, only when a landlord chooses to import tenants from photos of their rent book: the photos are sent to Anthropic's Claude AI to read the houses, names, phone numbers and amounts, and are not kept by Rentipay afterwards.
• Our email provider, to send account and notification emails.
• Our hosting and backup providers, who store the data on our behalf.
• Our error-monitoring provider, if enabled, which receives technical error reports without tenants' personal data.

We will also disclose data if Kenyan law, a court or a regulator lawfully requires it.

Rental passport

A tenant can choose, from their rent page, to share their rent record with other landlords on Rentipay. It is off unless the tenant switches it on. A landlord moving in someone with the same ID number then sees totals only: how many months were paid on time over the last two years, how many landlords, since when, and whether rent was left unpaid. Not the payments themselves, the other landlords' names or the homes. The tenant can switch it off at any time, and landlords stop seeing it straight away.

5. Transfers outside Kenya

Some of our providers may store or process data outside Kenya. In particular, encrypted copies of our backups are kept in the European Union (Ireland), so the data survives if our main server is lost. Where data leaves Kenya, we only use providers that give appropriate safeguards for personal data, as the Data Protection Act requires.

6. How long we keep it

• Account and tenant records: while the landlord's account is active. When an account is closed we delete or anonymise its data within 90 days, except where we must keep it longer by law.
• Payment and financial records: for as long as the law requires, currently at least five years under Kenya's tax laws.
• Backups: encrypted; kept for 14 days on our server and 90 days in separate off-site storage, then deleted.
• Security logs and rate-limiting records: only as long as needed for security.

7. How we protect it

All connections use HTTPS. ID numbers, M-Pesa credentials and backups are encrypted at rest. Each landlord can only see their own records, and every change to money records is logged. Logins are protected against password guessing, and inactive sessions sign out automatically. If a breach puts your data at risk, we will notify the Data Protection Commissioner within 72 hours and tell affected people without delay, as the Act requires.

8. Your rights

Under the Data Protection Act you have the right to:

• be told how your data is used (this policy);
• get a copy of the personal data held about you;
• have inaccurate data corrected, and out-of-date or unlawfully held data deleted;
• object to some uses of your data, or ask us to restrict them;
• receive your data in a portable format.

Landlords can exercise these rights by contacting us. Tenants should contact their landlord first, or us if they cannot. We will respond within the time the law allows. You may also complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).

9. Cookies

We only use cookies needed to run the site: one to keep you signed in, and one to protect forms against forgery. Your light/dark theme choice is stored in your browser. We do not use advertising or tracking cookies.

10. Children

Rentipay is for adults. Landlord accounts are for people aged 18 or over.

11. Changes to this policy

If we make important changes we will tell landlords in the app or by email before they take effect. The date at the top shows when this policy last changed.

Contact us

Email: stormmerodida2@gmail.com
Or use our contact form.