Privacy Policy
Last updated: July 2026 · Effective immediately. We will notify you of material changes by email.
✓ We do not sell your personal data. We do not use advertising cookies or third-party tracking pixels. We collect only what we need to run the platform.
Apatmento ("we", "us", "our") is committed to protecting your privacy. This policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and your rights under Kenyan law and good data protection practice.
1. Data Controller
The data controller responsible for your personal information is Apatmento, operating the Cabana platform, based in Nairobi, Kenya. For privacy-related matters, contact us at connect@apatmento.space.
2. Information We Collect
Information you provide directly:
| Category | Examples | When Collected |
|---|
| Account information | Full name, email address, phone number, profile photo | Registration |
| Identity verification | Government ID (for hosts); selfie verification | Partner/Agent onboarding |
| Booking information | Check-in/out dates, guest count, special requests, booking reference | When you make or receive a booking |
| Host / listing data | Property name, address, description, photos, pricing, availability, M-Pesa payout number | Listing creation and management |
| Payment references | M-Pesa transaction reference numbers, payment amounts | Each transaction |
| Communications | Reviews, support messages, dispute submissions | When you contact us or post content |
| Agent & referral data | Referral codes, commission balances, referred user IDs | Agent / referral programme participation |
| Rewards data | Points balance, redemption history | On each qualifying booking |
Information collected automatically:
- Usage data: Pages visited, features used, search queries, time spent, click paths
- Device & browser data: Browser type and version, operating system, screen resolution, language preferences
- Network data: IP address, approximate location derived from IP (city/country level), internet service provider
- Session data: Authentication tokens stored in your browser's local storage or as session cookies
- Push notification tokens: Device tokens used to deliver push notifications (only if you opt in)
3. Legal Basis for Processing
We process your personal data on the following legal grounds:
- Contract performance: Processing necessary to provide you with bookings, payouts, and account services you have requested
- Legitimate interests: Platform security, fraud prevention, improving our services, and analytics — provided these interests are not overridden by your rights
- Legal obligation: Retaining financial records for tax and regulatory compliance under Kenyan law
- Consent: Push notifications, marketing communications, and optional features — you may withdraw consent at any time
4. How We Use Your Data
- To create and manage your account
- To process bookings and payments, and send confirmations and receipts
- To connect guests with hosts and facilitate the booking relationship
- To calculate and pay referral commissions and agent earnings
- To manage your rewards points balance and process redemptions
- To respond to customer support requests and resolve disputes
- To send transactional communications (booking confirmations, check-in reminders, receipts) — these cannot be opted out of while you have active bookings
- To send service updates and platform announcements (you may opt out)
- To improve the platform through aggregated, anonymised analytics
- To detect, investigate, and prevent fraud, abuse, and security incidents
- To comply with Kenyan legal and regulatory obligations
- To enforce our Terms of Service
We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects without human review.
5. Payment Data
Payments are processed via M-Pesa through PayHero. We handle payment data as follows:
- We do not store your M-Pesa PIN, full M-Pesa credentials, or any card details — we never see them
- We store M-Pesa transaction reference numbers and payment amounts to verify and confirm bookings
- We store your M-Pesa phone number (as provided on your account) solely to initiate STK Push payment requests and to pay out earnings to hosts and agents
- PayHero processes the actual M-Pesa transaction; their privacy policy governs how they handle payment data
- Financial records (booking amounts, platform fees, payout records) are retained for 7 years for tax and legal compliance purposes, even after account deletion
6. Data Sharing
We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances:
- Hosts: When you book a property or tour, we share your name and phone number with the host to facilitate check-in and communication
- Guests: When you accept a booking as a host, we share the guest's name and contact details with you
- Agents: Agents can see that a referred user signed up and made bookings (without personal identifying details beyond what is necessary to verify commission eligibility)
- PayHero / M-Pesa: Your phone number and booking amount are shared to initiate and process payments
- Supabase: Our database provider (USA/EU) stores your account and booking data under a Data Processing Agreement. Supabase is SOC 2 Type II certified.
- Vercel / Netlify: Our hosting provider processes web traffic logs including IP addresses. These providers are contractually bound to data protection obligations.
- Push notification services: If you opt in to push notifications, your device token is processed to deliver notifications. We use no third-party advertising networks for notifications.
- Law enforcement and regulators: Where required by a court order, subpoena, or applicable Kenyan law, we may disclose personal data. We will notify you of such disclosures where legally permitted.
- Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of our assets, your data may be transferred. We will notify you before such transfer and your rights under this policy will be maintained.
7. Data Retention
- Account data: Retained for the duration of your active account
- Booking records: Retained for 7 years after the booking date for tax and legal compliance
- Financial records (platform fees, payouts): 7 years
- Communications and support tickets: 3 years after closure
- Usage and analytics logs: Aggregated and anonymised after 12 months; raw logs deleted after 90 days
- Deleted accounts: Personal data is anonymised or deleted within 30 days of account deletion, except where retention is required by law (e.g. financial records)
- Marketing preferences: Retained until you opt out or delete your account
8. Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- All data transmitted between your browser and our servers is encrypted using HTTPS (TLS 1.2 or higher)
- Database storage via Supabase with row-level security policies and encrypted storage at rest
- Sensitive credentials (API keys, M-Pesa secrets) stored as server-side environment variables, never in client-side code
- Passwords are hashed using bcrypt and never stored in plaintext
- Access to production data is restricted to authorised personnel only
- Session tokens are rotated on authentication and expire after a period of inactivity
No system is completely secure. In the event of a personal data breach that poses a risk to your rights, we will notify you promptly by email and take immediate steps to contain and remediate the breach.
9. Cookies & Tracking
We use minimal cookies necessary for the operation of the platform. We do not use advertising cookies, third-party tracking pixels, or behavioural profiling tools. For full details, see our Cookie Policy.
In summary, we use:
- Authentication cookies / local storage: Supabase session tokens to keep you logged in — these are strictly necessary and cannot be opted out of while using the Service
- Preference storage: Local storage for UI preferences (dark mode, notification settings) — no personal data is sent to third parties
We do not use Google Analytics, Facebook Pixel, or any other third-party analytics or advertising tracking.
10. Push Notifications
If you opt in to push notifications through your browser or our Progressive Web App:
- Your browser generates a unique device push token which is stored in our database linked to your account
- We use this token to send you notifications about booking confirmations, check-in reminders, and platform updates
- You can opt out at any time through your browser's notification settings or your Apatmento account settings
- Revoking push notification permission does not delete your account or affect your bookings
- We do not share push notification tokens with third-party advertising networks
11. Location Data
We do not continuously track your location. Location data is used only in the following specific contexts:
- Emergency SOS: If you use the in-app Emergency SOS feature, your precise GPS location is shared with emergency services (and only when you explicitly activate this feature)
- IP-based location: We derive an approximate city or country from your IP address for fraud detection and to improve search relevance — this is not precise GPS location data
- "Near me" searches: If you use location-based search features, your browser may request your location. This is processed locally in your browser to return relevant results and is not stored on our servers.
12. Third-Party Links & Services
Apatmento contains referral links to third-party services (rides, food, flights, shopping). When you click these links and use those services:
- You will be subject to the third party's own privacy policy and terms
- Apatmento is not responsible for the privacy practices of third-party services
- We may receive confirmation that a referral was completed (for commission purposes) without receiving your personal data from the third party
We encourage you to review the privacy policies of any third-party services you use.
13. Children's Privacy
Apatmento is not intended for, and does not knowingly collect personal data from, individuals under the age of 18. If we become aware that we have collected personal data from a child under 18 without parental consent, we will delete that data promptly. If you believe a child has provided us with personal data, please contact connect@apatmento.space.
14. Your Rights
You have the following rights regarding your personal data:
- Access: You can request a copy of the personal data we hold about you
- Correction: You can correct inaccurate or incomplete data via your account settings, or by contacting us
- Deletion: You can request deletion of your account and associated personal data. We will honour this within 30 days, subject to legal retention requirements for financial records
- Restriction: You can ask us to restrict processing of your data in certain circumstances (e.g. while a dispute is under review)
- Objection: You can object to processing of your data based on legitimate interests
- Data portability: You can request your account data in a machine-readable format (JSON)
- Withdraw consent: Where processing is based on consent (e.g. marketing emails, push notifications), you can withdraw at any time without affecting the lawfulness of prior processing
To exercise any of these rights, email connect@apatmento.space with the subject line "Data Rights Request". We will respond within 30 days. We may need to verify your identity before processing the request.
If you are not satisfied with our response, you have the right to lodge a complaint with the relevant data protection authority in Kenya.
15. Changes to This Policy
We may update this Privacy Policy from time to time. When we do:
- We will update the "Last updated" date at the top of this page
- We will notify you of material changes by email at least 30 days before they take effect
- For significant changes that affect how we use your data, we may ask for your renewed consent
Your continued use of the Service after the effective date of changes constitutes acceptance of the updated policy.
For any privacy-related questions, requests, or concerns, reach us through any channel:
See also: Terms of Service · Cookie Policy