Cookie Policy

Cookies are small text files that are stored on your device (computer, tablet, or mobile phone) when you visit a website. They are widely used to make websites work efficiently, to improve user experience, and to provide information to website operators.

Similar technologies include web beacons, pixel tags, local storage, and session storage. We refer to all of these collectively as 'cookies' in this Policy.

2.1 First-Party Cookies — these are cookies set directly by RentVault Pay when you visit our website or use our platform. We control these cookies entirely.

2.2 Third-Party Cookies — these are cookies set by third-party services that we use to support our platform, such as analytics providers, payment processors, and security tools. These third parties have their own privacy and cookie policies.

3.1 Strictly Necessary Cookies. These cookies are essential for the Platform to function and cannot be switched off. They do not require your consent.

session_id

Session — maintains your authenticated login session (expires at session end).

csrf_token

Session — protects against cross-site request forgery attacks (expires at session end).

pnx_auth

Persistent — keeps you logged in if 'Remember Me' is selected (30 days).

pnx_prefs

Persistent — stores your UI preferences such as language and display settings (1 year).

3.2 Performance and Analytics Cookies (optional). Google Analytics 4 (GA4) is currently disabled. Publishing this policy does not enable it. If analytics is enabled later, it will remain off for you unless you choose to accept analytics on our public website.

If you opt in, Google receives pseudonymous browser identifiers and technical information about the visit, including the public page viewed and browser or device characteristics. Network requests also disclose connection information, including the request's IP address, to Google. This is not the same as collecting only anonymous data. Reports help us improve the public website.

Analytics does not run on login, signup, tenant setup, signed-in account, payment-link or document-signing pages. We do not send names, contact details, tenancy records, rent amounts, payment references, URL queries or URL fragments to Google Analytics. We do not enable advertising cookies, Google signals or advertising personalisation through this integration.

_ga

Optional GA4 pseudonymous browser identifier — up to 180 days, only after opt-in.

_ga_BCZQCN48ND

Optional analytics state for this GA4 property — up to 180 days, only after opt-in.

rvp-public-analytics-choice

Local storage, not a cookie — remembers your analytics choice and policy version for up to 180 days.

3.3 Functional Cookies. These enable enhanced functionality and personalisation. If you disable them, some features may not work as intended.

pnx_lang

Persistent — stores your selected language preference (1 year).

pnx_dash

Persistent — remembers your dashboard layout and widget preferences (6 months).

pnx_notify

Session — tracks which in-app notifications you have dismissed.

3.4 Security Cookies. These are used to protect you and our Platform from fraud and unauthorised access.

pnx_sec

Session — detects and prevents suspicious login attempts.

pnx_2fa

Persistent — remembers trusted devices for two-factor authentication (30 days).

cf_clearance

Persistent — Cloudflare security cookie to distinguish bots from humans (1 year).

3.5 Third-Party Payment Cookies. When you or a tenant initiates a payment, third-party payment processors may set their own cookies. These are governed by the respective providers' cookie and privacy policies:

• •Safaricom M-Pesa — subject to Safaricom's Privacy Policy;
• •Payment gateway providers — subject to their respective policies.

We recommend reviewing the cookie policies of these providers. We do not control or have access to these cookies.

Cookies are either:

• •Session cookies — these are temporary and are deleted when you close your browser;
• •Persistent cookies — these remain on your device for a fixed period (as set out in the tables above) or until you delete them manually.

5.1 Analytics Choices. While GA4 is disabled, no Google Analytics tracking runs and no analytics opt-in is needed. If optional analytics is enabled later, a notice on public pages will offer:

• •Essential only — refuse analytics and keep using the service;
• •Accept analytics — allow optional public-page analytics;
• •Manage preferences — choose whether to allow optional analytics.

When optional analytics is enabled, you can change or withdraw your choice using Cookie preferences in the footer of public pages, including the Cookie Policy page. Withdrawal stops future analytics collection and removes the analytics cookies set by this integration. It does not undo processing that already occurred. Essential service functions do not require analytics consent. If your browser blocks storage, the integration fails closed and does not begin tracking.

5.2 Browser Settings. You can also manage cookies directly through your browser settings. Most browsers allow you to:

• •View cookies that have been set;
• •Delete individual or all cookies;
• •Block cookies from specific or all websites;
• •Set preferences for how cookies are handled.

Instructions for managing cookies in common browsers:

• •Google Chrome: Settings > Privacy and Security > Cookies and other site data
• •Mozilla Firefox: Settings > Privacy & Security > Cookies and Site Data
• •Safari: Preferences > Privacy > Manage Website Data
• •Microsoft Edge: Settings > Cookies and Site Permissions

5.3 Opt-Out Tools. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on available at tools.google.com/dlpage/gaoptout.

No. We do not use advertising cookies, retargeting pixels, or behavioural tracking technologies for marketing purposes. We do not share your data with advertising networks or allow advertisers to place cookies on our Platform.

Any personal data collected through cookies (such as login session identifiers or device identifiers) is processed in accordance with our Privacy Policy and the Kenya Data Protection Act, 2019. Cookie data is stored securely and is not shared with third parties except as described in this Policy.

We may update this Cookie Policy from time to time to reflect changes in our use of cookies or in applicable law. We will notify you of significant changes via a notice on the Platform or by email. The current version will always be available at www.rentvaultpay.com/cookie-policy (also reachable at /cookies).

If you have any questions about our use of cookies, please contact:

Legal Entity

Riosiri Capital Investments Proprietary Limited

Trading As

RentVault Pay

Privacy / Cookie Queries

dpo@rentvaultpay.com

Data Protection Officer

dpo@rentvaultpay.com

Website

www.rentvaultpay.com

For complaints about our use of cookies, you may also contact the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.