Privacy Policy

RentVault Pay ("we," "our," "us") is committed to protecting the personal data of every landlord, manager, staff member, and tenant who uses the platform.

When you register, we ask you to acknowledge that you have received and read this Policy. That acknowledgement is not consent to ordinary personal-data processing. The lawful bases we use are explained in section 4.

We act as Data Controller for the account, security, billing, support, and platform-operations data of landlords, managers, staff, and tenants. Where a landlord determines why and how tenant and tenancy data is used and we handle that data on the landlord's instructions, the landlord is the Data Controller and we act as Data Processor.

Legal entity

Riosiri Capital Investments Proprietary Limited

Registration number

PVT-MKUMLRK9

Registered address

Milimani Building, Cathedral Street, Kisii Township, Kisii County, Kenya

Office / correspondence address

Town House, 5th Floor, Wabera Street, Nairobi, Kenya

Privacy and data-protection requests

dpo@rentvaultpay.com

General support

support@rentvaultpay.com

3.1 Data you provide directly:

• •Full name and National ID / Passport number (for KYC verification)
• •Email address and phone number
• •Physical and postal address
• •Property details and rental information
• •Bank account details and mobile-money information (e.g. M-Pesa Paybill / Till numbers)
• •KRA PIN number (where required for tax compliance)
• •Profile photo (optional)
• •Tenant-submitted M-Pesa payment codes, payment amount and date, supporting notes, and any challenge or correction you submit

3.2 Data collected automatically:

• •IP address and device information
• •Browser type and operating system
• •Session, security, and activity records generated when you use the platform
• •Payment-record status, including whether a submitted payment is pending, approved, rejected, matched, or reversed
• •The identity and timestamp of a landlord or manager who approves or rejects a submitted payment code, together with any decision note
• •Essential session cookies and related security information

3.3 Data from third parties:

• •Payment confirmation data and transaction identifiers from Safaricom M-Pesa, banks, or a landlord's configured payment channel
• •Tenant, lease, unit, and property information supplied by a landlord or authorised manager

Under the Kenya Data Protection Act, 2019, we rely on the following lawful bases:

• •Contractual necessity — to create and operate accounts, provide tenancy and payment-record services, deliver service messages, and perform our obligations under the Terms of Service.
• •Legitimate interests — to secure the platform, prevent fraud, maintain reliable records, support users, improve the service, and keep evidence of important actions. We assess those interests against the rights of affected users.
• •Legal obligation — where we must retain, disclose, or process information to comply with applicable Kenyan law or a lawful regulatory or court request.
• •Explicit consent — only for the processing and storage of property details, which Kenyan law treats as sensitive personal data. This is requested separately from the Terms, Privacy Policy acknowledgement, and offshore-processing acknowledgement.

We do not rely on consent for ordinary account, contact, tenancy-administration, payment-record, security, or service-delivery processing. In particular, a tenant's ordinary data is not processed solely on consent because the landlord may have enrolled the tenant in the service.

The current signup forms do not ask for marital status or family details, and no consent is requested for those categories.

• •To register and verify your account on the platform
• •To display the correct landlord, property, unit, lease, and tenant information to authorised users
• •To provide payment references, notifications, matching, recording, and reconciliation without receiving or holding rent
• •To receive a tenant-submitted M-Pesa code as pending and unverified until a landlord or authorised manager approves or rejects it
• •To retain the approver, decision time, status, and decision note as an audit record
• •To send payment receipts, reminders, and notifications via SMS or email
• •To generate financial reports and statements for landlords
• •To detect, prevent, and investigate fraud or unauthorised access
• •To respond to support queries and resolve disputes
• •To send service-related communications
• •To improve platform features and user experience
• •To comply with court orders, regulatory requests, or legal obligations

We do not sell your personal data. We share it only as set out below:

Who receives information Replit and Google Cloud host RentVault Pay, including our database and file storage, in the United States. They hold the account, property, tenancy, payment-record, uploaded-file and security information needed to run the platform. Celcom Africa (Kenya) sends our SMS messages, including verification codes, using your phone number and the message content. Resend (United States) sends our emails, including verification codes, using your email address and the message content. Anthropic, through Replit, is used only when your landlord or agency chooses to use our optional AI drafting tools. It may then receive your name, property and tenancy details, payment or arrears information, and the drafting instructions. It processes this in the United States and other countries. Cloudflare stores backup copies of uploaded files in its Oceania (Australia) region. Safaricom (Kenya), where M-PESA is used, receives the phone number, amount, payment reference and transaction details needed to request and confirm payment into your landlord's own account. Your landlord or agency and its authorised staff receive the tenancy information needed to manage your tenancy. Each recipient receives only what it needs for its service. This list does not widen your consent beyond property details. We will add any new recipient to this list before we use it.

6.5 Legal recipients — we may disclose the minimum necessary information to the ODPC, a court, law-enforcement agency, tax authority, or other regulator when a valid legal obligation or lawful request applies.

6.6 Internal processor register — we maintain an internal processor and transfer register (current version 2026-10-17.1) recording each active provider, purpose, data categories, recipient country, safeguards, and review information. It is not a public route or page, but it can be produced to the ODPC or another competent regulator on lawful request.

We retain personal data only for as long as it is needed for the purpose described in this Policy, to operate the account or tenancy, to resolve a dispute, to maintain reliable payment and legal-evidence records, or to meet an applicable legal obligation.

Retention depends on the type of record and the reason it is held. We do not state a fixed period unless it has been verified for that record. When an account is deleted, information that is not required may be deleted or anonymised; payment, security, policy-acknowledgement, and other evidence may be retained where a lawful reason still applies.

We review retained information and delete or anonymise it when the purpose and applicable legal basis no longer require it.

We use technical and organisational measures that are implemented in the platform, including:

• •Password hashing and authenticated sessions
• •Role-based and workspace-based access controls
• •Encryption of selected stored credentials, including KRA PIN and payment-provider credentials
• •Security and activity records used to investigate important actions
• •Data minimisation when information is sent to communications or payment providers

We do not claim that all providers have signed a data-processing agreement, that all cross-border transfers use Standard Contractual Clauses, that data centres are located in Kenya, that regular penetration testing is performed, that admin multi-factor authentication is enabled, or that audit logs are immutable.

As a data subject you have the right to:

• •Access — request a copy of the personal data we hold about you
• •Rectification — request correction of inaccurate or incomplete data
• •Erasure — request deletion where data is no longer necessary
• •Object — to processing based on legitimate interests
• •Restriction — limit our processing in certain circumstances
• •Data portability — receive your data in a structured, commonly used format
• •Withdraw consent — at any time, where consent was the basis for processing
• •Challenge or correct a payment record — a tenant may ask the landlord or us to review a pending, rejected, approved, matched, or otherwise inaccurate payment record

To exercise a right, challenge a payment record, or withdraw property-details consent, email our DPO at dpo@rentvaultpay.com. We will respond within the period required by applicable law. You may also lodge a complaint with the ODPC at www.odpc.go.ke.

We use an essential session cookie to keep you signed in and support account security. The platform may also store local preferences in your browser. Blocking essential storage may prevent login or other account functions from working.

The recipients, information they receive, purposes and countries are described in section 6. The offshore processing notice below explains processing outside Kenya.

Cross-border handling is governed by sections 48 and 49 of the Kenya Data Protection Act, 2019. Before an offshore processor is enabled or changed, we record the purpose, data categories, country, available safeguards, and review information in the internal processor register. We do not represent that every transfer uses Standard Contractual Clauses or that every recipient country has been declared adequate.

Replit and Google Cloud host RentVault Pay, including our database and file storage, in the United States. Celcom Africa in Kenya sends our SMS messages, and Resend in the United States sends our emails. If your landlord or agency chooses our optional AI drafting tools, Anthropic, through Replit, processes the drafting information in the United States and other countries. Cloudflare stores backup copies of uploaded files in its Oceania (Australia) region. Safaricom in Kenya receives payment information where M-PESA is used. Your landlord or agency and its authorised staff receive the information needed to manage your tenancy. Each recipient receives only what it needs for its service, as described in Who receives information. Foreign privacy laws and lawful government-access rules may differ from Kenya's, and enforcing your rights abroad may be more difficult. We rely on contractual necessity and legitimate interests for ordinary personal-data processing. This acknowledgement records that you received, understood, and were informed of the risks of offshore processing; it is not consent to ordinary processing.

RentVault Pay is not intended for persons under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us and we will delete it.

We may update this Policy when our services, providers, legal obligations, or processing practices change. We will publish the new version and effective date and provide an appropriate notice for material changes. Where a new acknowledgement or consent is legally required, we will ask for it separately rather than treating continued use as consent.

Legal entity

Riosiri Capital Investments Proprietary Limited

Trading as

RentVault Pay

Registration number

PVT-MKUMLRK9

Privacy and data-protection requests

dpo@rentvaultpay.com

General support

support@rentvaultpay.com

Registered address

Milimani Building, Cathedral Street, Kisii Township, Kisii County, Kenya

Office / correspondence address

Town House, 5th Floor, Wabera Street, Nairobi, Kenya

Website

www.rentvaultpay.com