Privacy Notice

Who operates the service

Ceejay Creations operates the Keja Mtaani service. The address supplied is Umoja, Nairobi, Kenya; a full street or postal address is still required. Contact: ceejaycreationofficial@gmail.com.

For privacy requests or concerns, email that address with “Privacy request” in the subject. Do not email passwords, identity documents, or other unnecessary sensitive information.

Information we handle

• Account details, including email, chosen account role, and account identifiers.
• Records of the Terms of Use and Privacy Notice versions acknowledged at sign-up, and your optional marketing preference.
• Information tenants submit in a viewing request, such as name, phone number, preferred date/time, and message.
• Landlord listing details, including property description, rent, availability, photos, and location. Public map locations are approximate; the precise coordinates are used for nearby search.
• Saved search filters, including search terms, rent ranges, and approximate map-search coordinates when you choose to save a map-based search.
• When you are signed in, listing views and contact actions can be recorded with the listing, account, and time. These records support account history, landlord listing activity, service operation, and abuse prevention.
• Technical information needed to operate and secure the service may be processed by the hosting and authentication providers.

Purposes and lawful basis

We use information to create and secure accounts, publish and manage rental listings, facilitate requested contact/viewings, provide account activity features, and prevent abuse. The intended lawful bases include taking steps requested by you or performing a service you request, and consent where the law requires it. Optional marketing messages, if introduced, will have a separate opt-in. A Kenyan privacy professional should confirm the final lawful-basis wording for each purpose before launch.

Service providers and sharing

Supabase is used for database and authentication services. Transactional email is sent through the provider configured for Supabase Auth; this may be Resend if the operator has configured it. The operator must verify and name the actual email provider before launch. The app may also use its hosting provider and OpenStreetMap map tiles to provide the service.

Listing information you submit may be visible publicly after review and publication. Viewing-request details are shared with the relevant landlord to respond to your request. We do not sell personal information.

Retention, access, and deletion

Our proposed retention schedule is described in the Data Retention Policy. Signed-in users can export account data. Privacy requests are queued for manual handling; account deletion and automated cleanup are not yet implemented, and the schedule is not a promise that deletion currently runs automatically.

You may request access to or correction/deletion of your information by emailing ceejaycreationofficial@gmail.com. We may need to verify your identity and may retain information where required by law or to resolve a dispute.

Security incidents

Interim incident-response owner: Ceejay Creations, contact ceejaycreationofficial@gmail.com. The operator must formally designate a named individual as Data Protection Lead before launch. Report suspected account compromise, data exposure, or misuse promptly using that address.

1. Contain the incident, restrict access, preserve relevant records, and promptly rotate exposed Supabase/database/API credentials.
2. Review relevant hosting, Supabase, and email-provider audit/security logs; document scope, affected data, timeline, and decisions.
3. Contact affected processors and require prompt cooperation. A 48-hour processor notice is a contractual target to negotiate, not a claim that every provider is already bound to it.
4. Notify affected people and the Office of the Data Protection Commissioner when and within the periods required by applicable Kenyan law. The operator’s proposed 72-hour escalation target must be verified with qualified counsel before launch.

We use access controls and service-provider security features, but no internet service can guarantee absolute security. You may also raise a concern with the Office of the Data Protection Commissioner in Kenya.