Privacy Policy

DirectHome Kenya is a property marketplace focused on users and properties in Kenya. It is operated from the United Kingdom by Dariusz Debowski trading as Smart AI Lab, who is the data controller for the processing described in this policy.

An official UK business correspondence address will be added where legally required before paid commercial services are activated. We do not publish a private residential address.

This policy applies to the DirectHome Kenya website, accounts, property listings, internal communications, verification, promotions, support and related services.

For privacy and data-rights matters, contact privacy@directhomekenya.com. General support enquiries should be sent to support@directhomekenya.com. Requests are logged with a case or reference number and tracked to resolution.

privacy@directhomekenya.com · support@directhomekenya.com

We collect information users provide, information created through use of the platform and limited technical information needed to operate and protect the service.

• Account, profile and consent information
• Property listings, files and location information
• Messages, access requests and support enquiries
• Verification, moderation, payment and promotion records
• Login, device, cookie and security records

Account data can include full name, email address, primary phone number, optional WhatsApp number, account type, county and area, company name for agents, developers or companies, verification status, account activity, consent history, password hash, sessions and security information.

Passwords are stored only as secure bcrypt hashes and never as readable plaintext. Raw session tokens are not stored in the database; only hashed session tokens are retained server-side.

Users can update their primary phone number and can change or remove an optional WhatsApp number through their authenticated profile. Phone verification is not required. Sensitive account and listing actions require a verified email address and remain subject to the platform's authentication and security controls.

Listing data can include title, description, rent or sale type, property type, price in KES, bedrooms, bathrooms, property size, area, estate, town, county, landmarks, location notes, listing status, verification status and promotion status.

Inactive listings are retained for 12 months unless a longer period is justified by a dispute, fraud report or legal requirement.

Property images are stored as optimised files on Hostinger-controlled storage. MySQL or MariaDB stores file paths, image metadata, dimensions, file size, ordering and technical information—not image binaries.

When an image is no longer referenced by an active database record, a scheduled bounded cleanup removes the orphaned file after a safety grace period. Cleanup failures remain eligible for a later retry. Images can be retained where required for a dispute, fraud report, legal hold or other justified legal matter.

A publisher must select the property's exact position on the map. DirectHome Kenya can store the private latitude and longitude of that pin together with area, estate, town, county, nearest landmark and location notes. Public pages show only an approximate location or area.

On-site GPS confirmation is optional. Only when the publisher chooses to use it, DirectHome Kenya can collect the captured device location, GPS accuracy, timestamp, distance from the selected property pin and presence-verification result. The browser or device asks for permission before GPS data is captured. A successful check can add a verified-location badge but is not required for submission or publication. It does not prove ownership, title, authority to sell or rent, property condition or freedom from disputes.

Exact coordinates are private by default. Public pages show only an approximate location or area. A registered interested user can request exact location through internal messaging. The owner or lister can approve, decline or revoke access.

Approval is personal, non-transferable, linked to one requester account, valid for 48 hours and logged with request, approval, expiry and revocation history. While approved, the requester can view the exact location on a map and use Get Directions. Raw latitude and longitude are not displayed unnecessarily. Owners and authorised administrators can view request and decision history.

Owner and agent phone and WhatsApp details are private by default. Initial contact takes place through internal messaging. A user can request access, and the owner or lister can approve or decline sharing for that specific requester. Approval is personal, logged, not public to all users and revocable where appropriate.

Internal messaging is text-only. Photo, PDF and other file attachments are not available. Users must not send passwords, M-Pesa PINs, bank login credentials, unnecessary identity information or other sensitive credentials in message text.

Active conversations can be retained while an account is active. After account deletion or conversation closure, messages can be retained for up to 12 months. Messages related to fraud, abuse, disputes, claims or investigations can be retained for up to 24 months where justified.

Users must be at least 18 to create transaction-related accounts or publish listings. People who only search do not need to upload identity documents. Owners, agents, developers and other listers must verify identity and age using an identity document.

The full document image can be retained for up to 30 days after verification and is then permanently deleted. Audit data can include verified name, age 18+ confirmation, document type, issuing country, expiry date, masked number, verification time, verifier, result, rejection reason, cryptographic file hash and consent/security log. That audit record can remain for the account lifetime and up to 12 months after deletion where justified.

DirectHome Kenya does not verify a property seeker's identity on behalf of a landlord or seller. The contracting party remains responsible for its own identity checks and contracts.

Live Video Verification calls are not recorded or stored. DirectHome Kenya does not retain video, audio, screenshots or document copies shown during the call. It retains only the verification time, verifier, outcome, short notes about what was checked and verification expiry.

Video Verification confirms only what was visibly checked during the live call. It is not title verification, proof of ownership, conveyancing, valuation, structural inspection or a guarantee against fraud.

Payments and paid promotions are not active. Private location and contact access currently costs 0 KES and still requires the lister's approval. Future paid services may be introduced only after they are configured and clearly presented to users.

If payments are activated in the future, relevant accounting and payment records can be retained where required for tax, accounting, refunds or disputes. DirectHome Kenya never stores M-Pesa PINs, online banking passwords or full payment credentials.

Ordinary enquiries and support correspondence can be retained for up to 12 months after closure. Payment, fraud, complaint, dispute or legal-claim matters can be retained for up to 24 months where justified. Unnecessary sensitive information is deleted earlier when no longer needed.

Security records can include login date and time, protected IP-derived identifier or hash, device and browser information, failed login attempts, active sessions and devices. Users can sign out all other sessions. Login history can be retained for up to 12 months.

DirectHome Kenya stores service notifications in the user's account so important events such as enquiries, replies, access decisions, moderation outcomes and expiring access remain available after signing out, changing device or restarting the application.

Web Push is optional and requires browser or device permission. When enabled, we store a per-device push endpoint, public encryption keys, browser information and delivery status. Notification content is limited to necessary service information and links only to approved DirectHome Kenya pages. Users can disable Web Push from the notification menu or browser settings without disabling durable in-platform notifications. Invalid or expired device subscriptions are removed automatically.

Necessary cookies support authentication, sessions, security, account protection and core functions and remain active independently of analytics choices. Analytics is optional and off until permission is granted.

The cookie interface provides Accept, Reject and Manage Preferences, with Reject as easy as Accept. Choices can be changed or withdrawn later through Cookie Settings in the footer. Google Consent Mode defaults analytics and all advertising consent types to denied. DirectHome Kenya does not enable Google advertising cookies.

When analytics is enabled for the platform and a GA4 measurement ID is configured, Google Analytics 4 is loaded only after Analytics permission is granted. Withdrawing permission stops future analytics collection. The target GA4 user and event retention configuration is 14 months. Analytics can include pages viewed, interactions, device type, browser, approximate location, referral source, performance and usage events, but must not include private account content or direct identifiers.

DirectHome Kenya can recommend properties based on searches, viewed listings, saved properties, location preferences and account activity. Recommendations do not make legal or financial decisions. DirectHome Kenya does not sell advertising profiles. Personalised recommendations can be disabled in account settings.

Users can report listings, accounts, messages, fraud, abuse, harassment, impersonation, prohibited content, misleading information or safety concerns. A serious listing report temporarily hides the listing pending review, notifies the owner, creates a case number and provides a reason category. The owner can respond with an explanation and evidence.

An administrator records the investigation and can restore the listing, require corrections, maintain suspension or remove it. Reports, notes, evidence and decisions follow applicable dispute and investigation retention periods.

We use data to operate accounts and listings, provide messaging and controlled access, verify listers, protect users, moderate content, respond to support, process promotions and payments, improve relevant recommendations, maintain security and meet legal obligations.

Depending on the activity, potential lawful bases include performance of a contract, legitimate interests in security, fraud prevention and service operation, legal obligations, consent for optional analytics and marketing, and establishment, exercise or defence of legal claims. One basis does not automatically apply to every activity.

Information marked as required is necessary to create or secure an account, publish a listing, verify a lister, process a requested service or meet a legal obligation. Optional information can be left blank or removed where the relevant feature permits.

Listing descriptions and approximate areas are public once published. Exact coordinates, private contact details, messages, identity records, sessions and security records are restricted according to role, purpose and access approval.

Data is shared only where necessary with Hostinger as infrastructure provider; email providers for service messages; payment providers when activated; analytics providers after consent; professional advisers; law enforcement or regulators where legally required; and a legitimate future buyer, investor or successor operator during a sale, merger or transfer, subject to confidentiality and legal safeguards.

The system remains self-hosted and transferable. The main application, database and optimized property files operate on Hostinger-controlled infrastructure.

DirectHome Kenya operates from the United Kingdom and focuses on Kenya. International access or processing can occur. Appropriate contractual, technical or other safeguards are used where required. We do not claim a specific physical data-centre location in this policy.

Controls include bcrypt password hashing, hashed server-side session tokens, HTTP-only cookies, prepared database statements, access controls, rate limiting, origin checks, security headers, audit logs and restricted exact-location access. No internet service can promise absolute security.

The operational retention target is at least 7 daily restore points and 4 longer-term weekly restore points where infrastructure permits. This is a target rather than a guarantee, and operators verify actual backup coverage without inferring retention from a hosting plan name. Deleted data can remain in restricted backups until the relevant restore point is overwritten or retired. Backups support disaster recovery and full-system restoration, not routine restoration of individual deleted accounts or listings. Specific operational retention periods are described in the relevant sections above.

A user must re-authenticate before requesting deletion. The system checks for active disputes, fraud investigations, unpaid obligations, legal holds, active paid promotions and other justified retention requirements.

Without a blocker, the account is immediately restricted from new activity, deletion or anonymisation is scheduled after 30 days and the user is notified. With a blocker, deletion is paused, the reason is explained and the case goes to administrator review. Administrators handle exceptional cases and cannot arbitrarily refuse deletion. Profile data is deleted or anonymised after 30 days; minimal security, fraud, dispute, legal and audit records can remain for up to 12 months where justified.

Users can request a portable copy from account settings, potentially including profile data, listings, saved properties, internal messages and exact-location request history. Exports exclude unnecessary data belonging to others. Re-authentication or a recent secure session is required. Delivery can use JSON or ZIP.

Versioned records of Privacy Policy acceptance, Terms acceptance, marketing consent and withdrawal can include document type, version, time, action and relevant security metadata. Users and authorised administrators can review consent history.

Marketing consent is optional, separate from registration, off by default and withdrawable. Launch channels are in-platform notifications and opted-in email—not SMS or WhatsApp marketing. Password resets, listing status, access requests, security notices, payment confirmations and moderation notices are service messages, not marketing.

Subject to applicable law and identity verification, rights can include access, correction, deletion, restriction, objection, portability, withdrawal of consent and complaint. Contact privacy@directhomekenya.com. A request does not always require immediate deletion where lawful retention applies.

The service is not intended for children. Users must be at least 18 to create property transaction accounts or publish listings.

Where an incident involving personal data or account security is likely to create a real risk, affected users are notified by email and in-platform notification. The notice explains what happened, affected data or systems, likely consequences, measures taken and practical protective steps.

Privacy concerns should first be sent to privacy@directhomekenya.com so they can be investigated and tracked. Users may also have the right to complain to an applicable data-protection authority, subject to the law governing their circumstances.

We update this policy when services, practices or legal requirements change. Material changes are communicated appropriately and the effective and last-updated dates are revised.