Privacy Policy

DirectHome Kenya is a property marketplace focused on users and properties in Kenya. It is operated from the United Kingdom by Dariusz Debowski trading as Smart AI Lab, who is the data controller for the processing described in this policy.

An official UK business correspondence address will be added where legally required before paid commercial services are activated. We do not publish a private residential address.

This policy applies to the DirectHome Kenya website, accounts, property listings, internal communications, verification, promotions, support and related services.

For privacy and data-rights matters, contact privacy@directhomekenya.com. Requests are logged with a case or reference number and tracked to resolution.

privacy@directhomekenya.com

We collect information users provide, information created through use of the platform and limited technical information needed to operate and protect the service.

• Account, profile and consent information
• Property listings, files and location information
• Messages, access requests and support enquiries
• Verification, moderation, payment and promotion records
• Login, device, cookie and security records

Account data can include full name, email address, primary phone number, optional WhatsApp number, account type, county and area, company name for agents, developers or companies, verification status, account activity, consent history, password hash, sessions and security information.

Passwords are stored only as secure bcrypt hashes and never as readable plaintext. Raw session tokens are not stored in the database; only hashed session tokens are retained server-side.

Users can change or remove an optional WhatsApp number. A primary phone number can be changed only after the new number is verified; the old number remains active until verification succeeds. The change is logged and the user is notified by email. A primary number can be removed only if another verified contact method remains available. Owners and agents need an active verified contact number before publishing listings.

Listing data can include title, description, rent or sale type, property type, price in KES, bedrooms, bathrooms, property size, area, estate, town, county, landmarks, location notes, listing status, verification status and promotion status.

Inactive listings are retained for 12 months unless a longer period is justified by a dispute, fraud report or legal requirement.

Property images are stored as optimised files on Hostinger-controlled storage. MySQL or MariaDB stores file paths, image metadata, dimensions, file size, ordering and technical information—not image binaries.

Images belonging to deleted listings are permanently deleted after 30 days unless temporarily required for a dispute, fraud report or legal matter.

DirectHome Kenya can collect latitude, longitude, GPS accuracy, timestamp, captured device location, distance from the property pin, presence-verification result, area, estate, town, county, nearest landmark and location notes. The browser or device asks for permission before location is captured.

A lister must be physically present near the property before publication. GPS presence confirms physical presence near the location only. It does not prove ownership, title, authority to sell or rent, property condition or freedom from disputes.

Exact coordinates are private by default. Public pages show only an approximate location or area. A registered interested user can request exact location through internal messaging. The owner or lister can approve, decline or revoke access.

Approval is personal, non-transferable, linked to one requester account, valid for 48 hours and logged with request, approval, expiry and revocation history. While approved, the requester can view the exact location on a map and use Get Directions. Raw latitude and longitude are not displayed unnecessarily. Owners and authorised administrators can view request and decision history.

Owner and agent phone and WhatsApp details are private by default. Initial contact takes place through internal messaging. A user can request access, and the owner or lister can approve or decline sharing for that specific requester. Approval is personal, logged, not public to all users and revocable where appropriate.

Users can exchange text, property photos and PDF documents. They must not send passwords, M-Pesa PINs, bank login credentials, unnecessary identity documents or other sensitive credentials. Attachments are subject to file-type and size limits, safe filenames, access control and malware or content checks where available.

Active conversations can be retained while an account is active. After account deletion or conversation closure, messages can be retained for up to 12 months. Messages related to fraud, abuse, disputes, claims or investigations can be retained for up to 24 months. Attachments are normally deleted 90 days after closure unless needed as evidence.

Users must be at least 18 to create transaction-related accounts or publish listings. People who only search do not need to upload identity documents. Owners, agents, developers and other listers must verify identity and age using an identity document.

The full document image can be retained for up to 30 days after verification and is then permanently deleted. Audit data can include verified name, age 18+ confirmation, document type, issuing country, expiry date, masked number, verification time, verifier, result, rejection reason, cryptographic file hash and consent/security log. That audit record can remain for the account lifetime and up to 12 months after deletion where justified.

DirectHome Kenya does not verify a property seeker's identity on behalf of a landlord or seller. The contracting party remains responsible for its own identity checks and contracts.

Live Video Verification calls are not recorded or stored. DirectHome Kenya does not retain video, audio, screenshots or document copies shown during the call. It retains only the verification time, verifier, outcome, short notes about what was checked and verification expiry.

Video Verification confirms only what was visibly checked during the live call. It is not title verification, proof of ownership, conveyancing, valuation, structural inspection or a guarantee against fraud.

Records can cover paid promotions, featured listings, top-of-list placement, homepage promotion, urgent badges, boosts, refunds, invoices, payment status, provider references and accounting transactions. Basic listing prices can be zero at launch, and future prices are controlled through configurable platform settings.

Accounting and payment records can be retained for six years after the end of the relevant UK tax year where required for tax, accounting, refunds or disputes. DirectHome Kenya never stores M-Pesa PINs, online banking passwords or full payment credentials.

Ordinary enquiries and support correspondence can be retained for up to 12 months after closure. Payment, fraud, complaint, dispute or legal-claim matters can be retained for up to 24 months where justified. Unnecessary sensitive information is deleted earlier when no longer needed.

Security records can include login date and time, protected IP-derived identifier or hash, device and browser information, failed login attempts, active sessions and devices. Users can sign out all other sessions. Login history can be retained for up to 12 months.

Necessary cookies support authentication, sessions, security, account protection and core functions. Google Analytics 4 is activated only after valid consent; analytics cookies are off by default.

The cookie interface provides Accept, Reject and Manage Preferences, with Reject as easy as Accept. Choices can be changed later. Google Consent Mode is used so GA4 respects the choice. GA4 user and event retention is 14 months. Analytics can include pages viewed, interactions, device type, browser, approximate location, referral source, performance and usage events. Analytics data is not described as fully anonymous.

DirectHome Kenya can recommend properties based on searches, viewed listings, saved properties, location preferences and account activity. Recommendations do not make legal or financial decisions. DirectHome Kenya does not sell advertising profiles. Personalised recommendations can be disabled in account settings.

Users can report listings, accounts, messages, fraud, abuse, harassment, impersonation, prohibited content, misleading information or safety concerns. A serious listing report temporarily hides the listing pending review, notifies the owner, creates a case number and provides a reason category. The owner can respond with an explanation and evidence.

An administrator records the investigation and can restore the listing, require corrections, maintain suspension or remove it. Reports, notes, evidence and decisions follow applicable dispute and investigation retention periods.

We use data to operate accounts and listings, provide messaging and controlled access, verify listers, protect users, moderate content, respond to support, process promotions and payments, improve relevant recommendations, maintain security and meet legal obligations.

Depending on the activity, potential lawful bases include performance of a contract, legitimate interests in security, fraud prevention and service operation, legal obligations, consent for optional analytics and marketing, and establishment, exercise or defence of legal claims. One basis does not automatically apply to every activity.

Information marked as required is necessary to create or secure an account, publish a listing, verify a lister, process a requested service or meet a legal obligation. Optional information can be left blank or removed where the relevant feature permits.

Listing descriptions and approximate areas are public once published. Exact coordinates, private contact details, messages, identity records, sessions and security records are restricted according to role, purpose and access approval.

Data is shared only where necessary with Hostinger as infrastructure provider; email providers for service messages; payment providers when activated; analytics providers after consent; professional advisers; law enforcement or regulators where legally required; and a legitimate future buyer, investor or successor operator during a sale, merger or transfer, subject to confidentiality and legal safeguards.

The system remains self-hosted and transferable. The main application, database and optimized property files operate on Hostinger-controlled infrastructure.

DirectHome Kenya operates from the United Kingdom and focuses on Kenya. International access or processing can occur. Appropriate contractual, technical or other safeguards are used where required. We do not claim a specific physical data-centre location in this policy.

Controls include bcrypt password hashing, hashed server-side session tokens, HTTP-only cookies, prepared database statements, access controls, rate limiting, origin checks, security headers, audit logs and restricted exact-location access. No internet service can promise absolute security.

Daily backups are retained for 30 days and monthly backups for 12 months. Deleted data can remain in encrypted backups until automatic overwrite. Backups support disaster recovery and full-system restoration, not routine restoration of individual deleted accounts or listings. Specific operational retention periods are described in the relevant sections above.

A user must re-authenticate before requesting deletion. The system checks for active disputes, fraud investigations, unpaid obligations, legal holds, active paid promotions and other justified retention requirements.

Without a blocker, the account is immediately restricted from new activity, deletion or anonymisation is scheduled after 30 days and the user is notified. With a blocker, deletion is paused, the reason is explained and the case goes to administrator review. Administrators handle exceptional cases and cannot arbitrarily refuse deletion. Profile data is deleted or anonymised after 30 days; minimal security, fraud, dispute, legal and audit records can remain for up to 12 months where justified.

Users can request a portable copy from account settings, potentially including profile data, listings, saved properties, internal messages and exact-location request history. Exports exclude unnecessary data belonging to others. Re-authentication or a recent secure session is required. Delivery can use JSON or ZIP.

Versioned records of Privacy Policy acceptance, Terms acceptance, marketing consent and withdrawal can include document type, version, time, action and relevant security metadata. Users and authorised administrators can review consent history.

Marketing consent is optional, separate from registration, off by default and withdrawable. Launch channels are in-platform notifications and opted-in email—not SMS or WhatsApp marketing. Password resets, listing status, access requests, security notices, payment confirmations and moderation notices are service messages, not marketing.

Subject to applicable law and identity verification, rights can include access, correction, deletion, restriction, objection, portability, withdrawal of consent and complaint. Contact privacy@directhomekenya.com. A request does not always require immediate deletion where lawful retention applies.

The service is not intended for children. Users must be at least 18 to create property transaction accounts or publish listings.

Where an incident involving personal data or account security is likely to create a real risk, affected users are notified by email and in-platform notification. The notice explains what happened, affected data or systems, likely consequences, measures taken and practical protective steps.

Privacy concerns should first be sent to privacy@directhomekenya.com so they can be investigated and tracked. Users may also have the right to complain to an applicable data-protection authority, subject to the law governing their circumstances.

We update this policy when services, practices or legal requirements change. Material changes are communicated appropriately and the effective and last-updated dates are revised.