Privacy policy

Last updated: 30 September 2026

What we collect

Account details: name, email, phone and password (stored scrambled, never readable).
What you publish: photos, videos, descriptions, prices and locations.
Enquiries and messages sent through NyumbaUG.
Device and usage data: IP address, browser and the page you came from.
Identity-verification documents (only if you verify your identity): your National ID number or passport number, photos of your ID, a selfie holding it, a short selfie video if you record one, your date of birth (optional) and, for agencies, your business registration certificate and TIN.

To run the site: show listings, deliver enquiries and messages, and take payments.
To check identities and reduce fraud.
To send service messages by email, SMS or notification (receipts, codes, and alerts you choose).

Optional. You only submit documents if you choose to, at /account/verify-identity.
Storage. Your documents are kept in private storage that is never public, and never appear in a listing, search result or public page.
Who can see them. Only the NyumbaUG staff who review identity checks. Every time they open a file, it's recorded.
What we publish. Only the Verified user badge. Never your ID number, date of birth, registration number or any document image.
Retention. We keep your documents only for as long as we need them for verification.
Withdrawal. Until our team starts reviewing your check, you can withdraw it from the same page, which deletes the files immediately. To remove an approved verification, contact support.
Consent. You tick a consent box before submitting, and we record when you did.
Your rights. You can ask what documents we hold about you, or ask us to delete them. If deleting them means removing an active badge, we'll tell you first.

Flutterwave: to take payments you make.
Resend (email) and Africa's Talking (SMS): to send your messages, codes and alerts.
Hostinger (our servers) and Cloudflare (web traffic, video hosting and backups): to run the site. File backups are encrypted before they leave our server.
CARTO: our map images. Your browser asks CARTO for them, so CARTO sees your IP address.
Google or Apple: only if you choose to sign in with them.
Your browser's notification service: only if you turn on notifications.
Government or police: when the law requires it.
We don't share identity documents with anyone outside NyumbaUG, and we don't sell your data.

You can edit or close your account at any time from Settings. You can turn alerts off in your notification settings.