Privacy policy

1. Who we are

Domus is operated by NeoForge Labs Ltd, a company in Nairobi, Kenya (“we”, “us”). For anything about privacy or your personal data, email privacy@neoforgelabs.tech.

2. Our two roles

• Controller. We decide how data is used for our own customers and their team members (landlords, property managers and their staff), for visitors to this website, and for the consent-based rental history described in section 4.
• Processor. When a landlord or property manager uses Domus to manage their tenants, they are the controller of their tenants’ data and we process it on their instructions. Tenants should contact their landlord or property manager first; if you contact us, we will pass your request on.

3. What we collect

Account holders and their staff: name, email, phone number, password (stored only as a one-way hash), organisation details, M-Pesa Paybill or Till number, and KRA details (KRA PIN, stored encrypted, eTIMS device serial and branch). We keep an audit log of important actions, including the IP address they came from.

Tenants, on behalf of their landlord: name, phone number, email, national ID or other document details, lease terms, rent invoices and payments (including M-Pesa and card payment references), SMS messages sent to you, maintenance requests, and, when you sign a lease online, your signature, the time, your IP address and browser. If your landlord asks you to verify your identity, we collect the document details and images you submit for that check.

Website visitors: what you enter in the demo request form (name, work email, phone, company, portfolio size, role and message). We use Google Analytics and Vercel Analytics to understand how the site is used; Google Analytics sets cookies.

4. Why we use it, and our legal basis

• To provide the service (contract): accounts, rent invoicing and collection, receipts, reminders, leases, reports and support.
• To meet legal obligations: submitting eTIMS receipts and preparing rental income tax returns to the Kenya Revenue Authority when you ask us to, and keeping tax records.
• Rental history, with consent: a tenant can choose to share their verified rental history with a new landlord. We only share it after the tenant consents, and the tenant can withdraw consent at any time. To link a tenant’s history across landlords we use their phone number and a one-way hash of their ID number, not the number itself.
• Legitimate interests: keeping Domus secure, preventing fraud, and improving the product.
• Consent: analytics cookies, and replying to a demo request.

We do not sell personal data.

5. Who we share it with

We use these service providers, each only for the purpose listed:

We may also disclose data when the law requires it, for example to the Kenya Revenue Authority.

6. Transfers outside Kenya

Some of these providers store or process data outside Kenya (see the table). Where we transfer personal data abroad we do so under the safeguards the Data Protection Act requires, including contractual protections with each provider.

7. How long we keep it

We keep personal data only as long as we need it for the purposes above. Payment, receipt and tax records are kept for at least five years, as Kenyan tax law requires. When an account closes, we delete or anonymise the rest unless the law requires us to keep it.

8. How we protect it

Data is encrypted in transit. KRA PINs are encrypted at rest and passwords are stored as one-way hashes. Access is limited by role, every organisation’s data is kept separate, and important actions are logged. No system is perfectly secure; if a breach affects your data we will notify you and the Data Protection Commissioner as the law requires.

9. Your rights

Under the Data Protection Act, 2019 you have the right to:

• be told how your data is used;
• access the personal data we hold about you;
• object to processing, and withdraw consent at any time;
• have inaccurate data corrected, and have data deleted;
• receive your data in a portable format.

To exercise any of these, email privacy@neoforgelabs.tech. If you’re a tenant, your landlord or property manager controls your data; we will help them respond.

10. Complaints

If you’re unhappy with how we’ve handled your data, tell us first at privacy@neoforgelabs.tech. You can also complain to the Office of the Data Protection Commissioner (odpc.go.ke).

11. Children

Domus is not intended for anyone under 18, and we don’t knowingly collect their data.

12. Changes

We’ll update this page when our practices change and change the date at the top. For significant changes we’ll notify account holders directly.