privacy.

Who we are

Imara [to confirm] (the company's legal name and registered address) runs the Imara app for iPhone, Android and the web, and this website, imarahomes.app. This notice says what Imara collects about you, why, where it is kept, who can see it, how long it is kept and what you can ask. It follows Kenya's Data Protection Act, 2019. Contact: hello@imarahomes.app. Imara's registration with the Office of the Data Protection Commissioner: [to confirm].

What Imara collects

From everyone who has an account

• Your phone number, which is how you sign in (a six digit code), and your name, photo and, if you give them, your email, WhatsApp number and emergency contact.
• Your ID: its kind (national ID, passport or alien ID), its number, a photo of each side and a selfie, so Imara's team can check who you are. Only the last four digits of the number are ever shown in the app. Your date of birth.
• What you write and send in the app: messages, posts, comments, reports, repairs, notices and reviews, and the photos and files you add.
• Payment accounts you add (an M-Pesa number or a bank account) and the payments recorded in Imara.
• Your settings and the notifications Imara sends you.
• Whether you were active on a day (you signed in or did something), counted for Imara's own figures. Who was active is kept for two days at most.

Depending on how you use Imara

• Tenants: your tenancy (home, rent, lease and deposit), bills, payments and receipts, repairs, building reports, visitors you tell the gate about, notices you read, your household size, your rent reminder choices and your moving out.
• Landlords, agents and managers: your buildings and homes, their papers and photos, your tenants' tenancies, your team and what each may do, pay and payslips, service providers, your money records, receipts and statements, your KRA PIN and tax figures, and records you import from a spreadsheet.
• Caretakers and other team members: the buildings you look after, your hours and leave, who covers for you, jobs, meter readings with their photos, the daily checklist, the building log, your pay accounts and payslips, and cash or a float you hold.
• Shops and services: your business profile, verification papers, products, hours, delivery areas, team, orders and their delivery details, posts and boosts, payouts, and, if you use Books, your sales and expenses.
• House hunters: what you are looking for (budget, areas, bedrooms, must haves, when you move), homes you save, private notes, viewings, and, if you give them, where you work and how you travel, used only to work out trip times for you.

From your phone, only when you allow it

Imara asks for each of these at the moment you tap something that needs it, with the reason on the screen, and you answer in your phone's own question. You can say no and carry on. Every role's Settings has a Permissions page that lists them.

• Location, to show homes or shops near you or to pin a place. It is not tracked in the background.
• Camera and photos, to add a picture you choose (photos come through your phone's own picker).
• Microphone and speech, for voice notes and speaking instead of typing.
• Notifications, to tell you about rent, repairs and messages.
• Face ID or your fingerprint, only if you turn on "Lock with Face ID". The check happens on your phone; Imara never receives it.

Why Imara uses it

• To run the service you asked for: your tenancy, your buildings, your shop or your search [to confirm] (lawful basis: performance of a contract).
• To check who people are and keep Imara safe: ID checks, approving buildings and homes before they are shown, reports, and pausing accounts that break the rules [to confirm] (legitimate interests; legal obligation).
• To keep money records that the law asks for, such as a landlord's books for tax [to confirm] (legal obligation).
• To understand how Imara is used, as counts, not to profile you.
• Boosted posts from shops are shown by area and engagement and are always marked Sponsored. Imara does not sell your data and does not show advertising from outside Imara [to confirm].

Who can see it

Each person sees only what their part needs, and the same rules are enforced in the database itself, not only in the app. For example: a landlord sees their own tenants' tenancies, not a house hunter's private details; a house hunter's phone number is shown to a home's host only once a viewing is booked; a caretaker reads no amounts of what a tenant owes; a tenant's monthly rating reaches the landlord as totals without names.

Imara's staff see what their job needs, each step they take is written in a log that cannot be changed, and the person is told. No member of staff can read a chat kept on people's phones (it is not on Imara's servers), and a record chat is opened only from a report about it, and that is logged.

Imara uses these services to run: Supabase (the database, sign in and storage), Cloudflare (this website and the web app), and OpenStreetMap's map tiles (your browser or phone asks for map pictures of a place). When they are connected: Safaricom M-Pesa for payments, a text message provider for sign in codes, Apple and Google for notifications while the app is closed, and a map tile provider [to confirm].

Where it is kept

Imara's database is in Supabase's London region, in the United Kingdom. [to confirm] (the safeguards for keeping personal data outside Kenya, under sections 48 to 50 of the Act).

Chats between people are kept on their phones, not on Imara's servers. The server only passes a message on and removes it once it is delivered, and after 30 days at most. A backup is a file you make and keep yourself. Record chats stay on the server, because both sides rely on them: a tenant's chats with the building, the team's chat, a building's channels, chats with Imara, and chats about an order, a pickup or a viewing.

How long it is kept

• Your account, until you delete it. Deleting starts 30 days in which you can change your mind (90 for a shop's owner); then your account and everything that was only yours is deleted. What goes and what stays.
• A landlord's books: seven years after the account goes, where nobody can read them, for the tax authority; then removed.
• Money records other people rely on (receipts, tenancies, payslips, orders): kept with those people's records [to confirm] (how long, for a closed shop and a building with no owner).
• The log of what Imara's staff did: seven years.
• Who was active on a day: two days at most.
• Messages waiting to be delivered: 30 days at most.

Your rights

Under the Data Protection Act, 2019 you may: be told how your data is used (this notice); see it; ask what Imara's staff have done about your account; have it corrected; object to its use; have it deleted; and take a copy with you. In the app: edit your details in Settings, export or download your data from Privacy, ask for your record from Privacy, and delete your account from Settings. Or write to hello@imarahomes.app. Imara answers within [to confirm] days.

If you are not happy with the answer, you may complain to the Office of the Data Protection Commissioner (odpc.go.ke).

Keeping it safe

Sign in is by your phone number and a code. After ten minutes away the app locks and opens with your code or Face ID. Signing out ends the session on the server at once. Data travels encrypted, and the database's own rules decide who can read each row [to confirm] (encryption at rest, breach notification within 72 hours under section 43).

Children

Imara is for adults [to confirm] (the minimum age, and household members under 18 named by a tenant).

This website

imarahomes.app sets no cookies, runs no scripts and has no analytics. It loads the Jost font from Google Fonts, so your browser asks Google's servers for it. Cloudflare, which hosts the site, keeps standard request logs [to confirm].

Changes

When this notice changes in a way that matters, Imara tells you in the app before it takes effect. Last written: 27 October 2026 (draft).