Singlbase Technologies Limited ("Company", "we", "us", or "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal data in accordance with the Data Protection Act, 2019 (No. 24 of 2019) of the Republic of Kenya and the Data Protection (General) Regulations, 2021.

The Company is registered as a Data Controller and Data Processor with the Office of the Data Protection Commissioner (ODPC). This policy should be read alongside our Terms of Service and Cookie Policy.

Under Kenyan law, responsibility for personal data depends on the nature of the relationship:

• Singlbase Technologies Limited as Data Controller: We act as Data Controller for the personal data of our direct Users (landlords, property managers, agents, and team members) collected during account registration, onboarding, and general use of the Service.
• Singlbase Technologies Limited as Data Processor: Where Users upload or manage personal data of Tenants or other third parties through the Service, the User acts as the Data Controller and we act as a Data Processor. We process such data only on the documented instructions of the User, subject to applicable law.
• Users are responsible for obtaining a valid lawful basis and, where required, explicit consent from Tenants before uploading their personal data to the Service.

2.1 Account and Registration Data (Users)

• Full name, email address, and phone number.
• Organization name, organization registration number, KRA PIN, and VAT number (for tax-compliant invoicing).
• Account preferences, language settings, and notification preferences.
• Support and correspondence records.

2.2 Tenant and Third-Party Data (Managed by Users)

Users may upload personal data about Tenants including names, phone numbers, email addresses, national ID numbers, lease terms, rent payment history, and maintenance request details. Users act as Data Controllers for this data. We process it only as instructed. Users must ensure a lawful basis exists for all such processing.

2.3 Billing and Payment Data (Subscription)

• Subscription details: Plan tier, billing interval (monthly/annual), price, billing period dates, subscription status, and any scheduled plan changes.
• Payment method tokens: A non-sensitive Paystack authorisation code, card brand, last 4 digits, and expiry month/year. We do not store, process, or transmit full card numbers, CVV codes, or PINs. Those values are entered directly into Paystack's PCI-DSS Level 1 certified iframe and never reach our servers.
• Tax identifiers: Organization legal name, KRA PIN, and VAT number (if applicable), used to generate KRA-compliant invoices.
• Transaction history: Date, amount, currency, payment channel (card/M-Pesa/bank), Paystack reference, status (success/failed/refunded), and gateway response.
• Billing contact: An optional separate email address for invoice and renewal notifications.

2.4 Tenant Payment Data

• M-Pesa (Daraja): Tenant phone numbers used to initiate STK push requests, M-Pesa transaction references, and payment status confirmations received from Safaricom. We do not have access to, store, or transmit M-Pesa PINs.
• NCBA Bank: Account identifiers and transaction data retrieved via NCBA API OAuth tokens for payment reconciliation. We do not store NCBA login credentials.

2.5 Automated and Usage Data

• Log data: IP addresses, browser type, device type, and access timestamps, used for security monitoring, fraud detection, and platform stability.
• Session data: Authentication tokens stored in cookies for session management (see our Cookie Policy).
• Feature usage patterns: Aggregated, non-personally-identifiable data used to improve the Service.

We process personal data under the following lawful bases as defined in Section 30 of the Data Protection Act, 2019:

• To provide, maintain, and improve the Service.
• To process subscription payments, manage renewals, issue refunds, and send billing notifications via Paystack.
• To initiate tenant rent collection via M-Pesa STK push or NCBA bank transfers.
• To issue tax invoices and meet our reporting obligations to the Kenya Revenue Authority (KRA).
• To detect, investigate, and prevent fraudulent transactions or unauthorised access.
• To comply with applicable Kenyan laws, including the Data Protection Act 2019, POCAMLA, the Computer Misuse and Cybercrimes Act 2018, and CBK regulations.
• To respond to support requests and improve customer experience.
• Marketing: We send marketing communications only with your explicit prior consent. You may opt out at any time by clicking "Unsubscribe" in any marketing email or by contacting us at legal@singlbase.com. Transactional notifications (payment confirmations, renewal reminders, invoice receipts, failure alerts) are essential to the Service and cannot be opted out of while you have an active paid subscription.

We share personal data only with trusted subprocessors and as required by law. We do not sell, rent, or trade personal data to third parties for commercial purposes.

In addition, we may disclose personal data to:

• Law enforcement agencies, the ODPC, the Financial Reporting Centre (FRC), the Kenya Revenue Authority (KRA), the Central Bank of Kenya (CBK), or any other competent regulatory authority, where required by applicable Kenyan law or valid legal process.
• Successors or acquirers in the event of a merger, acquisition, or sale of assets, provided the successor commits to the same or equivalent data protection standards.
• Professional advisers (lawyers, auditors, accountants) under duties of confidentiality.

Cross-border transfers: Where personal data is transferred outside Kenya (for example, to Supabase or AWS infrastructure in the EU or US), we ensure adequate safeguards are in place as required by Section 48 of the Data Protection Act, 2019, including Standard Contractual Clauses or transfers to jurisdictions with comparable data protection standards. We maintain records of all cross-border transfers and can provide documentation to the ODPC upon request.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or disclosure. These include:

• AES-256 encryption for data at rest.
• TLS 1.3 encryption for all data in transit.
• Role-based access controls (RBAC) and row-level security (RLS) in our database.
• Multi-factor authentication options for all user accounts.
• Regular security reviews and access audits.
• PCI-DSS compliant payment processing via Paystack (card data never transits our servers).

Data Breach Notification: In the event of a personal data breach that poses a risk to the rights and freedoms of individuals, we will:

• Notify the ODPC within 72 hours of becoming aware of the breach, in accordance with Section 43 of the Data Protection Act, 2019.
• Notify affected data subjects without undue delay where the breach is likely to result in high risk to their rights.
• Maintain a record of all data breaches, including those not reported to the ODPC, for internal audit purposes.

We retain personal data only for as long as necessary for the stated purpose or as required by law. The following schedule applies:

Upon expiry of the applicable retention period, data is securely deleted, anonymised, or pseudonymised. Where anonymisation is used, the resulting data is no longer personal data and is not subject to the Data Protection Act, 2019.

As a data subject, you have the following rights under Sections 26 to 38 of the Data Protection Act, 2019. To exercise any right, contact us at legal@singlbase.com with your name, account email, and a description of your request. We will acknowledge your request within 5 organization days.

We will respond to all verified requests free of charge. Where requests are manifestly unfounded or excessive, we may charge a reasonable fee or refuse, providing written reasons.

The Service is not directed at children under 18 years of age. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us at legal@singlbase.com and we will delete it promptly.

We will not use your personal data for direct marketing without your prior explicit consent, as required by Section 37 of the Data Protection Act, 2019. Every marketing communication we send will include a clearly visible unsubscribe link. You may also opt out at any time by contacting us at legal@singlbase.com.

Transactional communications (payment receipts, subscription renewal reminders, invoice notifications, security alerts) are not marketing communications and are sent on the basis of contract performance.

To exercise your rights, report a privacy concern, or raise a data protection complaint, please contact us:

• Privacy and Legal: legal@singlbase.com
• General Support: legal@singlbase.com
• Postal Address: Singlbase Technologies Limited, Nairobi, Kenya

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC):

• Website: www.odpc.go.ke
• Breach reporting: odpc.go.ke/report-a-data-breach
• Registration portal: dataportal.odpc.go.ke

We may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or new features. When we make material changes we will update the "Last updated" date, notify registered Account Owners by email at least 14 days before the changes take effect, and display a notice within the Service. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.