Privacy Policy

Tenalord Limited (Kampala, Uganda) is the data controller for personal data processed through Tenalord. We handle your data in line with the Data Protection and Privacy Act, 2019 of Uganda and its regulations. For anything about your data, email marybright864@gmail.com.

Account details. Your name, email address, mobile number, account type (tenant or landlord) and password (stored only as a secure hash by our authentication provider). If you sign in with Google, we receive your name and email from Google.

Listings. For landlords: property details, price, location (including an optional map pin), photos and video.

Activity. Viewing requests and their messages and preferred dates, saved homes, reviews, reports you submit, and messages you send through our contact form.

Payments. The plan you bought, amount, status, payment method and the Pesapal reference. Your card or mobile money PIN never reaches us; Pesapal handles it.

Verification documents (landlords who apply). See section 4.

Technical data. Your IP address is used briefly to limit abuse (for example, too many sign-in attempts). Listing views are counted as daily totals per listing, not per person.

• To run your account and the marketplace (performing our contract with you).
• To share a landlord's phone number with a tenant, and a tenant's details with a landlord, only after a viewing request is accepted (performing the contract, at your request).
• To take payments and keep financial records (contract and legal obligation).
• To keep Tenalord safe: verifying landlords, screening listings for scam signals, reviewing reports, suspending accounts that break our Terms, and keeping an audit log of staff actions (legitimate interests and legal obligations).
• To send emails about your account: sign-up confirmation, password reset, viewing requests and responses, payment receipts, verification results, renewal reminders, suspension notices and replies to support messages. We don't send marketing emails.

Landlords who apply for the verified badge give us their National Identification Number (NIN), photos of the front and back of their National ID and a selfie. We use these only to confirm identity and prevent fraud.

• The files are stored in a private storage area that only you and our verification staff can access.
• Staff open them through links that expire after a few minutes. They are never shown on your public profile.
• A NIN can be verified for only one account, to stop the same identity being reused.
• We keep the documents while your account is active and for 12 months after it is closed or the request is rejected, then delete them, unless the law or an active fraud investigation requires longer.

• Listings, including photos, video, price, area and map location, are public.
• A landlord's name and verified badge appear on their listings.
• Reviews are public and show the reviewer's name.
• Phone numbers are never public. They are shared only between the two people in an accepted viewing.

We don't sell your data. We use these service providers to run Tenalord, under contracts that protect your data:

• Supabase: database, sign-in and file storage.
• Vercel: website hosting.
• Pesapal: payment processing.
• Our email provider: delivering the emails listed above.
• Google (Gemini API), only if enabled: drafting listing text from photos, understanding search phrases, and screening new listings for scam signals. Listing photos and notes, and search text sent for these features, may be processed by Google under its own terms, which can include using them to improve its products. ID documents and verification data are never sent to Google.
• Africa's Talking (only if enabled): sending sign-in codes by SMS.

Some of these providers store data outside Uganda. When that happens we rely on safeguards that give your data protection comparable to Ugandan law. We may also disclose data where the law requires it or to help police investigate fraud.

We use only the cookies needed to keep you signed in. We don't use advertising or tracking cookies, and there are no third-party analytics on the site.

• Account and listing data: while your account is active, and deleted within 90 days after you close it.
• Payment records: 7 years, for tax and accounting.
• Verification documents: as described in section 4.
• Support messages and reports: 2 years.
• Staff audit log: 5 years, to investigate abuse and disputes.
• Rate-limit counters keyed to an IP address or account: used only to block abuse, and replaced each time the limit window resets.

Under the Data Protection and Privacy Act, 2019 you can ask us to:

• Tell you what personal data we hold about you and give you a copy.
• Correct data that is wrong or incomplete.
• Delete your data, where we don't need to keep it for a legal reason.
• Stop or limit processing you object to.

Send your request from the email on your account to marybright864@gmail.com, or use the contact form with the topic “Privacy request”. We may ask you to confirm your identity, and we'll respond within 30 days. You can also complain to the Personal Data Protection Office of Uganda.

Access to data is restricted by role and enforced in our database. Passwords are hashed, connections are encrypted, and staff actions are logged. If a breach puts your data at risk, we will notify the Personal Data Protection Office and affected users without undue delay, as the law requires.

Tenalord is for people aged 18 and over. We don't knowingly collect data from children; if we learn we have, we delete it.

If we change this policy, we'll update the date above and email you about significant changes.