Privacy Policy

This version of our privacy policy has been updated to comply with the General Data Protection Regulation ((EU) 2016/679) (GDPR).

At TenantSphere we recognise the importance of your privacy. This policy outlines the information we collect, why we collect it, how we use and disclose it, how we safeguard your information, when your information will be deleted, and your privacy rights.

TenantSphere may be required to revise this Privacy Policy in the future to comply with any applicable regulations, in order to utilise new technologies or to improve your TenantSphere experience, so please check back periodically.

Important information about who we are

What information do we collect?

1) Information you choose to give us

• Account & Contact: name, email, phone, address, profile photo, role (tenant/landlord/agent/service professional), preferences, communication settings.
• Identity & KYC (where required): government ID details, date of birth, business/mandate documents, proof of property ownership/management, verification photos/videos.
• Property & Listing: property descriptions, photos/videos, pricing, availability, amenities, lease terms, tour windows.
• Lease & Applications: tenant application details, supporting documents, lease information, signatures, timestamps.
• Payments: payer/payee details, amounts, method metadata (e.g., masked card data or mobile money identifiers), receipts, dispute metadata.
• Communications & Content: messages, images, attachments, feedback, reviews.
• Support: correspondence, troubleshooting context, screenshots/logs you choose to share.
• Device permissions (camera, photos/media, files, notifications, approximate location) are requested only to deliver related features (e.g., document upload, chat images, tours).

2) Information others give us about you

• From landlords/agents: tenant contact/identity/application/lease data, property visit/tour data.
• From tenants: landlord feedback, maintenance requests, payments, lease communications.
• From service professionals: assignment notes, scheduling, job outcomes.
• From verification sources: ownership/mandate confirmations and related docs (as provided to us by the submitter).

When we process data strictly on the instructions of a business customer, we act as a processor (see Controller/Processor roles below).

3) Information we observe/collect automatically

• Technical: IP address, device IDs, OS/browser, language, app version, crash logs, performance data.
• Usage: pages/screens viewed, features used, clicks, session timing, referral source.
• Transaction: payments to/from you, fees, status, timestamps, provider references.
• Security/Fraud: device signals, network info, behavior patterns flagged to prevent abuse.
• Cookies/SDKs: used for authentication, preferences, analytics, and fraud prevention (see Cookie Policy).

4) Special categories and children

• We do not intentionally collect special category data (e.g., health, religion). KYC documents may include a facial image or nationality solely for verification.
• The Service is for users 18+. We do not knowingly collect data from children under 18.

Why we collect and how we use information (lawful bases)

We only process personal data where lawful. Main bases: performance of a contract, legitimate interests (balanced), consent (where required), and legal obligations (including AML/CFT), with rare reliance on vital interests.

• Account creation and management: contract; legitimate interests (operate our platform).
• Listing verification and publication: legitimate interests (fraud reduction, data quality); legal obligations where applicable.
• Tours, visits, scheduling, chat: contract; legitimate interests (coordination, safety).
• Payments (visitation fees, rent, commissions): contract; legal obligations (accounting, AML/CFT); legitimate interests (prevent fraud).
• E‑signatures and documents: contract; legal obligations (records).
• Notifications and product communications: contract; legitimate interests (service updates).
• Marketing: consent where required; opt‑out any time.
• Analytics, product improvement, debugging: legitimate interests (improve security and UX).
• Fraud prevention and trust & safety: legitimate interests; legal obligations (where applicable).
• Compliance and enforcement: legal obligations; legitimate interests (protect users and our service).

Controller and Processor roles

Controller: We are the controller for the TenantSphere platform and direct relationships with users.

Processor: For certain B2B workflows (e.g., a landlord's internal use of tenant application data), we act as processor under a Data Processing Addendum (DPA) available on request or as incorporated into our Terms. The business customer is the controller and responsible for notices/consents.

Sharing your information

We share the minimum necessary for the purposes below:

• Service providers (processors): hosting, databases, storage, auth, analytics, support tooling, email/SMS/push, ID/KYC verification, document signing.
• Examples include: Supabase, Stripe, MTN MoMo, Orange Money, AWS, and identity verification providers.
• Financial institutions and payment processors for transaction settlement and compliance.
• Government or law enforcement where required by law.
• With your consent, or at your direction, for specific features (e.g., sharing applications with landlords).

Data retention and deletion

We retain personal data only for as long as necessary for the purposes described or as required by law. When retention is no longer required, we delete or anonymize data according to our policies.

You may request deletion of certain data where applicable; we will honour requests subject to legal or legitimate business requirements.

Your rights

• Access, correction, and deletion of your personal data.
• Objection or restriction of processing in certain circumstances.
• Data portability where applicable.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with a supervisory authority.

Contact