Privacy policy

Effective date: 28 August 2026

1. Who we are

Kamkejani operates a Kenyan digital marketplace that helps guests discover stays, compare listing information, receive AI-assisted recommendations and contact hosts. For the personal data described in this policy, Kamkejani is the data controller unless we state otherwise.

You can contact us at support@kamkejani.co.ke, +254 716 004 252, or 4th Floor, Philadelphia House, Wing B, Office Suite 2, Nairobi, Kenya.

2. What this policy covers

This policy applies to Kamkejani websites, dashboards, AI search, account registration, listing and verification workflows, contact-unlock services, payments made to Kamkejani, support channels and related communications. A host is independently responsible for personal data that the host collects directly from a guest outside Kamkejani, including information used to arrange or manage an accommodation stay.

3. Personal data we collect

Depending on how you use Kamkejani, we may collect:

• Account and identity data, including your name, email address, phone number, role, password hash, verification status and account preferences.
• Host and listing data, including business or property names, listing descriptions, amenities, prices, availability, photographs, approximate public location and exact private location details.
• Verification data, including identity or business documents, contact-verification records, selfies or other evidence submitted to establish trust and listing ownership.
• Guest activity data, including searches, AI prompts, saved stays, contact-unlock attempts, unlocked hosts, directions, calls, WhatsApp actions, feedback, concerns and booking outcomes voluntarily reported to us.
• Payment and commercial data, including amounts, currency, payment-provider references, transaction status, subscriptions, promotions, credits and refunds. Full payment-card or mobile-money credentials are normally handled by the payment provider rather than stored by Kamkejani.
• Device, security and usage data, including IP address, browser and device information, session identifiers, referral source, campaign parameters, pages viewed, timestamps, approximate location and security events.
• Communications and support data, including emails, WhatsApp messages, support requests, reviews and other information you send to us.
• Cookie and preference data, including language, accessibility, currency and consent choices.

Please do not submit information that is unnecessary for the service or that you are not authorised to provide.

4. How we collect data

We collect data directly from you when you register, search, list a stay, upload information, unlock a contact, pay for a service, contact support or respond to feedback. We also receive data automatically from your device, from hosts and guests participating in the same marketplace interaction, and from service providers such as payment, communications, hosting, fraud-prevention and analytics providers. We may use information that you deliberately made public or that is lawfully available from public records when verifying a listing or preventing abuse.

5. Why we use data and our lawful bases

We process personal data only where we have a lawful reason under the Kenya Data Protection Act, 2019 and applicable regulations. The reason depends on the activity:

• Contract or steps requested before a contract: to create and secure your account, display and manage listings, provide AI search, process a contact unlock, deliver a subscription or promotion, and provide support.
• Legal obligation: to maintain required financial records, respond to lawful requests, meet tax and consumer-protection duties, and comply with data-protection or other applicable laws.
• Legitimate interests: to operate and improve the marketplace, prevent fraud, keep users and listings safe, measure service performance, enforce our terms, protect legal claims and understand demand, where those interests are not overridden by your rights.
• Consent: for optional analytics or marketing technologies, direct marketing where consent is required, and other processing for which we specifically ask permission. You may withdraw consent at any time without affecting earlier lawful processing.
• Vital or public interests: only where processing is reasonably necessary to protect a person or comply with a lawful public-interest requirement.

We do not sell personal data.

6. AI search, matching and automated tools

Kamkejani uses automated tools and AI to interpret search prompts, match preferences to listing details, explain recommendations, assist with listing content, identify possible duplicate or unsafe activity and help prioritise operational review. AI outputs can be incomplete or inaccurate and should not be treated as a guarantee that a stay is suitable, safe, available or legally compliant.

We use safeguards, source listing data and human review for important operational decisions. You may contact us to question an automated outcome or request human review where a decision significantly affects you. Kamkejani does not intend to make a decision producing legal or similarly significant effects solely through automated processing without the safeguards required by law.

7. When we share data

We may share only the data reasonably needed with:

• Guests and hosts involved in a marketplace interaction. Public listings show host-supplied stay information; verified contact and exact-location details are revealed only through the applicable access flow.
• Payment, mobile-money, email, messaging, hosting, storage, security, customer-support, AI and technical service providers acting under appropriate instructions or contractual safeguards.
• Analytics and advertising providers when you have enabled the relevant optional category.
• Professional advisers, insurers, auditors, potential business transferees or financiers where confidentiality and lawful-processing requirements apply.
• Courts, regulators, law-enforcement agencies or other authorities where disclosure is legally required or reasonably necessary to protect rights, safety and the integrity of the service.

We do not authorise service providers to use personal data for unrelated purposes.

8. Listings, contact unlocks and location data

Hosts choose listing information that becomes public and must avoid publishing private details in public descriptions or photographs. Kamkejani may show an approximate area publicly while restricting a host phone number, exact map pin, building, estate or unit details until the guest completes the applicable contact-unlock flow.

When a guest unlocks a host, Kamkejani records the interaction and may retain actions such as WhatsApp, call, directions, reopenings and feedback to operate the service, prevent repeated charging, measure outcomes and address disputes. The guest and host should use exchanged contact information only for genuine accommodation enquiries and related safety or support needs.

9. Cookies and similar technologies

Necessary storage supports authentication, security, payments, language, accessibility and privacy preferences. Optional Analytics helps us understand usage and performance. Optional Marketing measures campaigns across services such as Google, Meta and X.

Optional categories do not load until you confirm your choices. Analytics and Marketing may be presented as selected in the preference bar, but they remain inactive until you save or accept those choices. You may reopen Privacy choices from the website footer or privacy page and withdraw a category. Withdrawal may remove optional cookies and reload the page.

10. International transfers

Some service providers may process data outside Kenya. Where personal data is transferred internationally, we use measures required by applicable law, such as adequate safeguards, contractual protections, necessity for the requested service or explicit consent where appropriate. You may contact us for more information about the safeguards relevant to your data.

11. How long we keep data

We keep personal data only for as long as reasonably necessary for the purposes described here, including providing the service, maintaining security, resolving disputes, enforcing agreements and meeting legal, tax or accounting requirements.

An account closure immediately ends active sessions and removes the account and its stays from public access. The account enters a restricted 30-day recovery state so an administrator can reverse an accidental or unauthorised closure. After that recovery window, the account is no longer eligible for ordinary rollback and a permanent privacy-erasure request can be completed, subject to information we must retain by law or for narrowly limited security, fraud-prevention or legal-claim purposes.

Payment records, consent evidence, security logs, verification records and staff audit records may have different retention periods based on legal and operational requirements. When data is no longer required, we delete, anonymise or securely isolate it.

12. Security and incident response

We use access controls, authentication safeguards, session revocation, role-based permissions, audit trails, encryption or hashing where appropriate, monitoring and restricted administrative recovery controls. No internet service is completely secure, so users must protect passwords, devices and verification codes and notify us promptly of suspected unauthorised access.

If a personal-data breach creates a real risk of harm, we will investigate, contain and document it and notify the Office of the Data Protection Commissioner and affected people where required by law.

13. Your data-protection rights

Subject to applicable law and lawful exceptions, you may ask us to:

• Tell you how your personal data is used and give you access to it.
• Correct inaccurate, incomplete, false or misleading data.
• Delete data that is inaccurate or no longer lawfully required.
• Object to or restrict particular processing.
• Provide portable data where the right applies.
• Stop direct marketing or withdraw consent for optional processing.
• Review a significant decision made solely through automated processing.

Send requests to support@kamkejani.co.ke. We may need to verify your identity and clarify the scope of a request. We will respond within the period required by applicable law and explain any lawful reason that prevents full compliance.

You may also raise a complaint with the Office of the Data Protection Commissioner of Kenya through odpc.go.ke. We encourage you to contact us first so we can try to resolve the concern quickly.

14. Children

Kamkejani accounts and contact-unlock services are intended for adults aged 18 or older. We do not knowingly create accounts for children. If you believe a child has provided personal data without valid authorisation, contact us so we can investigate and take appropriate action.

15. Changes and contact

We may update this policy when the service, law or our processing practices change. We will publish the revised effective date and provide additional notice where a material change requires it. Continued use after a change does not replace consent where the law requires fresh consent.

Questions, rights requests and privacy concerns may be sent to support@kamkejani.co.ke or delivered to 4th Floor, Philadelphia House, Wing B, Office Suite 2, Nairobi, Kenya.