Privacy policy

Effective date: 30 September 2026

1. Who we are

Kamkejani operates a Kenyan digital marketplace that helps guests discover getaways, compare listing information, receive AI-assisted recommendations and contact hosts. For the personal data described in this policy, Kamkejani is the data controller unless we state otherwise.

You can contact us at support@kamkejani.com, +254 716 004 252, or 4th Floor, Philadelphia House, Wing B, Office Suite 2, Nairobi, Kenya.

2. What this policy covers

This policy applies to Kamkejani websites, dashboards, AI search, account registration, listing and verification workflows, contact-unlock services, payments made to Kamkejani, support channels and related communications. A host is independently responsible for personal data that the host collects directly from a guest outside Kamkejani, including information used to arrange or manage an accommodation getaway.

3. Personal data we collect

Depending on how you use Kamkejani, we may collect:

• Account and identity data, including your name, email address, phone number, country, role, password hash, verification status, policy-acceptance version and account preferences.
• Host and listing data, including business or property names, listing descriptions, amenities, prices, availability, photographs, approximate public location and exact private location details.
• Verification data, including identity or business documents, contact-verification records, selfies or other evidence submitted to establish trust and listing ownership.
• Guest activity data, including searches, AI prompts, saved getaways, contact-unlock attempts, unlocked hosts, directions, calls, WhatsApp actions, feedback, concerns and booking outcomes voluntarily reported to us.
• Payment and commercial data, including amounts, currency, payment-provider references, transaction status, subscriptions, promotions, credits and refunds. Full payment-card or mobile-money credentials are normally handled by the payment provider rather than stored by Kamkejani.
• Device, security and usage data, including IP address, browser and device information, session identifiers, referral source, campaign parameters, pages viewed, timestamps, approximate location and security events.
• Communications and support data, including emails, WhatsApp messages, support requests, reviews and other information you send to us.
• Cookie and preference data, including language, accessibility, currency and consent choices.
• Calendar-sync data, including encrypted imported iCal URLs, provider labels, sync status and errors, imported blocked periods and protected Kamkejani export tokens.
• Guest Safety Check data submitted by hosts, including an encrypted guest phone number, a protected exact-match fingerprint, factual feedback, the reporting account and submission time.

Please do not submit information that is unnecessary for the service or that you are not authorised to provide.

4. How we collect data

We collect data directly from you when you register, search, list a getaway, upload information, unlock a contact, pay for a service, contact support or respond to feedback. We also receive data automatically from your device, from hosts and guests participating in the same marketplace interaction, and from service providers such as payment, communications, hosting, fraud-prevention and analytics providers. We may use information that you deliberately made public or that is lawfully available from public records when verifying a listing or preventing abuse.

5. Why we use data and our lawful bases

We process personal data only where we have a lawful reason under the Kenya Data Protection Act, 2019 and applicable regulations. The reason depends on the activity:

• Contract or steps requested before a contract: to create and secure your account, display and manage listings, provide AI search, process a contact unlock, deliver a subscription or promotion, and provide support.
• Legal obligation: to maintain required financial records, respond to lawful requests, meet tax and consumer-protection duties, and comply with data-protection or other applicable laws.
• Legitimate interests: to operate and improve the marketplace, prevent fraud, keep users and listings safe, measure service performance, enforce our terms, protect legal claims and understand demand, where those interests are not overridden by your rights.
• Consent: for optional analytics or marketing technologies, direct marketing where consent is required, and other processing for which we specifically ask permission. You may withdraw consent at any time without affecting earlier lawful processing.
• Vital or public interests: only where processing is reasonably necessary to protect a person or comply with a lawful public-interest requirement.

We do not sell personal data.

6. AI search, matching and automated tools

Kamkejani uses automated tools and AI to interpret search prompts, match preferences to listing details, explain recommendations, assist with listing content, identify possible duplicate or unsafe activity and help prioritise operational review. AI outputs can be incomplete or inaccurate and should not be treated as a guarantee that a getaway is suitable, safe, available or legally compliant.

We use safeguards, source listing data and human review for important operational decisions. You may contact us to question an automated outcome or request human review where a decision significantly affects you. Kamkejani does not intend to make a decision producing legal or similarly significant effects solely through automated processing without the safeguards required by law.

7. When we share data

We may share only the data reasonably needed with:

• Guests and hosts involved in a marketplace interaction. Public listings show host-supplied getaway information; verified contact and exact-location details are revealed only through the applicable access flow.
• Payment, mobile-money, email, messaging, hosting, storage, security, customer-support, AI and technical service providers acting under appropriate instructions or contractual safeguards.
• Analytics and advertising providers when you have enabled the relevant optional category. For enhanced-conversion measurement, we may send normalised, one-way hashed contact identifiers and campaign/event data to the enabled provider so a registration or other conversion can be attributed without sending the plain identifier in that event.
• Professional advisers, insurers, auditors, potential business transferees or financiers where confidentiality and lawful-processing requirements apply.
• Courts, regulators, law-enforcement agencies or other authorities where disclosure is legally required or reasonably necessary to protect rights, safety and the integrity of the service.

We do not authorise service providers to use personal data for unrelated purposes.

8. Listings, contact unlocks and location data

Hosts choose listing information that becomes public and must avoid publishing private details in public descriptions or photographs. Kamkejani may show an approximate area publicly while restricting a host phone number, exact map pin, building, estate or unit details until the guest completes the applicable contact-unlock flow.

When a guest unlocks a host, Kamkejani records the interaction and may retain actions such as WhatsApp, call, directions, reopenings and feedback to operate the service, prevent repeated charging, measure outcomes and address disputes. The guest and host should use exchanged contact information only for genuine accommodation enquiries and related safety or support needs.

Hosts may connect an Airbnb, Booking.com or other standards-compatible iCal feed to a listing or room type. Kamkejani encrypts imported calendar URLs, imports only the booking periods needed to calculate inventory and provides protected export URLs that hosts can paste into other calendar platforms. Calendar feeds may be delayed, incomplete or unavailable, so hosts remain responsible for checking dates and avoiding double bookings. Disconnecting a feed stops future imports; deleting the listing or completing account erasure removes its calendar credentials and imported calendar data.

9. Cookies and similar technologies

Necessary storage supports authentication, security, payments, language, accessibility and privacy preferences. Optional Analytics helps us understand usage and performance. Optional Marketing measures campaigns across services such as Google, Meta, X and TikTok. Where supported, enhanced conversions use normalised and one-way hashed email addresses or phone numbers to improve conversion matching. Kamkejani does not enable this optional sharing until the relevant Marketing choice has been saved.

Optional categories do not load until you confirm your choices. Analytics and Marketing may be presented as selected in the preference bar, but they remain inactive until you save or accept those choices. You may reopen Privacy choices from the website footer or privacy page and withdraw a category. Withdrawal may remove optional cookies and reload the page.

10. International transfers

Some service providers may process data outside Kenya. Where personal data is transferred internationally, we use measures required by applicable law, such as adequate safeguards, contractual protections, necessity for the requested service or explicit consent where appropriate. You may contact us for more information about the safeguards relevant to your data.

11. How long we keep data

We keep personal data only for as long as reasonably necessary for the purposes described here, including providing the service, maintaining security, resolving disputes, enforcing agreements and meeting legal, tax or accounting requirements.

An account closure immediately ends active sessions and removes the account and its getaways from public access. The account enters a restricted 30-day recovery state so an administrator can reverse an accidental or unauthorised closure. After 30 days, an automated erasure process deletes private conversations, saved getaways, submitted reviews, calendar credentials, verification images and listing photographs where technically available; scrubs listing, contact-note, analytics-session, payment-attribution and profile fields; and replaces the account’s direct identifiers with irreversible deleted-account values. Narrow records required for financial, safety, security, consent, audit or legal claims are retained only in minimised or anonymised form and under their applicable retention rules.

Guest Safety Check reports are retained while reasonably needed to protect hosts, investigate disputes and prevent abuse. They are not public, are searchable only by signed-in hosts using the complete international phone number, do not reveal the reporting host and do not automatically block a guest. A person may ask us to review, correct or remove a report connected to their number.

Payment records, consent evidence, security logs, verification records and staff audit records may have different retention periods based on legal and operational requirements. When data is no longer required, we delete, anonymise or securely isolate it.

12. Security and incident response

We use access controls, authentication safeguards, session revocation, role-based permissions, audit trails, encryption or hashing where appropriate, monitoring and restricted administrative recovery controls. No internet service is completely secure, so users must protect passwords, devices and verification codes and notify us promptly of suspected unauthorised access.

If a personal-data breach creates a real risk of harm, we will investigate, contain and document it and notify the Office of the Data Protection Commissioner and affected people where required by law.

13. Your data-protection rights

Subject to applicable law and lawful exceptions, you may ask us to:

• Tell you how your personal data is used and give you access to it.
• Correct inaccurate, incomplete, false or misleading data.
• Delete data that is inaccurate or no longer lawfully required.
• Object to or restrict particular processing.
• Provide portable data where the right applies.
• Stop direct marketing or withdraw consent for optional processing.
• Review a significant decision made solely through automated processing.

Send requests to support@kamkejani.com. We may need to verify your identity and clarify the scope of a request. We will respond within the period required by applicable law and explain any lawful reason that prevents full compliance.

You may also raise a complaint with the Office of the Data Protection Commissioner of Kenya through odpc.go.ke. We encourage you to contact us first so we can try to resolve the concern quickly.

14. Children

Kamkejani accounts and contact-unlock services are intended for adults aged 18 or older. We do not knowingly create accounts for children. If you believe a child has provided personal data without valid authorisation, contact us so we can investigate and take appropriate action.

15. Changes and contact

We may update this policy when the service, law or our processing practices change. We will publish the revised effective date and provide additional notice where a material change requires it. Continued use after a change does not replace consent where the law requires fresh consent.

Questions, rights requests and privacy concerns may be sent to support@kamkejani.com or delivered to 4th Floor, Philadelphia House, Wing B, Office Suite 2, Nairobi, Kenya.

Managed booking privacy update — reviewed 16 October 2026

When you choose Book with Kamkejani, we also process the guest and host account identifiers, getaway and room selection, quantity, check-in and checkout times, quoted nightly or hourly prices, the accepted fee and policy snapshots and acceptance time. Payment references, confirmed amounts, settlement-ledger entries, refund and withdrawal requests, provider outcomes, cancellation reasons, disputes, staff decisions and notification-delivery records are linked to the booking. We do not need your mobile-money PIN, banking password or full card credentials.

For platform payments, we retain the receipt details you provide, such as your name, email and phone number, together with the accepted tax breakdown, coupon redemptions, booking-credit grants, expiry and use, and renewal consent and status where applicable. Relevant receipt and verified contact details may be shared with the payment provider to identify the correct payer and reconcile receipts. Where withdrawals are offered, we process the verified destination and provider references needed for that transfer. Recurring card payments use the provider's authorisation reference, stored securely, rather than a full card number or security code.

We use this information to take the steps you request before booking, administer the booking contract, reserve and release inventory, reconcile payments, calculate agreed charges, arrange refunds and host settlement, handle disputes, provide service notices and maintain financial and security records. Processing rests on contract or requested pre-contract steps, applicable legal obligations, and proportionate fraud-prevention and legal-claims interests. Optional marketing still requires the applicable separate choice; booking does not authorise unrelated advertising.

The booking guest, host and authorised support staff can see the information needed for their role. The host receives the guest information needed to fulfil that booking, not the guest's unrelated wallet, other getaways or complete payment details. Enabled payment, messaging, hosting and support providers receive only relevant data under appropriate safeguards. We do not publish booking histories, wallet balances, private disputes or withdrawal details on public getaway cards or calendar feeds. Booking does not grant general permission to bypass the separate contact-unlock service or redistribute contact data.

Booking and financial records remain restricted while a getaway, refund, payout, dispute or recovery is unresolved and for any additional period required by applicable legal, tax, accounting or claims obligations. Closing an account does not erase outstanding entitlements or liabilities. We minimise identifiers and erase or anonymise unnecessary data when lawful retention ends; data rights and complaint routes in this policy continue to apply. Simulated staging/test booking records are labelled test data and do not represent real payments or redeemable balances. A separately authorised real-payment pilot must identify its real transaction records distinctly from simulations.

Related service rules: https://www.kamkejani.com/booking-policies. Contact support@kamkejani.com for booking-data access, correction, privacy concerns or a disputed record.

Managed-booking payment-review privacy update — reviewed 16 October 2026

Payment-dispute review may also use provider reversal or chargeback references, evidence supplied by the parties, booking and refund reconciliation, the reason and amount of an affected payout hold, and documented recovery decisions. We process only the information reasonably needed to administer the transaction, comply with applicable obligations, investigate fraud and establish or defend lawful claims. Relevant evidence may be shared with the responsible payment provider and authorised reviewers; neither party receives the other's unrelated account or financial records. Access is restricted and decisions remain auditable, with retention governed by the unresolved issue and applicable lawful retention requirements, not an indefinite general right to keep all evidence.

For account operations, we may retain a coarse last-active timestamp based on verified sign-in or a visible, recently interacted authenticated page. It helps administrators distinguish recent, dormant and unknown activity when managing accounts; it is not a record of every tap or a guarantee that someone is currently online. Hidden or idle polling and administrator impersonation must not be treated as the account holder's activity. Where prior evidence is unavailable, the record is described as unknown rather than asserting that the person never used the service. This operational use does not authorise unrelated advertising.

Simulated transactions remain identified as test data. A separately enabled, explicitly authorised administrator-only staging payment mode creates real payment and refund records for the amount shown at checkout, not a real accommodation reservation. Such records must be distinguished from simulations and handled under the same relevant security, reconciliation and privacy safeguards. The earlier statement that staging transactions involve no real money applies to the simulator, not to an expressly labelled real-money pilot. Your data rights and support complaint routes remain unchanged.