Kanesto Privacy Policy

Effective and last updated: 29 October 2026.

Kanesto — Building the trusted infrastructure for real estate in Nigeria.

This Privacy Policy explains how Kanesto Technologies Limited ("Kanesto", "we", "us") collects, uses, shares, and protects personal information when you use the Kanesto platform. It is written to reflect what the Platform actually collects and does today, and is intended to align with the Nigeria Data Protection Act 2023 (NDPA), the General Application and Implementation Directive 2025 (GAID) and other guidance from the Nigeria Data Protection Commission (NDPC).

1. Categories of Personal Data We Collect

We collect only what the Platform's actual features require:

Account information — full name, email address, password (stored hashed by our authentication provider), account/profile type (e.g. seeker, landlord, agent), avatar image (optional), onboarding preferences (budget range, preferred locations, currency, goals) if you choose to provide them.

Contact information — phone number (optional field on your profile, and required when you list a property, offer services or apply to be an inspector), email address.

Details you give when you add a role — when you open List a property, Offer services or Become an inspector, the details that role needs: your state and city, your company name (developers, agencies and campus agencies), and the states you can work in (inspectors). A campus agent also gives their school, level, department, matric number (optional) and the part of the campus area they work in; a campus agency gives its school and campus area. These are kept with your account, shown to Kanesto staff, and used to run the role, to verify you, and to understand which schools and places we serve. We save them as you type so you do not lose them.

Where you heard of Kanesto and referral codes — at sign-up you can tell us how you heard about Kanesto and enter a referral code. We keep your answer, and the code (and the partner it belongs to) if it is valid, so we can see which channels work and can count sign-ups for a partner. A partner is told how many people signed up with their code, not who they are.

Location (optional, only if you turn it on) — if you choose Share my location on your Profile, we keep your last shared position (latitude and longitude, and the accuracy your device reports) with the time. It is kept for safety and for dealing with serious problems. It is not used for advertising. Only Kanesto staff with the right permission can look at it, and only after writing down a reason; every look is logged. You can stop sharing at any time, and stopping deletes what we kept. If you never turn it on, we do not collect it. (Separately, a service request can use your location once, to match the nearest provider first.)

Identity/verification information — if you choose to use our optional verification feature, the documents you upload (e.g. a government-issued ID, NIN slip, BVN confirmation slip, utility bill, or CAC business certificate) and the verification outcome. We store the document you upload. When you send an ID you also type its number. We do not keep that number: we keep only a one-way coded version of it (a hash) so we can tell if the same ID is used on two accounts, and it cannot be turned back into your number. The reviewer also types the name as it appears on your ID, and we keep that name and whether it matched your profile name, with who reviewed it and when. Verification is needed to publish a listing and to receive rent through Kanesto, and is otherwise optional — see our Platform Policy, Part B. What is shown publicly: on a listing, a "Listed by" box shows the lister's name, whether Kanesto reviewed their identity, how long they have been on Kanesto and how many listings they have live. If you are an agent and choose to, it also shows the regulator and registration number you entered once Kanesto has approved your registration. That choice is a box you tick when you submit it and can switch off at any time on the Verification page. Your phone number, email address and the documents themselves are never shown in that box.

Property information — details you enter about a property you list (address, price, description, photographs, room/occupancy configuration) or a property you enquire about.

Payment-related information — transaction records (amount, currency, date, purpose, status, a payment reference), and, for withdrawals, the Nigerian bank account details you provide (bank name, account number, verified account name) so we can pay you. We do not collect or store your card number, CVV, or full card details — these are entered directly into Flutterwave's own secure payment interface and never pass through Kanesto's servers.

Bank-transfer slips and payout checks — if you pay a large rent by bank transfer, the transfer slip you upload (kept privately, visible only to you and authorised Kanesto staff). To approve a payout account for rent, Kanesto compares the name on your identity document with the name on your bank account and keeps the result with the approval.

Phone alerts — if you allow alerts on a device, your browser gives us a device address and keys so we can send you notifications (for example a message, an application or a payment). We store them with your account until you turn alerts off in your browser, the device stops responding, or you close your account. We do not read them for any other purpose.

Device/technical information — IP address, browser/device type, and similar technical data generated automatically when you use the Platform, for security and diagnostic purposes.

Usage information — pages viewed, searches performed, listings saved, and similar in-product activity, used to operate and improve the Platform.

Communications/support information — messages you send other users through the Platform, and correspondence with our support team.

Payment confirmation and report records — when you confirm payment details before paying a landlord directly, or report a payment problem, a listing or a person, we keep what you confirmed or wrote, when, and any evidence you attach. These records are kept so disputes can be reviewed fairly and cannot be edited afterwards.

2. Purposes of Processing and Lawful Bases

| Purpose | Example | Lawful basis under NDPA | |---|---|---| | Creating and operating your account | sign-up, login, profile display | Performance of a contract with you | | Setting up a role you ask for | List a property, Offer services, Become an inspector, campus agent details | Performance of a contract with you | | Understanding where sign-ups come from and counting partner sign-ups | how you heard of Kanesto, referral codes | Legitimate interest | | Safety, using your shared location | looking up your last shared position, with a reason and a log | Consent (you turn it on and can turn it off) | | Facilitating a listing, application, tenancy, booking, or payment | showing your listing to seekers, processing a payment | Performance of a contract with you | | Verifying identity/property/business where you request it | reviewing an uploaded document | Consent (you choose to submit it) | | Processing payments and payouts | Payment-provider (Flutterwave, ALATPay) transaction verification, bank payout | Performance of a contract; legal obligation (record-keeping) | | Security, fraud prevention, and platform integrity | detecting suspicious activity | Legitimate interest, legal obligation | | Sending service communications | payment receipts, status updates | Performance of a contract; legal obligation | | Sending marketing communications | product updates, offers | Consent (opt-in/opt-out as described below) | | Complying with law | responding to a lawful request from a regulator or court | Legal obligation |

3. Third-Party Processors

We share personal data with the following categories of third party, only as needed to provide the Platform:

ALATPay (Wema Bank) — a payment processor for incoming customer payments (card, bank transfer, Wema account). ALATPay receives what is needed to process your payment (amount, your contact details for the transaction, and your payment-instrument details directly). It is the payment gateway of Wema Bank, a licensed Nigerian bank, with its own privacy obligations.
Flutterwave — our payment processor for incoming customer payments (card, bank transfer, USSD). Flutterwave receives what is needed to process your payment (amount, your contact details for the transaction, and your payment-instrument details directly). Flutterwave is a separately regulated Nigerian payment service provider with its own privacy obligations.
Browser push services — if you allow phone alerts, your notification text and a device address are sent through your browser's own push service (for example Google or Apple's) so it reaches your device.
Kuda Business — used for processing approved withdrawal payouts to users' bank accounts (recipient bank name, account number, verified account name, and payout amount, only for approved withdrawals).
Hosting/database provider — Supabase (Postgres database, authentication, file storage), which stores the data described in Section 1 on our behalf, under its own security and processing terms.
Vercel - application hosting. It processes requests and technical data (such as IP address) needed to serve the website.
OpenStreetMap - map display and address lookup. Addresses or locations you enter when listing or searching may be sent to it to place a pin on the map.
Google Fonts - the website loads its typefaces from Google's font service, so your browser's IP address and browser type are sent to Google when a page loads.
Unsplash - the homepage loads some of its background pictures from Unsplash's image servers, so your browser's IP address and browser type are sent to Unsplash when the page loads.
Error monitoring - if a page crashes, a short technical report (the error message, the page address without any search terms, and your browser name, but no name, email or form content) may be sent to our error-monitoring provider so we can fix it.
Resend - email delivery provider, used to send account and notification emails. Kanesto does not currently send SMS.

We do not sell personal data to third parties.

Apart from the providers in Section 3, we share personal data only:

With the other user in your transaction, what they need to deal with you, such as your name and, once you have booked a visit or been accepted, your phone number. A user may not use it for anything unrelated to the transaction (Terms of Use, Section 23A);
With regulators, courts, the police and other authorities that have the power to ask for it, or where the law requires us to report something, including to help prevent or investigate fraud, money laundering or other crime;
With professional advisers such as lawyers, accountants and auditors, who must keep it confidential;
With a person who takes over our business or part of it, or who is considering doing so, who must then use it only as this Policy allows; and
With your consent, or where you ask us to.

Where we share personal data with a person outside Nigeria, Section 11 applies. We require every provider and adviser we share data with to protect it and to use it only for the job we give them.

4. Data Security

We apply access controls (row-level security on our database, role-based staff permissions) so that personal data is only reachable by the account it belongs to, or by staff with a legitimate operational reason, and take reasonable technical and organisational measures to protect data against unauthorised access, loss, or misuse. You are responsible for keeping your password and sign-in codes secret; tell us at once if you think someone else has used your account. No system is completely secure; see Section 12 for what happens if something goes wrong.

Automated decisions. Routine withdrawal requests that meet our limits can be approved automatically by the system (see our Platform Policy, Part D). Automatic approval is never used to refuse you: a request the system does not approve is passed to a member of our team. You can ask for a person to review any decision about your account or payouts by writing to legal@kanesto.africa.

5. Retention

We keep personal data only as long as we need it for the purpose it was collected for:

| Data | How long we keep it | |---|---| | Account and profile details | While your account is open, then deleted or anonymised after closure, unless we must keep some of it as set out below | | Identity and verification documents you upload (ID, passport photo, proof of address) | The picture is deleted 90 days after we approve it. We keep that you were verified, what was approved and when, the name that was on the ID, and the coded version (hash) of the ID number used to spot duplicates. Kept longer only if needed for a fraud investigation, a dispute or a legal duty. Each time our staff open one, who and when is logged | | Payment, payout, tenancy and ledger records | For as long as Nigerian tax, anti-money-laundering and company-record rules require (generally at least five years), even if you close your account | | Messages and support correspondence | While your account is open and while a dispute or complaint about them is open | | Technical and security logs | For a short period needed for security and debugging |

If a longer period is needed to deal with a legal claim or a request from a regulator or court, we keep the data for that purpose only.

6. Your Rights

Under the NDPA, you have rights including the right to:

know what personal data we hold about you and why;
request a copy of your personal data;
request correction of inaccurate data;
request deletion of your data, subject to our legal retention obligations (see Section 5);
withdraw consent where processing is based on consent (e.g. marketing, optional verification documents);
object to certain processing, including processing for direct marketing;
ask for your data in a commonly used, machine-readable format where the law gives you that right (data portability);
not be subject to a decision based solely on automated processing that significantly affects you, and ask for a person to review one (see Section 4);
lodge a complaint with the Nigeria Data Protection Commission.

To exercise any of these rights, contact us at legal@kanesto.africa. We will respond without undue delay and, in any case, within one month. We may ask you to confirm who you are first, to protect your data from someone pretending to be you.

6A. What You Confirm When You Give Us Data

When you create an account or add a role, you confirm that you are giving us your Personal Data freely, that you are old enough and able to do so, and that you have been told what we collect, why, who we share it with and what your rights are (this Policy). Where we ask for your consent for something specific, such as sharing your location, uploading ID, or marketing, you can say no to it, or withdraw it later, without losing the rest of the Platform, except where that part of the Platform cannot work without it.

If you give us information about another person (for example a co-tenant, a landlord's contact, or a person you ask us to pay), you confirm that you are allowed to give it to us and that you will tell them we hold it.

7. Account and Data Deletion

You may request account deletion at any time through a support request from the Support page or by emailing legal@kanesto.africa. We will delete or anonymise personal data we are not otherwise required to retain (see Section 5) — for example, completed transaction records may need to be retained for tax and audit purposes even after account deletion.

8. Cookies and Analytics

Kanesto uses only strictly necessary browser storage: your sign-in session, your light/dark theme preference, and a draft of a listing while you are creating one. Kanesto does not use advertising cookies or third-party analytics. Kanesto does count visits to its own pages (which page, which website or campaign link brought you, and your type of device and browser) using a random identifier kept in your browser, with no cookie and without storing your IP address. When you are signed in, the count is linked to your account so we can understand how people go from visiting to using Kanesto. Your browser's Do Not Track or Global Privacy Control setting switches this off. Visit records are deleted after about 13 months. The Flutterwave checkout, which is operated by Flutterwave, may set its own cookies under its own policy.

8A. Safety Checks and Monitoring

To keep the Platform safe and to prevent and detect crime, Kanesto uses automated checks on listings, messages, uploads and activity, for example to spot phone numbers or links placed to take people off the Platform, repeated failed sign-ins, and patterns that look like fraud or card testing. Our staff may review a message, listing or account activity where a report has been made, where the automated checks have flagged it, or where the law requires, and only to the extent needed for that purpose. Each time our staff open a sensitive record such as an ID document or a shared location, the access is logged.

9. Marketing Communications

Where we send you marketing communications, we do so only with your consent (e.g. an opt-in at sign-up or in notification preferences) or another lawful basis permitted by the NDPA, and you may opt out at any time through your notification preferences or by using the unsubscribe mechanism in the message itself.

9A. How We Contact You

We contact you by email and by notices inside the Platform, and by phone alerts if you turn them on. Service messages such as receipts, security alerts, changes to your payments, refunds, bookings and these policies are part of running your account and you cannot opt out of them while your account is open. Marketing messages are separate and you can opt out of them at any time (Section 9). If you give us a phone number, we may use it to reach you about a booking, a visit or an urgent problem with your account.

10. Children and Minors

The Platform is intended for users aged 18 and above who can lawfully transact. We do not knowingly collect personal data from children. If we become aware that a minor has provided personal data, we will delete it.

11. International Data Transfers

Some of the providers in Section 3 (including our database and application hosting providers) may store or process personal data on servers outside Nigeria. Where personal data is transferred outside Nigeria, Kanesto relies on the safeguards the NDPA allows: the recipient being bound by contractual data-protection terms that give an adequate level of protection, the transfer being necessary to perform the contract you have with us (for example to process your payment or show your listing), or your consent where that applies. We limit what is sent to what is needed to provide the Platform.

12. Breach and Security Incident Handling

If we become aware of a personal-data breach that poses a risk to your rights, we will assess it and, where it is likely to put your rights and freedoms at risk, notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and tell affected users without undue delay where the risk to them is high.

13. Privacy Contact

Questions or requests about this Policy: legal@kanesto.africa.

14. Policy Updates

We may update this Privacy Policy as the Platform evolves. Material changes will be notified through the Platform or by email at least 10 days before they take effect, unless the law or the security of the Platform requires sooner, in which case we will tell you as soon as we can. The version in force and the date it was last updated are shown at the top of this page. Using the Platform after a change takes effect means you accept the updated Policy; if you do not accept it, you can close your account (Section 7).

15. Registration and Data Protection Officer

Kanesto Technologies Limited is the controller of the personal data described in this Policy. Kanesto will register with the Nigeria Data Protection Commission as a data controller of major importance and designate a Data Protection Officer, as the NDPA and the Commission's guidance require, and will keep its filings up to date. Questions about how Kanesto handles personal data, and requests to use your rights, can be sent to legal@kanesto.africa. You may complain to the Nigeria Data Protection Commission at any time.