Privacy Policy

Our customers are the data controllers. Each landlord, agency or property manager that subscribes to Rent Master Pro (the “customer”) decides what information about its tenants, landlords, suppliers and staff is recorded, and why. The customer is responsible for having a lawful basis for that processing, and for telling its tenants how their information is used.

Miventech Labs is the data processor. We process that information only on the customer’s documented instructions, to provide the service to the customer. We do not sell it, use it for advertising, or use it for our own purposes.

Miventech Labs is the controller only for a small amount of data of its own: contact details of the customers we deal with, billing records for subscriptions, and what people send us through the demo request form on this website.

If you are a tenant, your landlord or the agency managing your home is your first point of contact for questions about your data. Tenants do not have Rent Master Pro accounts; they deal with their landlord, including on WhatsApp.

Depending on which parts of the service a customer uses, this can include:

• Tenants: names, phone and WhatsApp numbers, email addresses, national ID numbers and photos of ID documents, KRA PINs, emergency contacts, and for students in hostels their institution and a guardian’s name and phone number; leases, rent, deposits, bills, payments and statements; M-Pesa receipts and forwarded M-Pesa messages; problems reported, with photos; move-out inspections and deposit settlements.
• Landlords an agency manages for: names, contact details, bank details, commission, statements and payouts.
• The customer and its staff: the business name, address and KRA PIN, paybill or till and bank details, and for each person given access, their name, username, email address, phone number and role.
• Property records: properties, units, meter readings, expenses and suppliers, bank statements imported to match payments, and the accounting records built from all of these. A vacancy listing the customer publishes shows the unit and its rent, never a tenant.
• Account and technical data: hashed passwords, two-factor sign-in settings, sign-in history and the IP address and browser of each session.
• Demo and trial requests: what you send through our demo form: your name, role, phone and email, your business name and town, how many properties and units you manage, and when suits you for a call; and, if you try Rent Master, the dates and plan of your trial. A trial account is filled with made-up sample people, not real ones.

• To provide Rent Master Pro to the customer: properties and tenants, billing, payments, the books, reports and maintenance.
• To send messages the customer or a tenant has asked for, by WhatsApp or email.
• To request M-Pesa payments a tenant or the customer starts, and record them against the right lease.
• To keep accounts and data secure, including detecting repeated failed sign-ins.
• To diagnose errors and keep the service running.
• For our own records: to manage the customer’s subscription, bill for it, and reply to demo requests.
• To run a free trial and keep to one free trial per business, by recognising a business that has had one before from its phone, email, email domain or name.

Rent never passes through Miventech Labs. Tenants pay into the customer’s own paybill, till or bank account. When a payment prompt is sent, Safaricom tells us the outcome so the payment can be recorded; the customer’s M-Pesa keys are stored encrypted and used only for that customer’s prompts.

We use the following providers to run the service. Several are used only when the customer uses the related feature. Each receives only what it needs for its task.

• Contabo GmbHGermany (EU)

  Hosts the servers that run Rent Master Pro: the application, its database, uploaded files, backups and our own error monitoring.

  Data: All data held in the service.

• Safaricom PLC (M-Pesa)Kenya

  M-Pesa payment prompts, where the customer has connected its paybill or till. The money goes to the customer’s own paybill or till, not to us.

  Data: The tenant’s phone number, the amount, the account reference (their unit) and the M-Pesa receipt.

• Meta Platforms (WhatsApp Business Platform)Outside Kenya

  WhatsApp messages between the customer and its tenants, where the customer uses WhatsApp: balances, receipts and statements a tenant asks for, payment prompts and problems a tenant reports.

  Data: The tenant’s WhatsApp number, the messages, and documents or photos sent either way.

• HostingerOutside Kenya

  Delivering email sent by the service, such as scheduled reports, and replies to demo requests.

  Data: The recipient’s email address and the message content.

Our error monitoring runs on servers we host ourselves. It records what went wrong and where, with the address of the page or request stripped of anything after the question mark.

Rent Master Pro is hosted in Germany, in the European Union, and some of the providers above process data in other countries. Where data leaves Kenya we rely on the safeguards the Data Protection Act, 2019 allows, including transfers to countries and providers with appropriate data protection safeguards, and we limit what is sent to what each task needs. A customer can ask us for more detail about any transfer.

• Traffic is encrypted in transit with HTTPS.
• Passwords are stored only as bcrypt hashes. A temporary password issued for a new account must be changed at first sign-in. Two-factor sign-in with an authenticator app is available.
• Two-factor secrets and M-Pesa keys are encrypted at rest.
• Sessions are kept in a secure, HTTP-only cookie that page scripts cannot read.
• Each customer’s data is kept separate, and access within a customer is limited by role and permission.
• The database is backed up every night.

No system is perfectly secure, but we work to protect the data entrusted to us.

The customer decides how long its records are kept while it uses the service. When a customer’s subscription ends, we make its data available for export on request and then delete it from the live service, unless the law requires us to keep it. Copies in our backups are overwritten as the backups rotate. Our own billing records are kept as long as tax and accounting law requires.

A free trial account, and everything in it, is deleted when the trial ends, as we say when it starts. Demo and trial requests are kept for two years after we were last in touch. After that the name, role, phone and email are removed, and we keep only one-way coded versions of the phone, email, email domain and business name, which cannot be turned back into them, with the dates of any trial. We keep those so a business that has had a free trial is not offered a second one.

Under the Data Protection Act, 2019 you have the right to be informed about the use of your data, to access it, to have inaccurate data corrected, to have data deleted where there is no longer a reason to keep it, and to object to processing.

Because our customers control the data in Rent Master Pro, please make your request to your landlord or the agency managing your home. If you contact us directly, we will pass your request on and help them respond to it. For data that Miventech Labs controls itself, contact us using the details below.

You can also complain to the Office of the Data Protection Commissioner (ODPC) in Kenya at www.odpc.go.ke.

If we become aware of a breach affecting a customer’s data, we will notify the customer without undue delay, tell it what we know, and help it meet its own obligations to notify the Data Protection Commissioner and the people affected.

Rent Master Pro uses a cookie only to keep you signed in, and your browser’s local storage to remember display preferences such as the theme. We do not use advertising or third-party analytics cookies.

We may update this policy as the service changes. The date at the top shows when it last changed, and we will tell customers about significant changes.

Related

See also our Terms of Service. Questions about this policy can be sent to info@miventechlabs.com.