Privacy Policy

Two roles matter here. An “Organization” (the agency, letting or property management business that registers on the Platform) decides what tenant, landlord and applicant information it keeps and why, so it is the data controller for that information. Tenant HQ is its data processor: we store and process that information only to run the Platform for the Organization.

For the information we collect about the people who sign up and use the Platform (account details, sign-in activity, usage), Tenant HQ is the data controller. Both roles are governed by the Nigeria Data Protection Act 2023 (“NDPA”).

Depending on how you use the Platform, we handle:

• Account information: name, email address, phone number, role, password (stored only as a one-way hash), and the Organization you belong to.
• Tenant, landlord and applicant records entered by an Organization: names, contact details, addresses, identity-check and rental-application details, guarantor details, tenancy and rent history, and uploaded documents.
• Bank and payment details: bank account details that an Organization or a landlord provides so rent can be paid or remitted. Account numbers are encrypted at rest and shown masked in the app. Card payments are handled by our payment provider; we do not see or store full card numbers.
• Messages and calls: team chat messages and attachments, and call records made through the Platform.
• Connected mailbox data if you choose to connect an email account (see section 5).
• Usage and device information: sign-in times, IP address, browser and device type, and an activity log of actions taken in the Platform, used for security and for the Organization's own audit trail.

• to provide the Platform: tenant and rent tracking, billing, receipts, reminders, inspections, agreements and chat;
• to send notifications you or your Organization have set up, such as rent reminders, receipts and application invitations;
• to secure accounts, detect fraud and abuse, and keep an audit trail;
• to support users and fix problems; and
• to meet legal obligations. We do not sell personal data, and we do not use Organization or tenant records for advertising.

We share data only with service providers that help us run the Platform, and only what each needs:

• Payment processing: Paystack, to take card and bank payments for rent and charges when an Organization has turned online payment on.
• Email delivery: Amazon Web Services (SES), to send reminders, receipts and invitations.
• Hosting and storage: our cloud infrastructure and file storage providers.
• Google: only if you connect a Google mailbox (section 5) or sign in with Google.

Within an Organization, data is visible to staff according to their role and the properties they manage. One Organization cannot see another's data. We may disclose information where the law requires it or to protect the rights and safety of users and others.

If you connect a Gmail account, Tenant HQ asks for read-only access to your mailbox. We use it to show your messages in the Platform's Inbox, to work out which emails matter, and to remind you about emails waiting for your reply. A connected mailbox is private to the person who connected it; Organization admins cannot read it.

Tenant HQ's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Google user data only to provide the features you see in the Platform. We do not sell it, use it for advertising, or allow humans to read it except where you ask us to for support, it is needed for security, or the law requires it. Your access token is stored encrypted, and you can disconnect the mailbox at any time, which stops syncing and deletes the stored access. You can also revoke access from your Google Account settings.

We keep an Organization's records for as long as its account is active so that rent, billing and tenancy history stay complete. When an Organization closes its account, we delete or anonymize its data within a reasonable period after any export window, except where we must keep something to meet a legal, tax or audit requirement. Security and sign-in logs are kept only as long as needed to protect the Platform.

Data is encrypted in transit, passwords are hashed, sensitive values such as bank account numbers and connected-mailbox tokens are encrypted at rest, and access is limited by role and by Organization. Repeated failed sign-ins lock the account, and suspicious sign-ins can be flagged and sessions revoked. No system is perfectly secure; if a breach affects your personal data we will notify the people and authorities the NDPA requires.

Under the NDPA you can ask to access the personal data held about you, correct it, have it deleted, restrict or object to how it is used, receive a copy of it, and withdraw consent where we rely on it. You can also complain to the Nigeria Data Protection Commission.

If you are a tenant, landlord or applicant, the Organization that manages your property holds your records, so please contact it first; we will help it respond. For your own Platform account, contact us using the details below.

Some of our providers process data outside Nigeria. Where that happens we rely on providers with appropriate safeguards and transfer only what is needed to deliver the service, as the NDPA requires.

The Platform is for businesses and adults. We do not knowingly collect personal data from anyone under 18.

We may update this policy as the Platform changes; the “Last updated” date above will change accordingly. Material changes will be flagged in-app where practical.

Questions or requests about your data can be sent to salamie.olalekan@gmail.com.