Privacy Policy

Last updated: 1 November 2026

This Privacy Policy explains how NestGrid collects, uses and protects personal data when you use our website, web app and mobile app (the "Service"). We handle personal data in line with the Kenya Data Protection Act, 2019.

1. Who is responsible for your data

NestGrid is responsible for the data needed to run your account and the Service. Landlords, property managers and agents using NestGrid decide what tenant and property information they record. For that information they are responsible for it, and we process it on their instructions.

2. Data we collect

• Account details: name, email address, phone number, password (stored in hashed form) and profile photo.
• Tenant details: national ID number, occupation, previous and permanent addresses, and documents uploaded to a tenancy.
• Property and tenancy records: properties, units, lease dates, rent, deposits and maintenance tickets.
• Payment records: invoices, amounts, dates and transaction references, including M-Pesa references used to match payments. We do not store M-Pesa PINs or full card numbers.
• Enquiries: details you send through contact, demo or listing request forms.
• Technical data: device tokens for push notifications, IP address, browser or device type, and logs that keep the Service secure.

3. How we use your data

• To create and secure accounts, including one-time verification codes.
• To manage tenancies, issue invoices, and match and record rent payments.
• To send service messages by email, SMS and push notification.
• To respond to enquiries and provide support.
• To prevent fraud, fix faults and improve the Service.
• To meet our legal, tax and accounting obligations.

We rely on performing our contract with you, our legitimate interests in running a secure Service, legal obligations and, where required, your consent.

4. Who we share data with

We do not sell personal data. We share it only as needed with:

• The landlord, property manager, caretaker or maintainer connected to your tenancy.
• Payment providers that process your transactions, such as M-Pesa and card gateways.
• Service providers for hosting, file storage, email, SMS and push notifications, including Firebase Cloud Messaging.
• Authorities or advisers where the law requires it, or to protect rights and safety.

Some providers operate outside Kenya. Where data is transferred abroad, we take steps to keep it protected as the Data Protection Act requires.

5. Cookies

We use cookies needed to keep you signed in and protect forms. Our Cookie Policy has more detail.

6. How long we keep data

We keep personal data while an account or tenancy is active, and afterwards for as long as needed to meet legal, tax and accounting duties or resolve disputes. We then delete or anonymise it.

7. Security

We use access controls, encrypted connections and hashed passwords to protect your data. No system is completely secure, so please keep your login details private and tell us about any suspected misuse.

8. Your rights

You may ask to access, correct or delete your personal data, object to or restrict its use, withdraw consent, or receive a copy in a portable format. Tenants may also need to contact their landlord or property manager, who controls their tenancy records. You can complain to the Office of the Data Protection Commissioner of Kenya.

9. Children

The Service is not intended for anyone under 18, and we do not knowingly collect their data for accounts.

10. Changes to this policy

We may update this policy and will change the date above. Significant changes will be announced through the Service.

11. Contact us

For privacy questions or requests, contact us at lawrence@ims.co.ke.