Privacy Policy

2.1 Information We Collect

• Account information: full name, phone number, email address, secure sign-in information, and account consent records.
• Identity verification: national ID or passport details submitted by Hosts and, where required, Guests.
• Host verification evidence: proof of ownership or right to rent, KRA PIN information, county-permit information, and related review metadata.
• Guest profile photo: a private profile image that a Guest chooses to add to their account. It is required before the Guest can submit a booking request, but it is not used in public Explore cards or public search results.
• Listing content: property photographs, descriptions, pricing, availability information, house rules, cancellation terms, and location.
• Payment information: M-Pesa, card-processing, and PayPal transaction details needed to process bookings and payouts. We do not store full card details or M-Pesa PIN details ourselves; those are handled by the relevant payment processors.
• Usage data: device information, log data, and how you interact with the platform, collected to improve performance and security.

2.2 How We Use Your Information

• To create and manage your account, record policy acceptance, and verify Host and Guest identities where required.
• To review Host submissions and keep unpublished verification evidence available only to authorised review personnel and the relevant Host.
• To process bookings, payments, payouts, and booking-related communications.
• To show a Guest’s private profile photo only in private account views and, where appropriate, to an authorised Host for a confirmed or completed booking or to an authorised administrator.
• To maintain trust and safety, including fraud prevention and investigation of inaccurate or unsafe listings.
• To meet legal and regulatory obligations, including tax and tourism-authority reporting where required.
• To send marketing communications where you have opted in; you may opt out at any time.

2.3 Where Your Data Is Stored and Who Can Access It

Pinnamount stores account data, listing content, and photographs using Supabase, a cloud database and storage provider. Depending on our configuration, data may be stored on servers located outside Kenya. Private verification documents and Guest profile photos are stored separately from public listing media, are not exposed through public Explore routes, and are restricted by authenticated access controls. Where data is transferred or stored outside Kenya, we take reasonable steps to protect it consistently with applicable data-protection requirements, including restricting access to authorised personnel and using encrypted connections for data in transit.

2.4 Data Retention and Deletion

When you delete your Pinnamount account, we permanently delete your profile information, uploaded identification documents, verification evidence, Guest profile photo, and property photographs from our active systems within six months, except where we are legally required to retain certain records, including transaction records for tax or regulatory purposes, for a longer period. Booking history connected to completed transactions may be retained in anonymised form for accounting and regulatory compliance even after account deletion.

2.5 Who We Share Data With

We do not sell personal information to third parties for advertising purposes.

• Payment processors, including M-Pesa/Safaricom, card-processing providers, and PayPal, to complete transactions.
• The authorised Host connected with a confirmed or completed booking, for the limited booking details needed to host the stay. A Guest profile photo is not publicly displayed and is not shared with unrelated Hosts.
• Relevant government or regulatory bodies where required by law, such as tax or tourism authorities.
• Service providers who support our operations, such as cloud hosting, under confidentiality and security obligations.

2.6 Your Rights

Subject to applicable law and the relevant exceptions, you may request access to the personal data we hold about you, correction of inaccurate data, deletion of your data, and objection to certain uses of your data. To exercise these rights, contact support@pinnamountescapes.com.

2.7 Children’s Privacy

Pinnamount is not intended for use by individuals under 18. We do not knowingly collect personal information from children.