Privacy Policy

Keyova ("Keyova", "we", "us") is an app of Excel Keyova Labs Limited, a company registered in the Republic of Rwanda with its principal place of business in Kigali. Excel Keyova Labs Limited is the data controller for personal data processed through keyova.app and its related services.

Contact our data protection team at privacy@keyova.app.

This policy applies to landlords, property managers, tenants, service workers and visitors who use our website, web application and related services (the "Services").

• Account data: name, email address, phone number, role and password (stored hashed).
• Identity verification data: government ID images, document details, selfie, liveness video, date of birth, nationality and verification results.
• Property and lease data: properties, units, rent amounts, lease terms, signatures, signature timestamps and IP/device metadata.
• Service data: availability slots, service requests, status changes and confirmations.
• Technical data: log data, browser type, device identifiers and cookies required to keep you signed in.
• Google account data: if you choose "Continue with Google", we receive your name, email address and profile picture.

• To create and secure your account and provide the Services.
• To verify tenant identity at the request of the landlord or manager.
• To prepare, sign, store and evidence lease agreements.
• To route and track service requests.
• To send transactional emails such as invitations, milestones and reminders.
• To bill landlords for rented units.
• To detect fraud, enforce our Terms and comply with legal obligations.

We do not sell personal data and we do not use it for third-party advertising.

We process data on the basis of contract performance, legitimate interests (such as security and fraud prevention), legal obligation, and — for biometric identity verification — your explicit consent, which you may withdraw at any time.

Keyova's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to authenticate you and is never sold, used for advertising, or transferred except as necessary to provide the Services or as required by law.

We share data only with service providers who process it on our behalf under contractual safeguards, including:

• Cloud hosting and database infrastructure providers.
• Myaza — identity verification (KYC).
• Resend — transactional email delivery.
• Google — optional sign-in.

Within Keyova, tenant KYC evidence is visible only to the landlord or authorised manager of the tenant's property. We may disclose data where required by law or to protect rights and safety.

Some providers may process data outside Rwanda. Where this occurs, we rely on appropriate safeguards as required by Law No. 058/2021 and applicable data protection law.

We retain account data while your account is active. Lease records and audit trails are retained for up to 10 years to evidence agreements. Identity verification evidence is retained only as long as necessary for verification and legal obligations, after which it is deleted or anonymised.

We use encryption in transit and at rest, row-level access controls, short-lived access links for sensitive media, and audited database-enforced workflows. No system is perfectly secure; we will notify affected users and authorities of breaches as required by law.

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to processing, and withdraw consent. Email privacy@keyova.app. You may also lodge a complaint with Rwanda's National Cyber Security Authority (NCSA).

We use only essential cookies and local storage needed to keep you signed in and secure. We do not use advertising cookies.

The Services are not directed to individuals under 18, and we do not knowingly collect their data.

We may update this policy. Material changes will be notified by email or in-app before taking effect.