Legal

Privacy Policy

We explain what information we collect, why we collect it, and how we protect it when you use VeriStay.

Last updated: 22nd February 2026

Privacy Policy

This Privacy Policy is issued by VeriStay Kenya ("VeriStay", "we", "us", or "our") and applies to your use of the VeriStay mobile application and website (the "Platform").

We are committed to protecting your privacy and handling your personal data responsibly, in accordance with the Kenya Data Protection Act, 2019 and its accompanying regulations.

This Policy explains what personal data we collect from Hosts and Guests, why we collect it, how it is used, who it may be shared with, and the rights you have over your own data.

By creating an Account or using the Platform, you consent to the collection and use of your information as described in this Policy.

If you do not agree with this Policy, please do not use the Platform.

Our Commitment

VeriStay's handling of your data is guided by the same values behind our Platform:

  1. Accountability
  2. Transparency
  3. Compliance
  4. Reliability
  5. Trust

We only collect what we need to operate a safe and verified booking platform — nothing more.

1. Definitions

Capitalized terms used in this Policy have the meanings given below:

"Personal Data": Any information relating to an identified or identifiable natural person, as defined under the Kenya Data Protection Act, 2019.
"Data Subject": Any User (Host or Guest) whose Personal Data is processed by VeriStay.
"Processing": Any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
"Data Controller": VeriStay Kenya, which determines the purpose and means of Processing Personal Data on the Platform.
"Sensitive Personal Data": Data revealing a person's National ID number, passport details, or other information classified as sensitive under Applicable Law.
"Platform": Shall mean the "VeriStay Kenya" mobile application and website.

2. Information We Collect

2.1. Information You Provide Directly:

  • Account details — name, email address, phone number, and password.
  • Identity verification documents — National ID or passport number, and front/back ID photos.
  • Profile information — preferred name, date of birth, and profile photo.
  • Listing details (Hosts) — property address, photos, descriptions, and pricing.
  • Communications — messages sent through in-app chat, support tickets, or emails to us.

2.2. Information Collected Automatically:

  • Device information — device type, operating system, and unique device identifiers.
  • Usage data — pages viewed, features used, search queries, and booking history.
  • Location data — approximate location, where permitted, to show relevant listings.
  • Log data — IP address, browser type, and timestamps of access.

2.3. Information From Third Parties:

  • Google Sign-In — name, email, and profile photo, if you choose to register or log in using Google.
  • M-Pesa / Safaricom — payment confirmation details (e.g. M-Pesa reference codes) needed to verify a transaction.

3. How We Use Your Information

We process your Personal Data for the following purposes:

  • To create and manage your Account.
  • To verify Host identity and Property listings (the "Veri" in VeriStay).
  • To process Bookings, payments, payouts, and cancellations.
  • To facilitate communication between Hosts and Guests.
  • To provide customer support and respond to inquiries or disputes.
  • To send booking confirmations, reminders, and service-related notifications.
  • To send promotional emails, SMS, or push notifications, where you have not opted out.
  • To detect, investigate, and prevent fraud, abuse, or violations of our Terms.
  • To comply with legal obligations, including tax and regulatory reporting (e.g. to KRA or TRA where applicable to Hosts).
  • To improve and personalize the Platform based on usage patterns.

4. Identity Verification & ID Documents

4.1. As part of our verification process, we may request a copy of your National ID, passport, or other government-issued identification, along with a clear photo of the front and back.

4.2. This information is classified as Sensitive Personal Data and is processed strictly for identity verification, fraud prevention, and regulatory compliance purposes.

4.3. ID documents are stored securely and access is restricted to authorized VeriStay personnel involved in the verification process. We do not display your ID documents publicly or share them with other Users.

4.4. For Hosts, our verification team may also conduct an in-person inspection of the Property as described in our Terms and Conditions; this does not involve additional collection of personal documents beyond what is stated here.

5. Payment Information

5.1. All payments on the Platform are processed via M-Pesa STK Push, facilitated by Safaricom. VeriStay does not collect or store your M-Pesa PIN at any point.

5.2. We retain transaction references, amounts, and timestamps necessary to confirm payment, process refunds, and resolve disputes.

5.3. Wallet balances (for Guests) and payout details (for Hosts, including M-Pesa or bank account numbers used for withdrawal) are stored securely and used solely to facilitate transactions on the Platform.

5.4. Referral bonuses credited to a Guest's wallet are tracked internally and are not linked to any external financial account beyond what is needed to identify the referring and referred Users.

6. How We Share Your Information

We do not sell your Personal Data. We may share information in the following limited circumstances:

  • Between Hosts and Guests — limited information (e.g. name, profile photo, phone number) necessary to coordinate a confirmed Booking.
  • Service providers — third parties who help us operate the Platform, such as cloud hosting, SMS/email delivery, and payment processing (e.g. Safaricom M-Pesa).
  • Legal and regulatory authorities — where required to comply with a legal obligation, court order, or request from bodies such as the Kenya Revenue Authority (KRA) or Tourism Regulatory Authority (TRA).
  • Safety and fraud prevention — with relevant authorities (e.g. the Kenya Police) where we reasonably believe illegal activity has occurred on a Listing.
  • Business transfers — in the event of a merger, acquisition, or sale of assets, where your data may be transferred as part of that transaction, subject to confidentiality safeguards.

We require all third parties who process data on our behalf to maintain appropriate confidentiality and security standards.

7. Cookies & Tracking Technologies

7.1. Our website uses cookies and similar technologies to keep you signed in, remember your preferences, and understand how visitors use our site.

7.2. We may use analytics tools to measure traffic and usage patterns in aggregate, anonymized form to improve the Platform.

7.3. You can control or disable cookies through your browser settings; however, doing so may affect certain features of the website.

8. Data Retention

8.1. We retain your Personal Data for as long as your Account remains active, and for a reasonable period afterward to comply with legal, accounting, or reporting obligations.

8.2. Booking and transaction records may be retained longer where required for tax purposes or to resolve disputes, in line with Kenyan law.

8.3. You may request deletion of your Account at any time; see Clause 10 (Your Rights) below.

9. Data Security

9.1. We implement reasonable technical and organizational measures to protect your Personal Data against unauthorized access, alteration, disclosure, or destruction, including encrypted transmission and access-controlled storage.

9.2. Despite our efforts, no method of electronic transmission or storage is 100% secure. We encourage Users to also safeguard their own account credentials and avoid sharing OTPs or passwords with anyone.

9.3. In the event of a data breach affecting your Personal Data, we will notify affected Users and the Office of the Data Protection Commissioner as required under Kenyan law.

10. Your Rights as a Data Subject

Under the Kenya Data Protection Act, 2019, you have the right to:

  • Be informed of the use to which your Personal Data is to be put.
  • Access your Personal Data held by VeriStay.
  • Request correction of inaccurate or outdated Personal Data.
  • Request deletion of your Personal Data, subject to our legal retention obligations.
  • Object to the processing of your Personal Data, including for direct marketing.
  • Withdraw consent at any time, where processing is based on consent.
  • Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya.

To exercise any of these rights, please contact us using the details in Clause 15 below. We will respond within a reasonable timeframe as required by law.

11. Children's Privacy

The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect Personal Data from minors. If we become aware that we have inadvertently collected data from a person under 18, we will take steps to delete that information promptly.

12. Cross-Border Data Transfers

Some of our service providers (such as cloud hosting or analytics providers) may process data outside Kenya. Where this occurs, we take reasonable steps to ensure such transfers comply with the Kenya Data Protection Act, 2019, including the use of providers with appropriate data protection safeguards.

13. Third-Party Links & Services

The Platform may contain links to third-party websites or services (e.g. Google Maps, WhatsApp support). This Privacy Policy does not apply to those third parties, and we encourage you to review their respective privacy policies before providing any information to them.

14. Changes to this Privacy Policy

VeriStay reserves the right to update or modify this Privacy Policy at any time. Material changes will be communicated through the Platform or via email where appropriate. The "Last updated" date at the top of this page reflects the most recent revision. Your continued use of the Platform after changes take effect constitutes acceptance of the updated Policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how your Personal Data is handled, please reach out to us:

Email: veristay01@gmail.com

Phone: +254 708 344 103