This policy explains what personal data SeaSpace holds, why, who it goes to and what rights you have. We follow Kenya's Data Protection Act, 2019 and the regulations made under it.
1. Who we are
SeaSpace is run by Little Qwean Limited, a company registered in Kenya (company number PVT-3QU7GM57), whose registered office is at Workable, Waiyaki Way, Westlands, Nairobi (postal address P.O. Box 2700-00606, Sarit Centre, Nairobi).
Our Data Protection Officer is Joanna Drew. For privacy questions, email hello@seaspace.app, or use Settings, then Report a problem, in the app.
2. Two roles: your data and your guests' data
- Your own data (the account holders and the people on their teams): SeaSpace decides how this is used, so we are the data controller. This policy covers it in full.
- Your guests' data, and other people you add (staff, property managers): the landlord or agency decides how this is used and is the controller. SeaSpace is their data processor and handles the data only on their instructions, under the Data Processing Terms in our Terms of Business. Guests should first contact the landlord or agency they booked with. We will help them answer.
3. What we hold
- Account details: name, email address, phone number, a scrambled (hashed) password, language, and the accounts you belong to.
- Business details (agencies and property managers): business name, registration number, KRA PIN and verification status.
- Property details: houses, locations, rates, photos, calendar links, booking rules and payment details for guests (M-Pesa, bank).
- Booking and guest details (as processor): guest names, phone numbers, email addresses, dates, number of guests, messages, reviews and, if you use online check-in, nationality and ID or passport number.
- Money records: amounts recorded as paid or owed, expenses and receipt photos, imported agency, Airbnb and M-Pesa statements, and tax figures. We do not take or hold guest payments.
- Billing: your plan, payments and invoices. Card and M-Pesa payments are handled by Paystack. We keep a payment reference and a token that lets Paystack renew your plan. We never see or store your full card number.
- Messages: WhatsApp messages sent and received through a connected number, and the emails we send you.
- Consents: which version of our terms and this policy you accepted and when, and whether you want news and tips from us.
- Security and technical data: sign-in sessions, the network (IP) address used to create an account (kept for 24 hours to stop abuse), error logs and the access log of any support visit.
4. Why we use it, and on what legal basis
| What we do | Legal basis (Data Protection Act, 2019, section 30) |
|---|---|
| Create and run your account, sync calendars, send account and alert emails, provide support | To perform our contract with you |
| Bill for licences and keep financial records | Contract, and legal obligation (tax law) |
| Keep the Service secure, prevent fraud and abuse, fix faults | Our legitimate interests |
| Improve SeaSpace and show anonymised market figures | Our legitimate interests (only fully anonymised, combined data) |
| Send news, tips and offers | Your consent, given with the optional tick box. You can withdraw it at any time |
| Process guests' data for landlords and agencies | On our customers' instructions, as their processor |
We don't make decisions about you by purely automated means that have legal or similarly significant effects. Some features use automated tools. For example, Translate from English uses Cloudflare's AI service to translate text you choose to translate. That text is not used to train their models.
5. Who we share it with
- People you choose. Your team, and the agencies or property managers you link. You decide, house by house, what each one sees.
- Our service providers (sub-processors). They work under contracts that protect your data:
| Provider | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, file storage, backups, bot check (Turnstile), AI translation | USA (database in the eastern USA), served from Cloudflare's global network |
| Resend (Plus Five Five, Inc.) | Sending account and alert emails | USA |
| Paystack | Subscription payments by card and M-Pesa | Kenya and Nigeria |
| Safaricom PLC | M-Pesa payment prompts (when used) | Kenya |
| Meta Platforms (WhatsApp Business) | Sending and receiving WhatsApp messages, only if you connect a number | Global |
- Channels you connect. Airbnb, Booking.com, Google Calendar and others read your calendar links. These links show dates only, marked "Blocked", with no guest details.
- When the law requires it. For example, to a court, the Kenya Revenue Authority or the Data Protection Commissioner when they make a lawful request.
- If SeaSpace changes hands. If our business is sold or merged, we will tell you before your data comes under a different privacy policy.
We never sell personal data, and never share it for advertising.
6. Data stored outside Kenya
Our database and files are stored by Cloudflare in the United States, and emails are sent through Resend in the United States. We transfer data only as sections 48 to 50 of the Data Protection Act, 2019 allow. We rely on appropriate safeguards: written contracts with each provider that include data protection terms, encryption in transit, access limited to the people who need it, and providers' security certifications. We do not process sensitive personal data, as the Act defines it, abroad without the safeguards and consent the Act requires. You can ask us for details of these safeguards.
7. How we keep it safe
Connections are encrypted (HTTPS). Passwords are hashed and never stored as text. Sessions are signed cookies that only the server can read. Every action is checked on the server against what that person is allowed to do. SeaSpace staff use separate logins with two-step sign-in, can see your guests, bookings or money only with your permission, and every action they take is logged where you can see it. If a breach puts your rights at risk, we will tell you and the Data Protection Commissioner as the law requires.
8. How long we keep it
- Booking and money records: while your account is open and for 7 years after, so that you and we can meet tax and record-keeping duties. Our customers can ask for a shorter period.
- Closed accounts: the account is locked at once. After the retention period, its people, records, photos and houses are deleted, unless the law requires otherwise.
- Sign-up network addresses: 24 hours. Backups: 30 days.
- Consent records: for as long as the account exists, plus the retention period, so that we can show what was agreed.
- Marketing preference: until you change it.
9. Your rights
Under the Data Protection Act, 2019, you have the right to:
- be told how your data is used (this policy);
- see the personal data we hold about you;
- have wrong or misleading data corrected;
- have data deleted, where we don't need to keep it by law;
- object to us using your data, and to direct marketing at any time;
- withdraw your consent, without affecting what we did before; and
- get your data in a portable format. "Download all my data" in the app gives you everything as one file.
To use these rights, contact us as shown in section 1. We will reply within the time limits in the Data Protection (General) Regulations, 2021, and we may need to confirm who you are first. If you're unhappy with how we handle your data, you can complain to the Office of the Data Protection Commissioner (www.odpc.go.ke). We'd like the chance to put it right first.
10. Cookies and similar technology
- The SeaSpace app uses one essential cookie to keep you signed in (it lasts 14 days). It also keeps your language choice and an offline copy of the app on your device, so that the app starts quickly and works with a weak signal. When the bot check is switched on at sign-up, Cloudflare Turnstile may set its own security cookie.
- The SeaSpace website uses no cookies, analytics or advertising trackers.
All of these are strictly necessary, so there is nothing to accept. If we ever add analytics or advertising cookies, we will ask you first.
11. Marketing
We send news, tips and offers only if you tick the box for them, at sign-up or later in your account settings. Every one of these emails has an unsubscribe link. Account emails, such as confirming your address, receipts, password resets and the alerts you choose, are part of the Service and are not marketing.
12. Children
SeaSpace is for adults running rental businesses. You must be 18 or over to have an account. Guests' details, including children travelling with them, are entered by the landlord or agency, who is responsible for them.
13. Changes to this policy
When we change this policy, we update the date at the top. If the change matters, we tell you by email and in the app before it applies. Each version is kept, and we record which one you accepted.
See also our Terms of Business. Questions: hello@seaspace.app.