Privacy notice
How Truhali uses your information, in plain English. Truhali is new and in its test phase, so this notice describes exactly how things work today.
The short version
- I collect only what I need to visit your property and send you a report.
- No faces, children or number plates in any photo.
- I never sell your information, never post your property anywhere, and never need your ID, title deed or LR number.
- Visit photos are deleted 90 days after your report. On the Monthly Check, they are kept while you stay.
- Ask, and I will delete your information sooner.
- This website sets no cookies and has no analytics, ads or trackers.
Who is responsible
Truhali is run by Jose, an individual based in Nairobi, Kenya, trading as Truhali. It is not a registered company. Under Kenya’s Data Protection Act, 2019, I am responsible for how your information is used (the “data controller”). My full name is on every invoice, and I will give it to anyone who asks.
Contact: truhali.ke@gmail.com or WhatsApp +254 794 393 337.
What I collect
About you
- Your name, WhatsApp or phone number, and email if you use it.
- The country you live in, so I can get time zones right.
- Payment records: the amount, the date, and the sender’s name as M-Pesa shows it.
About your property
- Its location and map pin.
- What kind of property it is, and whether anyone lives or works there.
- How access is arranged.
- The code word you choose for each visit.
- For a build, the stage you were told it has reached.
At each visit
- Photos of the outside, the compound and the meters, and the meter readings.
- Photos inside only when the property is empty or under your control.
- Two short videos in which your code word, the date and the time are said out loud.
- The date, time and place each photo was taken (the phone records these).
- A list of what was seen.
The document you show on the video call. Before a first visit, I ask you to show me one document with your name on the property. You show it on the call. I don’t ask you to send it, I don’t take a screenshot, and I don’t keep its numbers.
Kenyan law treats property details as sensitive personal data, and I handle them that way.
Other people at your property
- If you give me a caretaker’s or relative’s first name and number, I use it only to arrange the visit.
- In reports, people are described by their role (for example “caretaker”), never by name.
- I don’t photograph faces, children or number plates. If someone is in the way, I wait or turn away.
- Videos may pick up voices.
- Anyone on site can decline to be recorded, to speak on video, or to let me in.
- Please tell anyone who lives or works there before the visit. I give you a short message to forward.
Why I use it
| What I do | Legal basis |
|---|---|
| Carry out the visits you ask for and send you reports | Our agreement (contract) |
| Show that each visit happened as reported (code word, time, place) | Our agreement |
| Arrange access with the person on site | Our agreement; for their contact details, my legitimate interest in arranging the visit you asked for |
| Invoices and payment records | Our agreement, and tax law |
| Deal with a complaint or legal claim about a visit | Establishing or defending legal claims |
Because some of the services below keep data outside Kenya, I also ask for your explicit agreement to that when you book.
What I never do
- Sell or rent your information.
- Share it with agents, repair firms, lenders or anyone else, unless you ask me to or the law requires it.
- Use photos of your property in posts, ads or sample reports.
- Post anything about your property publicly.
- Profile you or make automated decisions about you.
Where it is kept, and who else handles it
- Visit photos and videos are copied by cable from the phone to a private folder on my own computer, not to a cloud service, and then deleted from the phone.
- Visits in Nyeri, Naivasha and Nakuru are done by a person I know personally. They get the property’s location, the access details and the code word, never your name. They send the files straight to me (as a WhatsApp document or through Google Drive) and delete their copies once I have confirmed I have them.
- Your report and our messages travel through WhatsApp (Meta) or email (Gmail, run by Google). Their servers are outside Kenya.
- Payments go through Safaricom M-Pesa and whichever app you use to send.
- This website is hosted by Cloudflare, which handles basic technical data such as your IP address to deliver the pages and block abuse. The site sets no cookies of its own, loads nothing from other companies, and has no analytics, ads or tracking.
The countries where Meta, Google and Cloudflare store data may have weaker privacy laws than Kenya. That is why the original photos, with their exact location, stay on my computer, and why the report you receive shows how close together the photos were taken rather than the coordinates.
How long I keep it
| What | How long |
|---|---|
| Visit photos, videos and notes | Deleted 90 days after your report. On the Monthly Check, kept while you stay (so each report can show what changed), then deleted 90 days after your last report. |
| Your code word | Deleted with that visit’s photos. |
| Messages and contact details | Deleted within 12 months of your last visit, or within 6 months if you only asked a question and didn’t book. |
| Invoices and payment records | 5 years, because tax law requires it. |
If a record is needed as evidence in a dispute, I may hold it, unused, instead of deleting it. If that happens, I will tell you.
Keeping it safe
- Visit files are kept on my own computer, which needs a password to open, not on a cloud service.
- Location and camera data are removed from every photo in your report.
- Visit files are deleted from the phone once they are copied.
- If something goes wrong that puts you at real risk, I will tell you, and the Data Commissioner, within 72 hours.
Your rights
| You can ask me to | I respond within |
|---|---|
| Tell you what I hold about you and give you a copy | 7 days |
| Correct anything that is wrong | 14 days |
| Delete it, or stop using it for a purpose (payment records that tax law requires are kept) | 14 days, usually the same day |
| Send it to you or to another provider in a usable format | 30 days |
You can withdraw a consent at any time. That doesn’t affect what was done before. Write to truhali.ke@gmail.com or WhatsApp +254 794 393 337. If you are not happy with my answer, you can complain to the Office of the Data Protection Commissioner at www.odpc.go.ke.
Do you have to give me this information?
No law requires it. But I can’t visit a property without its location, the access arrangements and your agreement.
Changes
Truhali is in its test phase, so this notice may change. If a change affects you, I will tell you before it applies.