1. Who we are
This policy is issued by Keyvata Ltd ("Keyvata", "we", "us", "our"), the data controller for personal information processed through:
- the public website at keyvata.com;
- the signed-in hub at app.keyvata.com;
- the Keyvata iOS and Android applications; and
- our APIs that those surfaces call (api.keyvata.com).
We operate a Nigerian marketplace for physical real-estate tenancy, short-stay accommodation, shared living, event venues, and property sales. We are not a bank, a licensed estate surveyor, a law firm, an escrow company, or a custodian of funds or digital assets. Payments use Protected Milestone Settlement and are processed by CBN-licensed payment partners. Keyvata does not hold customer funds and does not store full card numbers.
Contact the privacy team at privacy@keyvata.com. Operational support is support@keyvata.com. The registered office address is published on the Contact page.
2. What this policy covers
It applies to anyone who browses listings, creates an account, completes identity checks, books or hosts a stay, signs a digital lease, messages another user, opens a dispute, or otherwise uses Keyvata. It does not apply to other websites you open from a link, which have their own policies.
We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation where still applicable, Google Play User Data policies, and Apple App Store Review Guideline 5.1 (Privacy). If those rules conflict, we apply the stricter operational control.
3. Information we collect
We collect only what is needed to run the marketplace, record booking payments, verify people and listings, and keep accounts secure. Categories:
| Category | Examples | How we get it |
|---|---|---|
| Account | Name, email, phone, role (tenant, guest, landlord, host, venue owner), password hash, profile photo | You, or Google / Apple when you choose those sign-in methods |
| Identity (KYC) | Legal name, date of birth, BVN or NIN match results, liveness session references, ID or utility-bill images | You, plus our identity-verification processor when you start a check |
| Marketplace | Saved searches, favourites, messages, booking dates, guest count, listing copy and photos you upload | You, as you use the product |
| Payments | Transaction reference, amount, currency, payment status, payout bank name and encrypted account number | Our ledger (card numbers never hit our servers) |
| Location | Approximate or precise coordinates when you search nearby or use the map | Your device, only after you grant location permission |
| Device & security | Device type, app version, push token, session identifiers, approximate IP used to detect abuse | Automatically when you use the app or hub |
| Support & disputes | Tickets, handover photos, dispute evidence, resolution notes | You, and our support staff when you open a case |
We do not collect biometric templates (Face ID / fingerprint maps). Those stay on your device. We do not sell personal data. We do not use your data to build advertising profiles or to track you across other companies' apps.
4. Device permissions (mobile)
Permissions are requested at the moment of use, not on first launch. You can refuse or later revoke them in system settings; some features will then be unavailable.
| Permission | Why we ask | If you refuse |
|---|---|---|
| Location (fine / coarse) | Show listings near you and centre the browse map | You can still search by city and filters; nearby/radius search will not work |
| Camera | Capture KYC documents, listing photos, and check-in / check-out inspection photos | You can upload an existing photo from the library where that path exists |
| Photo library (images only) | Attach listing, handover, or dispute photos | Camera capture may still be available; you cannot pick existing images |
| Notifications | Booking, payment, message, and access-code alerts | You still receive in-app and email notices where configured |
| Biometrics (Face ID / fingerprint) | Optional local app lock, revealing a door PIN, confirming a contract signature | Use your password or skip the optional lock; we never receive the biometric itself |
5. Why we use data (lawful bases)
Under the NDPA we rely on one or more of these bases for each purpose:
- Contract: creating your account, taking a booking, recording the payment, generating a tenancy or stay agreement, and paying a host after check-in.
- Legal obligation: retaining transaction and tax records, responding to lawful requests from Nigerian authorities, complying with CBN-licensed payment partners.
- Legitimate interests: fraud prevention, trust scoring from on-platform activity, diagnosing crashes, securing sessions — balanced against your rights.
- Consent: optional location for nearby search, marketing emails if we ever send them (we do not today), optional biometrics on the device, and optional cookies described in the Cookie Policy. We do not set preference, maps, analytics, or marketing cookies until you record a choice. You can withdraw consent without losing the rest of your account.
6. Identity checks and payments
Identity verification
Hosts and, where policy requires, guests complete phone, BVN/NIN, liveness, and document checks. We store the result of a check (matched / not matched, reference IDs) and the images you upload. Full government ID numbers are minimised and are not written into ordinary application logs.
Payments
Card checkout runs in a PCI DSS environment. Keyvata stores payment references and amounts so both sides can see a booking. Landlord payout account numbers are encrypted at rest. We never see or store full card PAN, CVV, or PIN.
Booking payments are for physical real-world services: leases, short stays, venues, and damage deposits. You pay at checkout, and the host is paid after check-in or handover. Keyvata does not hold those funds, and does not sell digital goods, tokens, wallets, or in-app upgrades.
7. Trust scores and automated suggestions
We may compute a trust score and listing "for you" matches from on-platform history (payments completed, reviews, disputes, saved preferences). These are decision-support tools for hosts and guests. They are not credit-bureau scores and are not sold to third parties.
You can ask us to explain, in plain language, the main factors behind your score, and to correct factual inputs (for example a booking wrongly attributed to you) by emailing privacy@keyvata.com.
9. Security
Traffic uses HTTPS/TLS. Access tokens are stored in the OS secure store on mobile and in HttpOnly cookies on the hub where the product design requires it. Payout account numbers are encrypted. Staff access to personal data is limited to support and compliance roles and is logged.
No online service is perfectly secure. If we become aware of a breach that is likely to result in a high risk to you, we will notify you and the Nigeria Data Protection Commission as the NDPA requires.
10. Retention and account deletion
We keep personal data only as long as the account is active, plus any period Nigerian commercial, tax, or anti-fraud law requires us to keep a record.
How to delete your account (Google Play and Apple Guideline 5.1.1(v)):
- In the app: Profile → Manage Account → Delete Keyvata Account, then confirm.
- On the web hub: Account settings, where the same control is offered when you are signed in.
- By email: write to privacy@keyvata.com from your registered address if you cannot sign in. We will verify the request before acting.
11. Your rights (NDPA)
Subject to the NDPA, you may:
- access the personal data we hold about you;
- correct inaccurate data;
- request deletion (see above);
- object to or restrict certain processing;
- request a portable copy of account data we hold in structured form;
- withdraw consent where we relied on consent (for example location).
We will respond within 30 days of a verified request, or explain why a lawful extension applies. Email privacy@keyvata.com and tell us which right you are exercising. If you are not satisfied, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
12. Children
Keyvata is for people who are at least 18 years old and have capacity to contract under Nigerian law. We do not knowingly collect data from children. If you believe a minor has an account, email privacy@keyvata.com and we will close it.
13. Changes
We will post updates on this page and change the effective date. Material changes that affect how we use existing data will be flagged in the product or by email to the address on the account, where we have it.
Related policies: Terms of Service, Privacy Policy, and Cookie Policy.
14. Contact
Keyvata Ltd
Privacy: privacy@keyvata.com
Support: support@keyvata.com
Shop 17, KC Plaza, Ushafa Bwari Road, Bwari, Abuja.
This policy explains our practices in good faith. It is not a substitute for independent legal advice about a specific booking or dispute.