Privacy policy

Flossytrukid BnB, built and operated by Rytrix in Nairobi, is the data controller for the personal data described here. We process it in line with the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021, and will register with the Office of the Data Protection Commissioner (ODPC) as the Act requires.

• Account: your name, email address, password (stored only as a secure hash by our authentication provider), profile photo, bio and languages.
• Phone number: your Kenyan mobile number, used for M-Pesa and for your host or guest to reach you about a confirmed stay.
• Bookings: dates, number of guests, the listing, messages to hosts, cancellations and reviews.
• Payment references: the M-Pesa number charged, transaction code, amount and time. We never collect or see your M-Pesa PIN — you enter it only on your phone.
• Hosts: listing details, photos, the exact address, check-in instructions and Wi-Fi details, and payout information.
• Technical: the essential cookies that keep you signed in, and basic server logs (IP address, browser, time) used for security.

Under section 30 of the Act, we rely on these lawful bases:

• Performance of a contract — to create your account, process bookings and M-Pesa payments, issue refunds and connect guests with hosts.
• Legal obligation — to keep financial records for tax purposes and respond to lawful requests from Kenyan authorities.
• Legitimate interests — to prevent fraud, keep the community safe, review listings, and improve the service, balanced against your rights.
• Consent — for optional marketing messages. You can withdraw consent at any time; we don't send marketing in this demo.

• Your host or guest. Once a booking is confirmed, the host sees the guest's name, phone number and trip details, and the guest sees the host's contact details and the exact address. Before that, only first names, profile details and the neighbourhood are shown.
• Safaricom (M-Pesa), our payment processor, receives the phone number and amount needed to send the payment prompt and process refunds.
• Service providers who host our database, authentication and website, under contracts that require them to protect your data and use it only on our instructions.
• Authorities, when Kenyan law or a valid court order requires it.

We do not sell your personal data.

Some of our infrastructure providers store data outside Kenya. Where that happens, we rely on the safeguards set out in Part VI of the Act, such as contractual protections, and share only what is necessary.

• Account and profile data: while your account is open, and deleted or anonymised within 90 days of closing it.
• Booking and payment records: for at least five years after the stay, as Kenyan tax law requires, then deleted.
• Reviews: while the listing is live; they are anonymised if you close your account.
• Security logs: up to 90 days, unless needed to investigate an incident.

Under section 26 of the Data Protection Act, 2019 you have the right to:

• Be informed about how your data is used (this policy).
• Access the personal data we hold about you.
• Correction of data that is inaccurate or out of date — most details can be edited in your account.
• Deletion of data that is false, misleading or no longer needed.
• Object to processing based on legitimate interests or for marketing.
• Data portability — a copy of your data in a common machine-readable format.

To exercise a right, email support@flossytrukid.rytrix.co.ke from the address on your account. We'll respond within the time limits set by the Regulations, and won't charge you for reasonable requests.

If you're unhappy with how we handled your data, you can complain to the Office of the Data Protection Commissioner at odpc.go.ke. We'd appreciate the chance to put things right first.

We use essential cookies only — the authentication cookies that keep you signed in and protect your session. They're strictly necessary, so they don't need consent. We don't use advertising or cross-site tracking cookies.

• All traffic is encrypted in transit (HTTPS/TLS).
• Database access rules ensure people only see their own data; phone numbers and exact addresses are stored separately and shared only after a confirmed booking.
• Staff access is limited to what their role needs, and admin actions are restricted to verified accounts.
• If a breach puts your rights at risk, we'll notify the ODPC within 72 hours and tell you without undue delay, as the Act requires.

Flossytrukid is for adults aged 18 and over. Children can stay as guests on a booking made by an adult, but we don't knowingly create accounts for, or collect data directly from, children.

We'll update this policy when our practices change and show the new date at the top. Significant changes will be announced by email or in the app.

Data protection questions: support@flossytrukid.rytrix.co.ke · +254 700 000 000· Flossytrukid BnB (Rytrix), Nairobi, Kenya.