Privacy Policy

1. Who we are

[Registered company name], [Registered office address], Kenya, runs Upland and is the data controller for the personal data described here under Kenya's Data Protection Act, 2019 (registration [ODPC data controller registration number]). Contact us about privacy through Contact support.

2. What we collect

• Account: your name, email address, phone number (optional), password (stored only as a secure hash by our authentication provider), and account type.
• Professional profile: display name, photo, biography, areas served, languages, experience, and your agency or law-firm membership.
• Verification evidence: documents you upload to verify yourself or an organization (such as an ID, licence, or registration certificate), the checks we run on the file, and our decision and its reason.
• Listings: property details and photos, the exact location you pin, and owner-authorization evidence, which can include the registered owner's name and contact details.
• Messages and transactions: inquiries and the contact details you include, offers, requests to buy or lease, your advocate's invitation email, checklist progress and notes, and closing records.
• Reviews, reports, and support: what you write and the reference numbers we give you.
• Activity: properties you save or view while signed in, notifications, your acceptance of these documents, and short-lived counters we use to prevent abuse.

We do not use advertising or analytics trackers. If you use “near me” on the map, your browser shares your location for that search only; we do not store it.

3. Why we use it

• To provide Upland (performing our contract with you): your account, listings, messages, offers, transactions, and reviews.
• To keep Upland trustworthy and safe (our legitimate interests, and yours): reviewing listings and professionals, checking uploaded files, preventing fraud and abuse, and handling reports.
• To meet legal obligations: for example keeping transaction records and answering lawful requests.
• With your consent, where we ask for it. You can withdraw consent at any time without affecting earlier processing.

4. Who sees it

• The public sees listings (with an approximate area within about a kilometre, never the exact pin), professional and organization profiles, and reviews, which are shown as “Upland user” without your name.
• The people you deal with see what they need: an inquiry goes to its recipient; offer and transaction details go to the buyer, the seller side, and the buyer's advocate.
• A buyer whose request the seller accepts, and the advocate that buyer appoints, can open the listing's owner-authorization evidence (the signed mandate, the title copy, the search certificate, and the registered owner's name and contact details) for due diligence. Access ends if the transaction is cancelled, and 90 days after it completes.
• Our team sees what it needs to review listings, verification, reports, and support requests.
• Service providers process data for us under contract: Supabase (database, sign-in, and file storage), our website hosting provider, our email delivery provider for account emails, and Google Maps Platform (maps, place search, and turning a listing pin into an address — Google receives the map area, search text, or pin you use).
• Authorities when the law requires it.

We do not sell personal data.

5. Where it is stored

Our database is hosted in [Supabase project region], and some providers above may process data outside Kenya. Where that happens we rely on the safeguards the Data Protection Act requires, such as contractual protections and providers with adequate security.

6. How long we keep it

• Your account and private profile data: while your account is open. When you delete it, access ends at once and the data is erased within 30 days.
• Notifications: 90 days after you read them, or 12 months if unread.
• Inquiries and messages: 24 months after the last activity, then removed or de-identified.
• Verification and listing evidence: while the decision is current and for 90 days after a final rejection, withdrawal, or the listing closing. Files that fail our safety checks are deleted after 90 days.
• Reports, moderation, support, and privacy-request records: 3 years after they are closed.
• Transaction and sale records: 7 years after closing, cancellation, or expiry, because they may be needed for contract claims.
• Abuse-prevention counters: about one hour to one day.

A specific record may be kept longer only while a legal hold covering it is in place, for example during a dispute. After you delete your account, shared records such as a closed transaction keep only a non-identifying reference to you.

7. Your rights

Under the Data Protection Act you can:

• Access and take a copy of your data: download an encrypted export from your account settings. We respond to other access requests within 7 days, and to portability requests within 30.
• Correct your details in your account, or ask us to; we respond within 14 days.
• Delete your account from your account settings. We decide other erasure requests within 14 days and complete accepted ones within 30.
• Object to or restrict some processing; we respond within 14 days.
• Complain to the Office of the Data Protection Commissioner (odpc.go.ke) if you are unhappy with how we handle your data.

To use a right that your account settings don't cover, or if you cannot sign in, contact support.

8. Security

Access to data is enforced by our database for every request, private files are never public and open only through short-lived links for people entitled to them, uploads are checked before anyone can open them, and connections are encrypted. No system is perfectly secure; if a breach affects you, we will tell you and the Data Commissioner as the law requires.

9. Cookies and browser storage

We use cookies only to keep you signed in, and your browser's session storage briefly to finish something you started before signing in, such as a report. We use no advertising or tracking cookies.

10. Children

Upland is for adults. We do not knowingly collect data from anyone under 18.

11. Changes

We will publish any change as a new, dated version and ask you to accept it when you next sign in.