Last updated 28 September 2026
This policy explains what personal data Ovehla collects through the Ovehla app and website, why, and your rights. Ovehla is the controller (the "data controller" or "responsible party") of that data. It is written for the EU/UK GDPR, the Kenya Data Protection Act 2019, the Uganda Data Protection and Privacy Act 2019, the Nigeria Data Protection Act 2023 and South Africa's POPIA.
1. What we collect
- Account: name, email, password (stored only as a secure hash by our sign-in service), and, if you choose, phone number and photo. If you sign in with Google we receive your name, email and profile picture from Google.
- Owner profile: display name, owner type, bio, phone, WhatsApp, email, country, city, area, address and map location, viewing hours. This is shown publicly next to your listings.
- Listings: text, price, photos and the property's location, shown publicly once approved.
- Identity verification (owners who choose it): photos of your identity document and a live selfie. These are sensitive and are only seen by you and our verification team.
- Activity: saved places, searches on your device, messages, booking and viewing requests, reviews, reports, support chats and notifications.
- Payments (owners): plan or fee, amount, currency, status and a payment reference. Card and mobile-money details go to the payment provider, not to us.
- Location: the country your connection comes from (worked out from your IP address, not stored in your account); your precise device location only if you allow it, used to pick your country, show distances and "Near me" results. We don't store your precise location in your account unless you save it as an owner or listing location.
- Device and technical data: IP address, browser or device type, app version, timestamps and error logs, and a push-notification token in the app.
2. Why we use it and our legal basis
| Purpose | Legal basis |
|---|---|
| Create and run your account, show listings, deliver messages, bookings and notifications | Performance of our contract with you |
| Publish owner profiles and listings | Contract; your choice to publish |
| Identity verification (ID + selfie) | Your explicit consent (withdraw it via Contact support); fraud prevention, security and legal obligations (records are kept for 90 days after an account is deleted) |
| Take owner payments and keep financial records | Contract; legal obligation (tax and accounting) |
| Review listings, handle reports, prevent fraud and abuse, keep Ovehla secure | Legitimate interests in a safe marketplace; legal obligation |
| Precise location, preference storage on your device, analytics (if ever added) | Your consent (browser prompt / cookie settings) |
| Service messages (e.g. listing approved, booking confirmed, support replies) | Contract; legitimate interests |
| Improve Ovehla using aggregated statistics | Legitimate interests |
| Respond to legal requests and enforce our terms | Legal obligation; legitimate interests |
We don't sell your personal data, and we don't use it for third-party advertising. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects: listing approvals, verification and account actions are made by people.
3. Who can see your data
- The public: your owner profile, listings and reviews you write (shown with your first name and initial).
- The other person in a conversation or booking: your name and the messages and details you send.
- Ovehla staff: only what they need for support, moderation, verification and payments, under confidentiality.
- Service providers who process data for us under contract and our instructions: cloud database, authentication and file storage; website hosting and content delivery; a licensed payment service provider; email and push-notification delivery; map tiles; and a public exchange-rate feed (which receives only your IP address, like any website request). Google, if you choose Google sign-in.
- Authorities, courts or others where the law requires it, or to protect people from fraud or harm.
- A buyer or successor if Ovehla is reorganised or sold, under this policy.
4. Where your data is stored (international transfers)
Our main database and files are stored in the United Kingdom (London). Some providers (for example website hosting, content delivery and the payment provider) may process data in other countries, including the EU, the United States and African countries.
The UK is recognised by the EU as providing adequate protection. When data leaves Kenya, Uganda, Nigeria, South Africa or the EU/UK, we rely on the safeguards those laws allow: adequacy decisions, standard contractual clauses or equivalent contract terms with our providers, and, where needed, the transfer being necessary to provide the service you asked for. You can ask us for details of these safeguards.
5. How long we keep it
| Data | Kept |
|---|---|
| Account, owner profile, saved places, notifications | While your account is open. When you delete your account, it is deactivated at once and permanently deleted after 90 days |
| Listings and photos | Until you delete them. When you delete your account, they leave public view at once and are permanently deleted after 90 days |
| Messages and bookings | As long as the conversation is needed by the other person, for safety and to resolve disputes |
| Identity verification records (ID documents and selfies) | Kept for 90 days after you delete your account, for security, fraud prevention and legal reasons, then permanently deleted. Only our verification team can open them |
| Payment records | Up to 7 years for tax and accounting law |
| Reports and moderation records | As long as needed for safety and legal claims, reviewed at least every 2 years |
| Server and security logs | Usually up to 90 days |
| Backups | Overwritten on a rolling basis |
6. Your rights
Depending on where you live, you have the right to: be informed; access your data and get a copy; correct it; delete it; restrict or object to processing (including to direct marketing); data portability; withdraw consent at any time (without affecting earlier processing); and not be subject to solely automated decisions.
Most of this you can do yourself: edit your profile, delete listings, turn notifications off, change cookie settings, or delete your account (My profile → Delete account, or /account/delete on the web). For anything else, use Menu → Contact support (in the app or on this website). We answer within 30 days (sooner where the law requires) and may need to confirm your identity first.
You can also complain to your data protection authority: the Office of the Data Protection Commissioner (Kenya), the Personal Data Protection Office (Uganda), the Nigeria Data Protection Commission, the Information Regulator (South Africa), the ICO (UK) or your local supervisory authority (EU). We'd appreciate the chance to help first.
7. Security
Data is encrypted in transit (HTTPS) and at rest by our hosting provider. Access is limited by strict database permissions; identity documents sit in a private store that only you and the verification team can open. No system is perfectly secure: if a breach affects your data in a way that puts you at risk, we will tell you and the relevant regulator as the law requires (for example within 72 hours under GDPR, Kenya's DPA and Nigeria's NDPA).
8. Children
Ovehla is for adults (18+). We don't knowingly collect data from children. If you think a child has an account, contact us and we will delete it.
9. Cookies and device storage
We use essential storage to keep you signed in and the site secure, and, only with your consent, preference storage. See the Cookie Policy for the full list and to change your choice.
10. Changes and contact
We may update this policy and will tell you in the app or by notification if the change is significant. The date at the top shows the latest version.
Data protection questions, requests or complaints: use Menu → Contact support (in the app or on this website).