✓ We do not sell your personal data. We do not use advertising cookies or third-party tracking pixels. We collect only what we need to run the platform.
Cabana ("we", "us", "our") is committed to protecting your privacy. This policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and your rights under Kenyan law and good data protection practice.
The data controller responsible for your personal information is Cabana, operating the Cabana platform, based in Nairobi, Kenya. For privacy-related matters, contact us at connect@cabana.africa.
2. Information We Collect
Information you provide directly:
Category
Examples
When Collected
Account information
Full name, email address, phone number
Registration
Public profile
Display name, @handle, headline, short bio, city and country if you choose to show them, languages, interests, your Cabana avatar, a profile photo or logo (verified members only), who you follow and who follows you
Profile studio
Identity verification
Result of an ID and liveness check run by our processor Didit: approved or declined, document type and issuing country, document expiry, and your verified first name and last initial. Cabana does not receive or keep your ID images, selfie, ID number or date of birth from this check. Agent ID uploads are stored privately.
Verification (optional for guests; required for some provider roles)
Organisation verification
Registered name, registration number, country, type, website and the registration document you upload, stored privately and seen only by Cabana’s verification team
Gold tick application
Booking information
Check-in/out dates, guest count, special requests, booking reference
When you make or receive a booking
Host / listing data
Property name, address, description, photos, pricing, availability, M-Pesa payout number
Referral codes, commission balances, referred user IDs
Agent / referral programme participation
Rewards data
Points balance, redemption history
On each qualifying booking
Information collected automatically:
Usage data: Pages visited, features used, search queries, time spent, click paths
Device & browser data: Browser type and version, operating system, screen resolution, language preferences
Network data: IP address, approximate location derived from IP (city/country level), internet service provider
Session data: Authentication tokens stored in your browser's local storage or as session cookies
Push notification tokens: Device tokens used to deliver push notifications (only if you opt in)
3. Legal Basis for Processing
We process your personal data on the following legal grounds:
Contract performance: Processing necessary to provide you with bookings, payouts, and account services you have requested
Legitimate interests: Platform security, fraud prevention, improving our services, and analytics. Provided these interests are not overridden by your rights
Legal obligation: Retaining financial records for tax and regulatory compliance under Kenyan law
Consent: Push notifications, location, and optional features. You may withdraw consent at any time in your phone or browser settings
Direct marketing to members: Members receive Cabana offers and news about our services. Every marketing email carries a one-tap unsubscribe link, and you can turn off push notifications in your phone settings at any time
4. How We Use Your Data
To create and manage your account
To process bookings and payments, and send confirmations and receipts
To connect guests with hosts and facilitate the booking relationship
To calculate and pay referral commissions and agent earnings
To manage your rewards points balance and process redemptions
To respond to customer support requests and resolve disputes
To send transactional communications (booking confirmations, check-in reminders, receipts). These cannot be opted out of while you have active bookings
To send service updates and platform announcements (you may opt out)
To improve the platform through aggregated, anonymised analytics
To detect, investigate, and prevent fraud, abuse, and security incidents
To comply with Kenyan legal and regulatory obligations
To enforce our Terms of Service
We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects without human review.
5. Payment Data
Payments are processed via M-Pesa through PayHero. We handle payment data as follows:
We do not store your M-Pesa PIN, full M-Pesa credentials, or any card details. We never see them
We store M-Pesa transaction reference numbers and payment amounts to verify and confirm bookings
We store your M-Pesa phone number (as provided on your account) solely to initiate STK Push payment requests and to pay out earnings to hosts and agents
PayHero processes the actual M-Pesa transaction; their privacy policy governs how they handle payment data
Financial records (booking amounts, platform fees, payout records) are retained for 7 years for tax and legal compliance purposes, even after account deletion
6. Data Sharing
We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances:
Hosts: When you book a property or tour, we share your name and phone number with the host to facilitate check-in and communication
Guests: When you accept a booking as a host, we share the guest's name and contact details with you
Agents: Agents can see that a referred user signed up and made bookings (without personal identifying details beyond what is necessary to verify commission eligibility)
Didit (identity verification): If you choose to verify your identity, Didit processes your ID document and a live selfie on its own secure page to confirm who you are. Didit returns only the outcome and the limited details listed above to Cabana.
Account safety (one person, one verified account): To stop banned members returning under new accounts and to keep each verified identity to one account, we keep one-way keyed fingerprints of a verified document, ID number, name with date of birth and verifying device, and one-way hashes of the phone number and email of banned accounts. They cannot be turned back into the original details. A match is reviewed by a person and never, on its own, closes an account.
Photo safety check: Profile photos and logos are checked by an automated image-safety model (through our AI providers, such as Vercel AI Gateway, Google or Groq) before they are published. Only the image is sent, never your name or account details. Photos the model is unsure about are reviewed by a Cabana moderator. Rejected images are deleted immediately; we keep only a one-way fingerprint so the same image cannot be re-uploaded.
Other members: Every Cabana profile is public, so the people you book with, host or travel alongside can see who they are dealing with. Your public profile shows only what is listed under "Public profile" above; your city appears only if you choose to show it. Hosts, agents and organisations also show a basic card (name, avatar or photo, and verification tick) on their listings. Your verification documents, ID number, legal name and contact details are never shown on any profile.
PayHero / M-Pesa: Your phone number and booking amount are shared to initiate and process payments
Supabase: Our database provider (USA/EU) stores your account and booking data under a Data Processing Agreement. Supabase is SOC 2 Type II certified.
Vercel / Netlify: Our hosting provider processes web traffic logs including IP addresses. These providers are contractually bound to data protection obligations.
Push notification services: If you opt in to push notifications, your device token is processed to deliver notifications. We use no third-party advertising networks for notifications.
Law enforcement and regulators: Where required by a court order, subpoena, or applicable Kenyan law, we may disclose personal data. We will notify you of such disclosures where legally permitted.
Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of our assets, your data may be transferred. We will notify you before such transfer and your rights under this policy will be maintained.
7. Data Retention
Account data: Retained for the duration of your active account
Booking records: Retained for 7 years after the booking date for tax and legal compliance
Financial records (platform fees, payouts): 7 years
Communications and support tickets: 3 years after closure
Usage and analytics records: Individual page views and taps are deleted after 35 days; visit records and browsing profiles after about 13 months (400 days). After that only daily totals, with no identifier, are kept
Deleted accounts: Personal data is anonymised or deleted within 30 days of account deletion, except where retention is required by law (e.g. financial records)
Marketing preferences: Retained until you opt out or delete your account
8. Security
We implement appropriate technical and organisational measures to protect your personal data, including:
All data transmitted between your browser and our servers is encrypted using HTTPS (TLS 1.2 or higher)
Database storage via Supabase with row-level security policies and encrypted storage at rest
Sensitive credentials (API keys, M-Pesa secrets) stored as server-side environment variables, never in client-side code
Passwords are hashed using bcrypt and never stored in plaintext
Access to production data is restricted to authorised personnel only
Session tokens are rotated on authentication and expire after a period of inactivity
No system is completely secure. In the event of a personal data breach that poses a risk to your rights, we will notify you promptly by email and take immediate steps to contain and remediate the breach.
9. Cookies & Tracking
We use minimal cookies necessary for the operation of the platform, and first-party analytics that never leave Cabana. We do not use advertising cookies or third-party tracking pixels. For full details, see our Cookie Policy.
In summary, we use:
Authentication cookies / local storage: Supabase session tokens to keep you logged in. These are strictly necessary and cannot be opted out of while using the Service
Preference storage: Local storage for UI preferences (dark mode, notification settings), no personal data is sent to third parties
A first-party visitor identifier: a random id kept in your browser's local storage, used for the personalisation described below
We do not use Google Analytics, Facebook Pixel, or any other third-party analytics or advertising tracking.
Personalisation and your browsing profile
To show you places that fit you, and so that APA, our assistant, does not have to ask you the same questions twice, Cabana keeps a profile of what you do on Cabana: the listings, tours, events and cars you view, save, share or start booking; what you search for (places, dates, number of guests, budget); and roughly when and on what kind of device you use Cabana. From that we work out things like the places you are interested in, the price range you usually look at and whether you are planning a trip or ready to book. Interest you have not shown for a while fades automatically.
What we use for location: the country, region and city our hosting network reports for your connection. We do not store your IP address for this, and we do not use your device's GPS for it.
Where it stays: on Cabana's own database. We do not sell it, and we do not give individual profiles to hosts, advertisers or anyone else.
Advertising: advertisers on Cabana can be shown the size and general make-up of audiences (for example "travellers interested in the coast"), never who is in them. Your profile only counts towards advertising audiences if your choices allow it; a Global Privacy Control signal from your browser turns advertising use off.
Your control: you can see what Cabana has inferred about you, erase it, or stop it being collected, at any time, with the buttons below. Browsers that send Do Not Track are not profiled at all.
Counting visits
To know how many people use Cabana, where they come from and which pages work, Cabana counts visits itself, on its own database, without any third-party analytics. For each visit we record the pages opened, the words on the buttons and links tapped (never anything you type), how long the page was in use and how far it was scrolled, how fast it loaded, the website or app that sent you (for example a search engine, WhatsApp or a campaign link), the type of device, its operating system, browser and model, your screen size and language, and the country, region and city our hosting network reports for your connection.
No IP address is stored for this, and nothing is sold or shared.
If you are signed in, the visit is linked to your account, so we know a member visited. Members of the Cabana team can see visits in the operations console.
Automated visitors (search engine and AI crawlers) are counted separately, by the name they give.
If your browser sends Do Not Track, or you press "Erase it and stop" above, each page is still counted once so our totals stay accurate, but with no identifier at all: a code that changes every day and cannot be linked to you or to your other visits. "Erase it and stop" also deletes the visits already recorded for this browser.
Retention: individual page views and taps are deleted after 35 days and visits after 400 days. Only totals per page and per day are kept after that.
10. Push Notifications
If you opt in to push notifications through your browser or our Progressive Web App:
Your browser generates a unique device push token which is stored in our database linked to your account
We use this token to send you notifications about booking confirmations, check-in reminders, and platform updates
You can opt out at any time through your browser's notification settings or your Cabana account settings
Revoking push notification permission does not delete your account or affect your bookings
We do not share push notification tokens with third-party advertising networks
11. Location Data
We do not continuously track your location. Location data is used only in the following specific contexts:
Emergency SOS: If you use the in-app Emergency SOS feature, your precise GPS location is shared with emergency services (and only when you explicitly activate this feature)
IP-based location: We derive an approximate city or country from your IP address for fraud detection and to improve search relevance. This is not precise GPS location data
Profile photos: Photos are cropped and re-encoded on your device before upload, which removes embedded location (GPS) and camera data.
"Near me" searches: If you use location-based search features, your browser may request your location. This is processed locally in your browser to return relevant results and is not stored on our servers.
12. Third-Party Links & Services
Cabana contains referral links to third-party services (rides, food, flights, shopping). When you click these links and use those services:
You will be subject to the third party's own privacy policy and terms
Cabana is not responsible for the privacy practices of third-party services
We may receive confirmation that a referral was completed (for commission purposes) without receiving your personal data from the third party
We encourage you to review the privacy policies of any third-party services you use.
13. Children's Privacy
Cabana is not intended for, and does not knowingly collect personal data from, individuals under the age of 18. If we become aware that we have collected personal data from a child under 18 without parental consent, we will delete that data promptly. If you believe a child has provided us with personal data, please contact connect@cabana.africa.
14. Your Rights
You have the following rights regarding your personal data:
Access: You can request a copy of the personal data we hold about you
Correction: You can correct inaccurate or incomplete data via your account settings, or by contacting us
Deletion: You can request deletion of your account and associated personal data. We will honour this within 30 days, subject to legal retention requirements for financial records
Restriction: You can ask us to restrict processing of your data in certain circumstances (e.g. while a dispute is under review)
Objection: You can object to processing of your data based on legitimate interests
Data portability: You can request your account data in a machine-readable format (JSON)
Withdraw consent and opt out of marketing: Where processing is based on consent (e.g. push notifications, location), you can withdraw at any time without affecting the lawfulness of prior processing. You can opt out of marketing emails with the unsubscribe link in any of them
To exercise any of these rights, email connect@cabana.africa with the subject line "Data Rights Request". We will respond within 30 days. We may need to verify your identity before processing the request.
If you are not satisfied with our response, you have the right to lodge a complaint with the relevant data protection authority in Kenya.
15. Changes to This Policy
We may update this Privacy Policy from time to time. When we do:
We will update the "Last updated" date at the top of this page
We will notify you of material changes by email at least 30 days before they take effect
For significant changes that affect how we use your data, we may ask for your renewed consent
Your continued use of the Service after the effective date of changes constitutes acceptance of the updated policy.
16. Contact & Complaints
For any privacy-related questions, requests, or concerns, reach us through any channel: