Privacy Policy

Last updated: September 4, 2026

Effective date: September 4, 2026

This Privacy Policy describes how Rex Real Estate ("Kuhlai", "we", "us", or "our") collects, uses, stores, and shares information when you use our real-estate platform accessible at kuhlai.com and any associated mobile interfaces (the "Service").

We are committed to protecting your privacy. This policy is written in plain language so you can make informed decisions about your data.

1. Information We Collect

1.1 Information you provide directly

Account registration: When you create an account, we collect your phone number (which serves as your unique identifier) and verify it via a one-time password (OTP) sent by SMS. Your name and email address are optional and can be added later through your profile settings.

Profile information: You may optionally provide a display name, email address, profile photo, and a home location (city or area description). These are used to personalise your experience and are visible to other Users only when you interact with them (e.g. sending an inquiry).

Property listings: If you are a Property Manager, you provide property details including type, price, number of rooms, description, GPS coordinates, address, contact phone number, and photographs. This information is displayed publicly as part of your listing.

Inquiries and messages: When you send a message to a Property Manager, the recipient receives your display name, phone number, and the content of your message. Messages are stored on our servers to enable the conversation feature.

Uploaded documents: You may upload documents (leases, receipts, photos) through the My Home feature. These are stored securely and are only accessible to you and, in the case of property-related documents, the property owner or assigned agent.

1.2 Information collected automatically

Device and usage information: When you use the Service, we automatically collect your IP address, browser type, device type, operating system, and the pages you visit. This information is used for security, debugging, and improving the Service.

Location data: With your permission, your device's GPS coordinates may be used to centre the explore map on your location and to calculate distances to nearby properties. This location data is processed in real time and is not stored on our servers unless you explicitly set a home location in your profile.

Cookies and similar technologies: We use only essential cookies: a session cookie (to keep you logged in) and a CSRF cookie (to protect against cross-site request forgery). We do not use advertising cookies, tracking pixels, or third-party behavioural tracking technologies.

1.3 Information from third parties

SMS delivery confirmations: Our SMS providers (MTN Cameroon, Orange Cameroon, Twilio) may report delivery status for OTP messages. This confirms whether the message reached your device but does not provide additional personal information.

Maps and location services: We use Google Maps, OpenStreetMap, and OSRM for mapping, nearby-amenity search, and route calculation. These services receive the coordinates you interact with (e.g. a property's location or your search area) but are not provided with your personal identity.

2. How We Use Your Information

We use the information we collect for the following purposes:

  • To provide the Service: Displaying listings, enabling messaging, managing your account, and facilitating contact between Users and Property Managers.
  • To verify your identity: Phone number verification during signup and KYC document review for Property Manager status.
  • To communicate with you: Sending OTP codes, push notifications for inquiries and replies, important-date reminders, and account-related announcements.
  • To improve the Service: Analysing usage patterns, debugging issues, and developing new features. We use aggregated, anonymised data for this purpose.
  • To prevent fraud and abuse: Detecting fraudulent listings, account takeovers, and violations of our Terms of Service.
  • To comply with legal obligations: Responding to lawful requests from government authorities where required by Cameroonian law.

3. How We Share Your Information

We do not sell, rent, or trade your personal information. We share information only in the following limited circumstances:

  • With other Users: When you send an inquiry, the Property Manager receives your name, phone number, and message. When you list a property, your listing information (including contact phone and property location) is visible to prospective tenants and buyers.
  • With service providers: We share data with third-party services strictly as needed to operate the Service:
    • SMS providers (MTN, Orange, Twilio) receive your phone number to deliver OTP codes.
    • Email provider (Resend) receives your email address if you enable email-based two-factor authentication.
    • Mapping services (Google Maps, Overpass API) receive coordinate data to provide map and nearby-amenity features.
    • AI assistant providers (OpenCode Zen, DeepSeek) receive your chat messages and FAQ context to generate support responses. These messages are not used to train AI models.
  • For legal compliance: We may disclose information if required by law, court order, or governmental request, or to protect the rights, property, or safety of Kuhlai, our Users, or the public.

4. Data Storage and Security

4.1 Storage location. All data is stored on secure servers hosted within the European Union. We use PostgreSQL for structured data, file storage for uploaded media, and Qdrant (self-hosted) for AI search embeddings.

4.2 Encryption. All data in transit is encrypted using TLS (HTTPS). Sensitive fields such as passwords are stored as irreversible hashes. Your phone number and KYC documents are stored with access controls that restrict who can view them.

4.3 Access controls. Access to personal data is restricted to authorised Kuhlai personnel on a need-to-know basis. Staff access is logged and auditable.

4.4 Data retention. We retain your data for as long as your account is active. When you delete your account, all associated data (listings, messages, documents, photos, push subscriptions, and verification records) is permanently deleted through cascading deletion. We do not retain backups of deleted accounts beyond what is necessary for system integrity.

5. Your Rights

You have the following rights regarding your personal data:

  • Access: You can view all your personal data at any time through your profile settings, listings page, and My Home dashboard.
  • Correction: You can update your name, email, avatar, and home location through your profile settings at any time.
  • Deletion: You can delete your account and all associated data at any time through the account settings page. Deletion is immediate and permanent.
  • Push notifications: You can disable push notifications at any time through your profile settings or your device's notification settings.
  • Data portability: You may request a copy of your personal data by contacting our support team. We will provide the data in a commonly used, machine-readable format within 30 days.
  • Objection to processing: You may object to the processing of your personal data for purposes other than those necessary to provide the Service. Contact our support team to discuss your concerns.

6. Location Privacy

6.1 Open Market listings. The exact GPS coordinates of Open Market properties are displayed on the map to help prospective tenants locate the property. By listing on the Open Market, you consent to the public display of your property's location.

6.2 Vetted Market listings. To protect agencies' proprietary listing data, Vetted Market properties are displayed with an approximate location. The map pin is placed at the nearest zone centre on a 7-kilometre grid covering Cameroon, which may be up to 3.5 km from the true property location. The exact coordinates are never sent to the client application for Vetted Market listings.

6.3 Your device location. When you use the explore map, your device's GPS coordinates may be used to centre the map and calculate distances. This data is processed locally on your device and is not transmitted to our servers. You can deny location access at any time through your browser settings without affecting your ability to use the Service.

7. Push Notifications

The Service uses Web Push notifications (via the VAPID protocol) to alert you about new messages, inquiry replies, and important-date reminders. To deliver push notifications, we store an encrypted subscription token provided by your browser's push service.

You can opt out of push notifications at any time by:

  • Toggling the "Reminders" switch in your profile settings.
  • Disabling notifications through your browser's settings for our site.
  • Removing all push subscriptions through your profile settings. Note: Property Managers who remove all push subscriptions will temporarily lose Property Manager status until at least one subscription is re-established.

8. KYC and Identity Verification

If you apply for Property Manager status, we collect and store:

  • Your full legal name and the role you are applying under (landlord, property owner, caretaker, or agent).
  • A government-issued identification document (front and back images) such as a national ID card, passport, or driver's licence.
  • A selfie photograph for identity verification.
  • For agency representatives: business registration documents, tax clearance certificates, and representative identification.

These documents are reviewed by Kuhlai staff for verification purposes only. They are stored securely with restricted access and are not shared with other Users. KYC documents are retained for as long as your Property Manager status is active, and are permanently deleted when your account is deleted.

9. Cookies

We use only two essential cookies, both set by our server:

  • sessionid — Keeps you logged in across page loads. This is a secure, HTTP-only cookie that expires when you log out or after a period of inactivity.
  • csrftoken — Protects against cross-site request forgery attacks on forms and API calls. This cookie is required for all POST requests to work.

We do not use advertising cookies, analytics cookies from third parties, or any cookies for behavioural tracking. The Google Analytics integration (if enabled) operates through a first-party script and does not set third-party cookies.

10. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will take steps to delete that information.

11. International Data Transfers

The Service is operated from Cameroon. If you access the Service from outside Cameroon, your information may be transferred to and processed in Cameroon. By using the Service, you consent to the transfer of your information to Cameroon, which may have different data-protection laws than your country of residence.

12. Third-Party Links and Services

The Service may contain links to third-party websites or services (e.g. WhatsApp, Google Maps). We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party service you access through the Service.

13. Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you promptly through the Service and, if you have provided an email address, by email. We will also comply with any applicable data-breach notification requirements under Cameroonian law.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When changes are made, the "Last updated" date at the top of this page will be revised. Material changes will be communicated through the Service or by email (if you have provided one). Your continued use of the Service after the effective date of any changes constitutes acceptance of the updated policy.

15. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, you can reach us at:

For formal privacy requests we accept correspondence by email. For anything else, use the button below for the fastest help.