Welcome to Varoom. Varoom is a property marketplace that allows hosts to list properties for renting, buying, or other permitted property-related transactions, while clients can discover properties, make bookings, communicate with hosts, and use related services.
This Privacy Policy explains what personal information we collect, why we collect it, how we use, share, and protect it, and the choices and rights you have. By creating an account or using Varoom, you acknowledge that you have read this policy.
1. Who We Are
Varoom, available at varoom.co.ke, is managed and operated by Varoom ("Varoom", "we", "us", or "our"). For the purposes of applicable data protection law, Varoom is the data controller of personal information collected through the platform.
2. Information We Collect
Depending on how you use Varoom, we may collect the following.
Information you provide
- Account details: name, email address, profile picture, and phone number if you choose to provide it
- Property listings and related information, including descriptions, photos, pricing, and availability
- Booking information and related transaction records
- Messages you send to other users and to Elie, our search assistant
- Reviews, ratings, and reports you submit
- Information you send us when you contact support
Information from Google
If you sign in with Google, we receive your name, email address, profile picture, and Google account identifier, as described in the Google Sign-In section below.
Information collected automatically
When you use Varoom we may collect technical information such as your IP address, browser and device type, pages viewed, and log data, and, if you grant permission, your device location. We use this to operate, secure, and improve the service.
3. Google Sign-In
If you choose to sign in using Google, Varoom may receive information made available through your Google account and the permissions requested during sign-in, including your name, email address, profile picture, and Google account identifier.
We use this information to create and authenticate your Varoom account, associate your Google account with your Varoom account, and provide account-related functionality.
Varoom does not sell Google user data and does not use Google user data for targeted advertising. Varoom's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4. How We Use Information
We use collected information to:
- Create and manage user accounts and authenticate users
- Allow hosts to create and manage property listings
- Allow clients to discover and interact with listings, including through Elie
- Process and manage bookings
- Facilitate communication between users
- Process or record payments and related transactions
- Display reviews and ratings
- Investigate reports, abuse, fraud, or security issues
- Provide customer support
- Improve the functionality and reliability of Varoom
- Comply with applicable legal obligations
5. Legal Bases for Processing
We process personal information only where we have a lawful basis to do so under applicable law, including the Kenya Data Protection Act, 2019. Depending on the activity, our basis is:
- Your consent, for example when you grant location permission or choose to provide an optional phone number
- Performance of a contract with you, for example creating your account and processing bookings
- Compliance with a legal obligation, for example financial record keeping
- Our legitimate interests, for example keeping Varoom secure and preventing fraud and abuse
Where we rely on consent, you can withdraw it at any time without affecting processing that already took place.
6. Elie, Our AI Search Assistant
Varoom offers Elie, an AI-powered assistant that helps clients search for properties. When you send Elie a message, its text is sent to a third-party AI provider (currently Google) to interpret your request, such as the type of property and location you want. Elie then searches Varoom listings and returns matching results.
Please do not include sensitive personal information, such as financial details or government ID numbers, in messages to Elie. Elie's responses are generated automatically and may not always be accurate, so please verify listing details before booking.
8. Payments
Varoom may use third-party payment service providers, which may include mobile money and card processors, to process payments. Payment information may be handled directly by those providers according to their own terms and privacy policies, and Varoom does not store your full card details or mobile money PIN.
Varoom may retain transaction records necessary for bookings, accounting, disputes, security, and operational purposes.
9. Messages and Communications
Varoom may store messages sent through the platform so users can access their conversations and so we can provide messaging functionality, address reports, investigate abuse, maintain security, and comply with applicable legal requirements.
We do not use private messages for advertising.
10. Property Addresses and Locations
Hosts may provide property addresses or location information when creating listings. Varoom is designed to limit how precisely a location is shown: the general area, such as neighbourhood or city, may be visible to everyone, more precise details only to users with an approved booking, and full details to the host.
If you grant location permission on your device, we may use your location to show distances to properties. We ask for permission only when a feature needs it, and you can decline or withdraw it at any time in your browser or device settings.
Maps and place search may be provided by Google Maps Platform, which may receive location-related requests made through Varoom and handles them under Google's own privacy policy.
11. Reviews and Reports
Reviews and ratings may be displayed to other users as part of Varoom's marketplace functionality.
Reports may be reviewed for safety, fraud prevention, dispute resolution, moderation, and security purposes.
13. Data Security
We take reasonable technical and organizational measures designed to protect information from unauthorized access, alteration, disclosure, or destruction, including encrypted connections, authentication and access controls, and limiting access to personal information to those who need it.
However, no online service can guarantee absolute security. If a breach affects your personal information, we will notify you and the relevant authorities as required by applicable law.
14. Data Retention
We retain information for as long as reasonably necessary to provide Varoom's services, maintain account and transaction records, resolve disputes, prevent abuse and fraud, maintain security, and comply with applicable legal obligations.
When information is no longer reasonably required, we may delete or anonymize it, subject to applicable legal and operational requirements.
15. International Transfers
Some of our service providers operate servers outside Kenya, so your information may be processed in other countries. Where the law requires, we take steps to make sure your information receives appropriate protection when it is transferred.
16. Your Choices and Rights
Under applicable law, including the Kenya Data Protection Act, 2019, you may have the right to:
- Be informed about how your personal information is used
- Request access to the personal information we hold about you
- Request correction of inaccurate or misleading information
- Request deletion of your personal information
- Object to certain processing of your personal information
- Request a copy of your data in a portable format, where applicable
- Withdraw consent you previously gave
To make a request, contact privacy@varoom.co.ke. We may need to verify your identity first, and we will respond within the timeframes required by applicable law.
You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya. We encourage you to contact us first so we can try to resolve your concern.
17. Account Deletion
You may request deletion of your Varoom account by contacting privacy@varoom.co.ke or support@varoom.co.ke.
When an account deletion request is accepted, we will take reasonable steps to delete or anonymize associated personal information, subject to information we are required or permitted to retain for legal, security, fraud-prevention, dispute-resolution, or legitimate operational purposes.
18. Children's Privacy
Varoom is not intended for children who are below the minimum age permitted to use the service under applicable law. We do not knowingly collect personal information from children in violation of applicable law.
If you believe a child has given us personal information, contact privacy@varoom.co.ke and we will take reasonable steps to delete it.
19. Third-Party Services
Varoom relies on third-party services for authentication, database and file storage, hosting, email delivery, payments, maps, AI features, analytics, and security, including providers such as Google, Supabase, Vercel, and Render. These providers process information on Varoom's behalf as necessary to provide their services and under their own privacy terms.
Varoom may contain links to other websites. We are not responsible for the privacy practices of those sites, so please review their policies.
20. Changes to This Privacy Policy
We may update this Privacy Policy as Varoom's features, services, or data practices change.
When we make changes, we will update the "Last updated" date at the top of this policy. For material changes, we may also notify you in the app or by email.
21. Contact Us
If you have questions about this Privacy Policy or how your information is handled, we are happy to help.