Who we are
TuuraHub (“TuuraHub”, “we”, “us”) is a property rental platform operated by Rootless Technologies Limited, a company registered in Uganda. When you use TuuraHub — whether as a renter browsing listings, a landlord managing units, or a tenant paying rent through a landlord's account — Rootless Technologies Limited is the controller of your personal data.
For data-protection enquiries, contact us at [email protected]. Our office is at 9HHX+FHC, Kisaasi - Kyanja Rd, Kampala, Uganda.
Scope of this policy
This policy applies to tuurahub.com, the TuuraHub web application, and any TuuraHub-branded surfaces you reach from there. It does not cover third-party sites we link to, or the internal practices of landlords who use TuuraHub to manage their own properties — landlords are independent controllers of the tenant data they record (see Section 7).
What we collect, and why
We try to collect as little as possible. Concretely:
Information you give us
- Account details — your name, email address, phone number (optional), and a hashed password if you sign up with email/password. Used to authenticate you and contact you about your account.
- Organisation details (landlords) — your business name, country, currency, and (optionally) a logo and branding colour. Used to scope your data and brand outgoing receipts/invoices.
- Property and unit information (landlords) — addresses, photos, descriptions, rent amounts. Used to power listings, applications, and your dashboard. Public listings appear on tuurahub.com/find.
- Tenant and lease records (landlords) — names, contact details, lease terms, rent ledger, payment proofs your landlord uploads on your behalf. Used to operate the landlord's tenancy.
- Application data (renters) — what you submit when you apply for a unit (name, contact, employment summary, any attachments you upload). Shared only with the landlord of the unit you applied for.
- Maintenance tickets and messages — content of any tickets, comments, or notes you record in the platform.
- Payment records — amount, currency, date, and the method (mobile money, bank transfer, cash) recorded by your landlord. We do not currently process card payments ourselves.
Information collected automatically
- Authentication and session cookies — required to keep you signed in. Strictly necessary; cannot be disabled.
- Display preference cookie (
display_currency) — remembers the currency you chose to view prices in on /find. 90-day expiry, no tracking purpose. - Server logs — IP address, request path, user agent, timestamp. Retained 30 days for security, abuse prevention, and debugging.
- Approximate location — only when you type a place name into the search box; we resolve it to latitude/longitude server-side. We do not use your device GPS and do not store the searches you make.
We do not run third-party advertising trackers, fingerprinting scripts, or analytics that profile individuals.
Legal bases (Uganda DPPA 2019)
Under Uganda's Data Protection and Privacy Act, 2019 we process personal data on the following bases:
- Performance of a contract — to operate your account, run your applications, and deliver landlord services you signed up for.
- Consent — for any optional features you explicitly opt into (e.g. marketing email, if/when offered). You can withdraw consent at any time.
- Legal obligation — to keep records required by Ugandan tax, anti-money-laundering, or company law.
- Legitimate interests — to keep the service secure (rate limiting, abuse detection), to prevent fraud, and to improve the product. We weigh this against your rights and never use it to override an objection.
Who we share data with
We do not sell your personal data. We share it only with the following categories of recipients, and only as necessary:
Landlords and tenants
If you apply for a unit, your application is shared with the landlord of that unit. If you are a tenant, your lease and payment records are visible to your landlord and any of their staff with the appropriate role.
Sub-processors we use
These are third-party services that process data on our behalf, under contractual confidentiality and security obligations:
- Database hosting — Self-managed PostgreSQL
- File storage — Third-party Storage providers as used by NITA with caching. (for property photos, application attachments, branding logos).
- Email delivery — Resend, used to send magic sign-in links, password resets, and transactional notifications.
- Maps and geocoding — Google Maps Platform (for landlord pin-drop in the property form) and OpenStreetMap Nominatim (for the renter search-by-area on /find, accessed via our server-side proxy).
- FX rate data — open.er-api.com, used to show indicative price conversions on /find. Only currency codes are sent; nothing identifying.
- Sign-in providers (optional) — Google OAuth, if you choose to sign in with Google.
Legal disclosures
We may disclose personal data when required by Ugandan law, valid court order, or regulatory authority. We will narrow the scope of any disclosure as far as the law permits and notify you unless legally barred from doing so.
International transfers
Some of our sub-processors are based outside Uganda. Where data leaves the country, we rely on the recipient's adequacy status, contractual safeguards, or your explicit consent — as required under Section 19 of the DPPA 2019.
Landlords as independent controllers
When a landlord uses TuuraHub to manage their own tenants, the landlord — not TuuraHub — decides what tenant data to record and for how long. In that relationship, we act as a data processor on the landlord's behalf. If you are a tenant and want a copy of, or correction to, the records your landlord holds about you, please contact your landlord first. If they do not respond, you may contact us at [email protected] and we will help where we can.
How long we keep your data
- Active accounts — for as long as the account is open.
- Closed accounts — most personal data is deleted within 90 days of account closure. Records we are legally required to retain (e.g. tax-relevant invoices) are retained for the statutory period and then deleted.
- Server logs — 30 days.
- Backups — encrypted backups roll off on a 35-day cycle. A deletion request applied to live data will propagate to backups within that window.
Your rights
Under the DPPA 2019 you have the right to:
- Access the personal data we hold about you.
- Have inaccurate data corrected.
- Have your data erased, where there is no overriding legal reason to keep it.
- Object to processing based on legitimate interests.
- Withdraw consent for any consent-based processing.
- Receive your data in a portable format (CSV/JSON, where technically feasible).
- Lodge a complaint with the Personal Data Protection Office of Uganda (PDPO) if you believe we have mishandled your data.
To exercise any of these rights, email [email protected]. We will respond within 30 days. We may need to verify your identity before acting on requests that concern personal data.
Security
We use industry-standard practices: encryption in transit (TLS), encryption at rest for the database and file storage, hashed passwords, role-based access inside the application, audit logging on sensitive actions, and least-privilege access for engineering staff. No system is bullet-proof — if a breach affects your data, we will notify you and the relevant authority as required by the DPPA 2019.
Children
TuuraHub is not directed at children under 18. We do not knowingly collect data from minors. If you believe a child has created an account, contact us and we will remove it.
Changes to this policy
We may update this policy as the product evolves. Material changes will be announced via email to account holders and a banner on the dashboard at least 14 days before they take effect. The current version is always available at tuurahub.com/privacy.
Contact
Postal address
Rootless Technologies Limited
9HHX+FHC, Kisaasi - Kyanja Rd, Kampala, Uganda
Privacy enquiries
General contact