1. Scope and Applicability

This Policy applies to personal data collected through our websites, mobile apps, APIs, and other services (collectively, the "Services"). It is intended to be global: where local law requires additional protections or disclosures (for example, GDPR in the EU, Kenya Data Protection Act, or CCPA in California), those local rules apply in addition to this Policy.

2. Information We Collect

We collect information you provide directly and information collected automatically when you use the Services.

2.1 Information you provide

• Contact details: name, email, phone number.
• Account and profile: username, password (hashed), profile photo, company details.
• Listing data: property address, photos, descriptions, ownership documents you upload.
• Communications: messages, inquiries, support tickets.
• Payment and billing: billing address, transaction records (payment card data is processed by third‑party providers and not stored by us unless explicitly stated).

2.2 Information collected automatically

• Usage data: pages visited, search queries, clicks, session duration.
• Device and technical data: IP address, browser type, operating system, device identifiers.
• Location data: approximate location derived from IP or device settings (with consent where required).
• Cookies and similar technologies: see Cookies section below.

3. How We Use Personal Data

We use personal data to provide, operate, secure and improve the Services, and to communicate with you. Typical uses include:

• Providing and personalizing the Services and search results.
• Verifying identity and listings (KYC, ownership checks).
• Processing payments, refunds, and managing escrow (if offered).
• Detecting and preventing fraud, abuse, and security incidents.
• Customer support and dispute resolution.
• With your separate opt-in, sending occasional company news, recommendations, and special offers by email. Submitting an inquiry alone does not subscribe you. You may withdraw consent by contacting us using the details in the Contact section.
• Complying with legal obligations and enforcing our Terms of Service.

4. Legal Bases for Processing (Global)

Where applicable (for example under GDPR), we rely on one or more lawful bases to process personal data:

• Contract: processing necessary to perform a contract with you.
• Legal obligation: processing necessary to comply with laws and regulatory requests.
• Legitimate interests: to operate, secure and improve the Services, prevent fraud, and protect rights (balanced against your rights).
• Consent: where required (for example, certain cookies or marketing communications).

5. Kenya DPA, GDPR, CCPA and Other Local Rights

We aim to comply with applicable data protection laws. Examples of rights you may have depending on your location:

• Kenya: rights under the Kenya Data Protection Act, 2019 (access, correction, deletion, objection, data portability).
• EU/EEA (GDPR): rights to access, rectify, erase, restrict processing, object, and data portability; right to withdraw consent; right to lodge a complaint with a supervisory authority.
• California (CCPA/CPRA): rights to know, access, delete, and opt out of sale/sharing of personal information; right to non‑discrimination for exercising rights.

To exercise your rights, contact us at hello@leafleft.com. We will verify requests and respond within applicable statutory timeframes.

6. Cookies and Tracking Technologies

We use cookies, web beacons, local storage, and similar technologies. On first visit you will be presented with a cookie consent banner allowing you to accept or manage preferences for essential, analytics, and marketing cookies. You can change cookie settings via your browser or our cookie preference center.

Cookie categories: essential (required for site functionality); analytics (performance measurement); marketing (personalized ads).

7. Verification, KYC and Listing Accuracy

Because we operate a property marketplace, we may require identity and ownership verification for users listing properties or completing transactions. By using the Services you consent to provide documents and information necessary for verification. Sellers are responsible for the accuracy of their listings; we may remove or suspend listings that appear fraudulent or misleading.

8. Payments, Escrow and Refunds

Payments are processed by third‑party payment providers. If we offer an escrow service, funds will be held in escrow until agreed conditions are met. Refunds and chargebacks are governed by the payment provider's policies and these Terms. Any fees, commissions, or service charges will be disclosed at checkout.

9. Sharing and Disclosure

We do not sell personal information. We may share personal data in limited circumstances:

• With other users when you publish listing contact details.
• With service providers who perform services on our behalf (hosting, analytics, payment processors, identity verification).
• With law enforcement, regulators, or other parties when required by law or to protect rights and safety.
• In connection with a merger, acquisition, or sale of assets (we will notify affected users where required by law).

10. International Transfers and Safeguards

We operate globally and may transfer personal data to countries with different data protection laws. When we transfer data internationally we implement appropriate safeguards such as:

• Standard contractual clauses or other lawful transfer mechanisms where required.
• Contractual commitments with processors to protect personal data.
• Technical and organizational measures to secure data in transit and at rest.

11. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. Retention periods are determined by the nature of the information, the purposes for which it was collected, and applicable law.

If you would like information about how long we retain a specific category of personal data or wish to request deletion, please contact us at hello@leafleft.com. We will verify requests and respond in accordance with applicable law.

12. Security

We implement reasonable technical and organizational measures to protect personal information from unauthorized access, disclosure, alteration, and destruction. These measures include encryption in transit (TLS), access controls, monitoring, and regular security reviews. No system is completely secure; if you suspect a breach contact us immediately.

13. Children

Our Services are not directed to children under the minimum age in your jurisdiction (commonly 13). We do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us and we will take steps to delete it.

14. Fraud, Abuse and Takedown

Report suspected fraud, illegal content, or IP infringement to hello@leafleft.com. We will investigate and may remove content or suspend accounts pending investigation. We may disclose information to law enforcement when required by law.

15. Changes to This Policy

We may update this Policy from time to time. When we make material changes we will post the updated Policy with a new effective date and, where appropriate, provide additional notice. Continued use of the Services after changes means you accept the updated Policy.

16. Contact and Data Protection Officer

If you have questions, requests, or concerns about this Policy or our data practices, contact:

LeafLeft
Email: hello@leafleft.com