Privacy policy

1. Who this policy covers

ROJA operates the rental marketplace at roja.africa. This policy applies to visitors, tenants, landlords and administrators using our website and ROJA Android app. The Android app loads the same website and uses the same accounts and services. For privacy questions or requests, contact hello@roja.africa.

2. Information we collect

• Account and contact details: your name, email address, phone number, account role, account identifier, sign-in information and account status. Passwords are handled by our authentication service; they are not displayed to other marketplace users.
• Identity verification: your ID or passport number, the document photograph you upload, information visible on that document, and verification decisions, notes and dates.
• Property information: landlord name, location, property type, rent and deposit, availability, facilities, descriptions, photos and other details you submit, together with listing status and review history.
• Messages and support: messages between tenants and landlords, landlord messages with ROJA administrators, timestamps, read status, listing reports, explanations, moderation notes and information you send to our support email.
• Referrals: the referral code used at signup, the referring account's email, the new account's identifier and email, and the signup date.
• Access and payment-related records: trial dates, access expiry, fee exemptions, listing payment status and any verified payment reference recorded when payment services are available. Paid renewals are currently paused pending a secure payment integration; we do not collect card details through ROJA at present.
• Technical and security information: our hosting and service providers may process IP addresses, browser and device information, request logs and error diagnostics to deliver and protect the service. We also record administrators' sign-in and sign-out times.

3. How we use your information

We use information to create and secure accounts, check identities and duplicate registrations, review and publish listings, enable eligible private conversations, track referrals and access periods, respond to enquiries, investigate misleading listings and abuse, and maintain reliable service. We send account, recovery, verification, referral and listing-status emails where needed.

Where applicable law requires a legal basis, we process information to provide the service you request, meet legal obligations, protect the marketplace and its users, or with your consent when required. Identity review does not establish property ownership or guarantee the accuracy or safety of a listing.

4. What is public and who can access it

• Published listings are public: visitors can see the landlord name, property location, descriptions, photos and other published property details. Avoid including identity documents, personal contact details or information about other people in your listing photos or description. Other people may copy public information.
• Identity documents are not public: they are stored privately and used for verification by authorised staff and the verification services described below. They are not shown to tenants or other landlords.
• Property messages are restricted: the tenant and the property's landlord can access their conversation; authorised administrators also have access for support, safety and moderation. Landlord–ROJA support conversations are restricted to that landlord and administrators. Messages are not public or end-to-end encrypted.
• Referral and moderation records are staff-only: administrators can see signup emails, dates and totals attributed to each referral link, alongside reports and internal review records. Referral links do not give the referrer access to another person's account or messages.

5. Service providers and other disclosures

We use Lovable Cloud and associated providers for hosting, authentication, database storage, private file storage and service operation. Email delivery providers process recipient addresses and email contents. Our automated identity check sends your document image, entered name and ID number through Lovable's AI gateway to Google's Gemini service for examination and comparison. The result and reason are stored with your account and can affect account approval and access to protected services. You can contact ROJA to ask for staff review of an incorrect verification result.

Providers process the information needed for their services. Processing and storage may take place outside Zimbabwe, where data-protection laws may differ. We may also disclose relevant information when required by law, to respond to lawful requests, prevent fraud or harm, or protect legal rights. We do not sell your personal information.

6. Cookies, local storage and the Android app

The website and app use browser or WebView storage to maintain your signed-in session and remember referral attribution. The referral code can remain on the device so a later signup is attributed to the link you used. Clearing browser or app storage removes stored session and referral information and may sign you out; it does not delete your account or information held by ROJA.

The Android app needs internet access to load ROJA. When you choose to upload a document or property photo, the selected file is sent to ROJA. The current app does not request background location, contacts or microphone access, and does not continuously collect your device's location. Property locations come from listing information you supply.

7. Security and retention

We use encrypted connections, authenticated access and access restrictions for private records and files. Access is limited according to account role and purpose. No internet service can guarantee absolute security; keep your password and recovery links private and report suspected misuse to us.

We retain information for as long as reasonably needed to operate your account, verify identity, manage conversations and listings, handle complaints, prevent fraud and meet legal obligations. A listing's 30-day publication expiry only removes its public availability; it does not automatically delete the listing, photos, messages or review records. Hidden and removed listings may remain in internal moderation records. Some records or backups may need to be retained after an account closes for legal, security or dispute-resolution purposes.

8. Your choices and deletion requests

You can choose to browse without creating an account. Creating an account and accessing protected services requires the information needed for signup and verification. You can request access to your personal information, correction of inaccurate details, deletion of your account and associated information, or restrictions on processing, subject to applicable law.

To request account deletion or exercise these rights, email hello@roja.africa from your registered email address, with the subject “ROJA privacy request”, and describe your request. This applies to both website and Android accounts. We may need to verify your identity before acting. Do not send a password or an ID document by email unless a secure verification method is agreed. We will explain any information that must be retained and why.

9. Children and other people's information

ROJA is intended for adults entering rental arrangements, not children. If you believe a child has supplied personal information, contact us so we can investigate and take appropriate action. Only upload information and photos you have the right to share, and avoid including other people's identity documents or unnecessary personal information.

10. Changes and privacy contact

We may update this policy when our services or legal requirements change. The latest version will remain available at roja.africa/privacy, with its updated date. We will provide additional notice of material changes where required. External services and websites you open from ROJA have their own privacy policies.

For questions, concerns or requests about your information, contact the ROJA team.