Privacy Policy

1. Who we are

Guri (“Guri”, “we”, “us”) operates a rental marketplace for Mogadishu where every home is represented by a verified agency. This policy explains what personal data we process and your rights over it. For data-protection questions, contact [email protected].

2. Information we collect

Account

When you create an account, our authentication provider (Clerk) processes your name, email address, and — if you use it — your Google sign-in. We store a mirrored user record keyed to your account. Your phone number is optional contact data used for calls and WhatsApp; it is never used as a login and is never verified by SMS at sign-up.

Identity documents

A photo of your national ID or passport is requested only when a deal is being closed, so the agency can verify the tenant. These documents are encrypted at rest, are never public, and are shown to authorised agency staff only through links that expire in minutes. Every time a document link is issued it is recorded in an append-only audit log.

Property & deal data

Listings, viewing requests, deal progress, leases, and agency-recorded payments. Guri does not process rent or deposits itself — payments are recorded by agencies off-platform.

Technical data

A sign-in session cookie (essential), and server logs that never contain passwords, document links, or full identity data.

3. How we use your data

• To run the service: publish listings, route your requests to the right agency, track a deal, and record leases.
• To verify identity at deal-closing and keep an accountable record of who viewed what.
• To send you deal and viewing updates through in-app notifications and WhatsApp/SMS — never marketing, and never to your email.
• To keep the platform secure, prevent fraud, and meet legal obligations.

4. Legal bases (GDPR)

Where GDPR applies we rely on: performance of a contract (running your rental), our legitimate interests (security, fraud prevention, service improvement), your consent where required, and compliance with legal obligations.

5. Who we share data with

• The agency handling your deal — sees your contact details and, at closing, your identity document, so it can verify and represent the tenancy.
• Service providers — Clerk (authentication), Cloudflare R2 (encrypted file storage), and our hosting provider, all acting on our instructions.
• Authorities where required by law.

We do not sell your personal data or share it for advertising.

6. Cookies

Guri uses only essential cookies (your sign-in session). We do not use advertising or analytics cookies. See our Cookie Policy.

7. Retention & deletion

We keep personal data only as long as needed to provide the service and meet legal record requirements. You can close your account at any time from your profile (“Leave Guri”); this deactivates your profile and schedules your personal data for deletion, except records we must retain by law and the append-only audit log required for accountability. Closing an account is blocked only while you have a live tenancy.

8. Your rights

Subject to local law you may request access to, correction of, deletion of, or a copy of your data, and may object to or restrict certain processing. To exercise any right, email [email protected] or use Contact & support. You may also complain to your local data-protection authority.

9. Security

Identity and ownership documents are encrypted at rest and served only through short-lived, access-logged links after a role check. Sessions, password hashing, and lockout are handled by our authentication provider.

10. International transfers & children

Some providers process data outside your country under appropriate safeguards. Guri is not directed to children under 18 and we do not knowingly collect their data.

11. Changes

We may update this policy; material changes will be signalled in the app. The date above shows the latest revision.