Who we are
Tezeka is a property management platform built for Zambian landlords. We are incorporated in Zambia and operate under the Data Protection Act 2021 and applicable subsidiary legislation. For privacy questions: support@tezeka.com
What we collect
We collect information you provide directly when creating an account, adding properties, onboarding tenants or contacting us: - Account: name, phone number, email address. - Property: address, type (residential, farm, commercial, apartment), photos and condition records. - Tenant: name, phone, NRC number or passport identifier, contact details. - Payment evidence: WhatsApp screenshots, MoMo reference numbers, bank confirmation images submitted for verification. - Agreement data: signed lease PDFs, signing timestamps, IP address of the signing device. - Tax and maintenance records: costs, dates and vendors.
Sensitive data
NRC numbers and passport identifiers are sensitive personal data under Zambian law. We encrypt these fields using AES-256-GCM before storage. The encryption key is never stored alongside the data. EXIF metadata, which may include GPS location data, is stripped from all uploaded photos and screenshots before storage.
How we use your data
We use your data to: - Provide, operate and improve the Tezeka platform. - Generate and deliver lease agreements and payment receipts. - Send rent reminders and portfolio summaries via WhatsApp or SMS. To stop WhatsApp messages from Tezeka, send STOP to our WhatsApp number, and START to turn them back on. Notices that matter, such as a lease waiting for your signature, then come by SMS or email instead. - Compute ZRA monthly tax estimates and produce downloadable returns. - Detect fraud, enforce rate limits and maintain security. - Comply with Zambian legal obligations. We do not sell your data. We do not use your data to train machine learning models without your explicit consent.
Third-party services
We work with a small number of service providers ("data processors") who process information on our behalf, only on our instructions and under appropriate confidentiality and security terms: - Supabase: database and authentication. - Cloudflare R2: storage for every file you upload: property images, signed PDFs, payment evidence, condition photos and Vault documents. The bucket is private; files are served only through short-lived signed links. - Vercel: hosting and content delivery. - Upstash: caching and rate limiting. - WhatsApp Business API (Meta) and Africa's Talking: delivering your notifications and receipts. - Resend: sending transactional email such as confirmations, receipts and security alerts. - Anthropic and OpenAI: the AI processing described below. - Perplexity: looking up published market rent information when you ask for a rent suggestion. - Sentry: error monitoring, so we can keep the service reliable. Screen recordings of a session are masked, and are kept only for the moments before an error unless you allow recordings in Cookie settings. - PostHog: product analytics, hosted in the European Union, only when you allow it. - DPO Pay: taking payment for your Tezeka subscription. Card and mobile money details are entered with DPO Pay, not with Tezeka. - Mapbox: the maps on property pages. Showing a map sends Mapbox the area being viewed and your device's network address. Which AI provider sees what. We use both Anthropic and OpenAI, and which one handles a task depends on the task, not on one being a backup for the other: - Payment evidence you submit for verification — screenshots and photographs of receipts and transfers — is read by OpenAI. A cheaper model reads it first, and a stronger one is used only when the first is unsure or flags a possible alteration. - Incoming WhatsApp messages are classified by OpenAI to work out what is being asked. - Agreement text formatting, tax report drafting and portfolio summaries are handled by Anthropic. - Each of the two also acts as the other's fallback when the primary provider is unavailable, so a task may occasionally be completed by the other provider. For custom agreements, Tezeka extracts the text layer on its own server and sends immutable text blocks for presentation classification. The uploaded PDF itself is not sent to any AI provider. Data sent to an AI provider is used only for the requested processing, and neither we nor they use it to train models. We do not sell or rent your personal information, and we share only what a provider needs to perform its task.
International data transfers
Some of our processors store or process data outside Zambia. Our database, file storage, hosting, caching, email, analytics, error-monitoring and AI providers operate data centres outside Zambia, principally in the European Union and the United States. Where data is transferred across borders, we rely on those providers' contractual and technical safeguards to maintain a comparable level of protection, consistent with the Data Protection Act 2021. Sensitive identifiers (NRC and passport numbers) are encrypted with AES-256-GCM before they are stored on any infrastructure, in or outside Zambia.
Data retention
We retain your data while your Tezeka account exists, including while a cancelled subscription is in a read-only state. This keeps your data, agreements and payment records accessible and allows them to be restored if you resubscribe. We retain personal data only for as long as it is reasonably necessary to provide the service, meet legal or contractual obligations, resolve disputes, prevent fraud and maintain security and audit records. You can request closure of your account at any time, either from Settings → Data & privacy inside Tezeka, or by emailing support@tezeka.com. What happens when you request deletion: - You confirm by typing your account email, and if two-factor authentication is switched on you verify it. This is to make sure the request is really from you. - We email you a confirmation naming the date we must respond by. Keep it — it is your record that you asked, and when. - Your subscription auto-renewal is switched off straight away, so you are not charged again while the request is being reviewed. - Nothing is deleted at that moment. Your records stay accessible so you can still export anything you need. - A person reviews the request. We then delete or anonymise the data we are not required to keep, and respond within 30 days. - Records we must keep for legal, contractual, tax, fraud-prevention or dispute reasons are restricted rather than deleted, and kept only for the applicable retention period. What happens to tenant records. Tenant details, leases, payment history, deposit settlements and maintenance records live inside the landlord account that created them. When that account is closed, those records are deleted or anonymised with it, apart from anything we are legally required to keep. If you are a tenant and want to know what is held about you, or want a copy before it goes, email support@tezeka.com — do not rely on your landlord's account remaining open. The Vault. Documents you place in the Vault are deleted with the account like everything else. While the account is open, no automated process reads Vault contents — only you, through explicit access that is logged.
Your rights
Under the Data Protection Act 2021, you have the right to: - Access the personal data we hold about you. - Correct inaccurate data. - Request deletion of data that is no longer necessary. - Object to processing based on legitimate interests. - Data portability: receive your data in a structured, machine-readable format. Account closure and a copy of your data can both be requested from Settings → Data & privacy inside Tezeka. For any other right, email support@tezeka.com with the subject line "Data rights request". Either way we will respond within 30 days.
Security
Security is built into Tezeka from the ground up, not bolted on afterwards: - Sensitive identifiers such as NRC and passport numbers are encrypted with AES-256-GCM before they are ever written to the database, and the keys are never stored alongside the data. - Strict row-level isolation means each landlord, agent and tenant can only ever reach the records they are authorised to see — one account can never read another's data. - Photos and screenshots are stripped of EXIF and GPS location data before storage, so a property's location is never leaked. - Every signed lease carries a SHA-256 document hash and a verification QR code, so any document can be proven authentic and unaltered. - All data in transit is encrypted with TLS, sensitive actions are rate-limited, and privileged access is tightly restricted behind multi-factor authentication. - Uploaded files are stored in a private bucket and are never publicly addressable; each view is served through a short-lived signed link. We review dependencies for known vulnerabilities as part of our release process. No system is perfectly secure, and we do not claim otherwise — if you believe you have found a weakness, email support@tezeka.com and we will look at it.
Children
Tezeka is built for landlords, agents and businesses. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with data, contact us and we will delete it.
Changes to this policy
We may update this policy to reflect changes in the law or our practices. If we make material changes, we will notify you by email or in-app notification at least 14 days before the change takes effect. Continued use of Tezeka after that date constitutes acceptance of the updated policy.
Data rights
Questions about your data?
Email support@tezeka.com with the subject “Data rights request”. We respond within 30 days.
Help centre
Have questions about Tezeka?
Visit our FAQ page for answers about payments, leases, security, data handling and plan features.