Privacy Policy

VillaCaps Ltd (“VillaCaps”, “we”, “us”) is a Rwandan company that provides a property-management platform at app.villacaps.com. Landlords and property managers use it to manage properties, units, tenants, leases, rent collection, and maintenance. Tenants and vendors use connected portals to pay, sign, and communicate. For the purposes of Law N° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy in Rwanda, VillaCaps is the data controller for account and platform data, and acts as a data processor for the tenant and property data that landlords enter into the platform. You can reach us at hello@villacaps.com.

• Account data — names, email addresses, phone numbers, and passwords (stored only as cryptographic hashes) for landlords, team members, tenants, and vendors.
• Property and tenancy data — properties, units, rent amounts, lease terms, tenant records, and tenancy history that landlords enter.
• Documents — lease contracts and signature records (signer name and timestamp), and payment-proof images or PDFs uploaded by tenants.
• Payment records — charge amounts, due dates, statuses, payment references, and methods. We do not collect or store mobile-money PINs, card numbers, or bank credentials — tenants pay landlords directly.
• Communications — messages sent through the platform, and delivery logs of SMS and email notifications we send on landlords’ behalf.
• Usage data — basic technical logs needed to operate and secure the service.

• Provide the platform: manage properties, leases, charges, payments, and maintenance.
• Send transactional notifications landlords ask us to send (rent reminders, invite links, lease signing links, payment confirmations) by SMS and email.
• Facilitate e-signatures of leases through our signing provider.
• Operate, secure, and improve the service, and provide support.
• Meet legal obligations (for example, accounting records).

• We never sell personal data or use it for advertising.
• We never hold rent money. Rent is paid by tenants directly to landlords (mobile money, bank transfer, or cash); VillaCaps records and reconciles those payments but is never in the flow of funds.
• We do not make automated decisions that produce legal effects about tenants.

We use a small number of subprocessors, each under contract and limited to the data it needs:

• Supabase — database, authentication, and file storage (cloud-hosted).
• Netlify — application hosting and delivery.
• Twilio — SMS delivery (receives phone numbers and message content).
• Resend — email delivery (receives email addresses and message content).
• BoldSign — e-signature services for leases (receives signer name, email, and the signed document). BoldSign processes data in its own data centers, which may be outside Rwanda; using the e-signature feature involves this cross-border transfer, which we limit to what the signature requires.
• Mobile-money operators (MTN, Airtel) — process payments tenants initiate directly; their own privacy policies apply to those transactions.

Landlords control the tenant data they enter and the notifications they ask us to send. By using VillaCaps, landlords confirm they have a lawful basis to collect tenants’ personal data and to contact tenants by SMS and email for tenancy-related purposes, and that they will respond to tenants’ questions about their data.

We keep account and platform data for as long as the account is active and for a reasonable period afterwards to meet legal, accounting, and dispute-resolution needs. Landlords can delete records in the app at any time; tenants can ask their landlord (or us) to delete their data. When data is no longer needed, we delete or anonymize it.

We protect data with encryption in transit, hashed passwords, strict access controls, and row-level isolation so each organization only ever sees its own data. No method of storage or transmission is perfectly secure; if we become aware of a breach that affects you, we will notify you and the relevant authority as the law requires.

Under Rwandan law (N° 058/2021) you have the right to:

• Access the personal data we hold about you and receive a copy.
• Ask us to correct inaccurate data.
• Ask us to delete your data, where we have no legal duty to keep it.
• Object to or restrict certain processing, and withdraw consent where processing is based on it.
• Lodge a complaint with the National Cyber Security Authority (NCSA), Rwanda’s data protection supervisory authority.

To exercise any of these, email hello@villacaps.com. Tenants can also contact their landlord directly, since the landlord controls most tenancy data.

We use only strictly-necessary cookies: the session cookies that keep you signed in and remember basic preferences. We do not use advertising or analytics trackers.

VillaCaps is a business service for adults. We do not knowingly collect data from anyone under 18.

If we make material changes, we will update the date above and, where appropriate, notify account holders by email or in the app. The current version is always at app.villacaps.com/privacy.