Hostiko (hostiko.co.ke) is committed to protecting your privacy. This policy explains how we collect and use your personal information.

1. Information We Collect

We collect your name, email address, Kenyan phone number (for M-Pesa payments), and billing information when you register or purchase services. We also collect server logs, IP addresses, and usage data for security and performance purposes.

2. How We Use Your Information

Your information is used to provide and improve our services, process M-Pesa payments via KopoKopo, send service notifications and invoices, and provide customer support. We do not sell your personal information to third parties.

3. M-Pesa Payments

Payment processing is handled by KopoKopo (Safaricom M-Pesa partner). Your M-Pesa transaction data is processed by KopoKopo under their own privacy policy. Hostiko stores only transaction confirmation references.

4. Cookies & Analytics

We use session cookies to keep you signed in to the client portal, and a small number of preference cookies (for example your theme and currency choice). Disabling cookies is possible in your browser but will break portal functionality.

We also use two analytics services to understand how the site is used and to find problems:

Google Analytics 4 — page views and traffic sources. Your IP address is anonymised before it reaches Google.
Microsoft Clarity — aggregated heatmaps and session recordings of how pages are used, which we use to fix confusing or broken pages. When you are signed in, your account ID is attached to the recording so we can reproduce a fault you report to us.

These are analytics cookies, not advertising cookies: we do not run ad networks, we do not build advertising profiles, and we do not sell or share your data with advertisers. Your passwords and payment details are never captured — card and M-Pesa entry happens on the provider's own pages, and sensitive fields are masked in recordings.

You can opt out at any time: use your browser's “Do Not Track” or an ad/analytics blocker, or install the Google Analytics opt-out add-on. You may also email us and we will exclude your account from session recording.

5. Data Security

All data is transmitted over HTTPS (SSL/TLS). Passwords are hashed using bcrypt. We follow industry security standards to protect your account data.

6. Data Retention

We retain account data for as long as your account is active. Billing and payment records are retained for 7 years as required by Kenyan tax law. You may request deletion of non-financial data by contacting support.

7. Your Rights

Under the Kenya Data Protection Act 2019, you have the right to access, correct, or delete your personal data. Contact us at [email protected] to exercise these rights.

8. Contact

For privacy questions, contact our Data Protection Officer at [email protected] or call +254 754 550 099.

Privacy Policy