Last updated: September 2026
Hostiko (hostiko.co.ke) is committed to protecting your privacy. This policy explains how we collect and use your personal information.
We collect your name, email address, Kenyan phone number (for M-Pesa payments), and billing information when you register or purchase services. We also collect server logs, IP addresses, and usage data for security and performance purposes.
Your information is used to provide and improve our services, process M-Pesa payments via KopoKopo, send service notifications and invoices, and provide customer support. We do not sell your personal information to third parties.
Payment processing is handled by KopoKopo (Safaricom M-Pesa partner). Your M-Pesa transaction data is processed by KopoKopo under their own privacy policy. Hostiko stores only transaction confirmation references.
When you pay an invoice we email you a receipt. We also share your name, email address and invoice number with Trustpilot A/S, an independent review website, so that it can send you one email inviting you to review Hostiko, about a week after you pay. Every paying customer is invited in the same way, whatever their experience with us, and nobody is invited more than once a year. Whether you leave a review is entirely up to you.
Trustpilot handles these details under its own privacy policy, and every invitation includes a link to stop receiving them. If you would rather we never share your details with Trustpilot, email [email protected] and we will exclude your account.
We use session cookies to keep you signed in to the client portal, and a small number of preference cookies (for example your theme and currency choice). We also use your browser’s local storage for the visit counter described below. Disabling cookies is possible in your browser but will break portal functionality.
We also use two analytics services to understand how the site is used and to find problems:
These are analytics cookies, not advertising cookies: we do not run ad networks, we do not build advertising profiles, and we do not sell or share your data with advertisers. Your passwords and payment details are never captured — card and M-Pesa entry happens on the provider's own pages, and sensitive fields are masked in recordings.
In addition to those two services, we keep our own basic record of visits to our public pages, so we can see which pages are useful without depending entirely on outside providers. For each page view we store the page address, the site you arrived from, your browser and device type, and your country. Your IP address is shortened before it is saved — the last part is removed — so the full address is never written to our records. Your country is read from our network provider’s own header, so no third-party location service is contacted.
To tell a repeat visit from a first one, a random identifier is stored in your browser’s local storage. It is generated in your browser, contains no personal information, and is not connected to your name or email unless you are signed in to the client portal, in which case your account ID is recorded with the visit. This record stays on our own servers and is not shared or sold. Automated crawlers are recorded separately and left out of the figures. Because it is a small script running in your browser, any analytics or script blocker stops it and it does not run at all with JavaScript disabled; clearing site data for hostiko.co.ke removes the identifier. We keep these visit records for 12 months, after which they are deleted automatically.
You can opt out at any time: use your browser's “Do Not Track” or an ad/analytics blocker, or install the Google Analytics opt-out add-on. You may also email us and we will exclude your account from session recording.
All data is transmitted over HTTPS (SSL/TLS). Passwords are hashed using bcrypt. We follow industry security standards to protect your account data.
We retain account data for as long as your account is active. Billing and payment records are retained for 7 years as required by Kenyan tax law. You may request deletion of non-financial data by contacting support.
Under the Kenya Data Protection Act 2019, you have the right to access, correct, or delete your personal data. Contact us at [email protected] to exercise these rights.
For privacy questions, contact our Data Protection Officer at [email protected] or call +254 754 550 099.