Version 1.2Effective 12 November 2026Last updated 12 November 2026
Unispace respects your privacy. This Privacy Policy explains how we collect, use, share, and protect information when you use the Unispace mobile application, including student housing and property listings, event ticketing, the Haul marketplace, Cart delivery, and related services (together, the "App" or "Service").
By creating an account or using the App, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, please do not use the App. This Privacy Policy should be read together with our Terms of Service.
1. Information We Collect
We collect information you provide directly, information generated as you use the App, and information from third parties you choose to connect.
Some information is required to provide the Service and you cannot use the relevant feature without it — for example, a delivery address is required to deliver a Cart order, and a phone number is required to confirm a payment. Everything else is optional, and where it is optional we say so.
1.1 Account and Registration Information
Full name, email address, and phone number provided at sign-up.
Password (stored in encrypted/hashed form by our authentication provider; we never store it in plain text).
Profile photo, if you choose to upload one. This is optional.
If you sign up or sign in with Google or Apple, the name, email address, and profile information those providers share with us under your privacy settings with them.
1.2 Location Information
Precise or approximate device location (GPS), if you grant location permission, used to show nearby properties, points of interest, directions, and search results on the in-app map. Location permission is optional.
Property, listing, or event addresses and coordinates you search for or view, and your search history, so we can show "recently viewed" and improve recommendations.
1.3 Listings, Bookings, and Marketplace Activity
Property listings you create as a host, including address, photos, price, and description.
Bookings, enquiries, and messages related to property viewings or reservations.
Shop and product information you create as a vendor on Haul, including business name, description, logo, banner, and product listings.
Products added to your Cart, orders placed, delivery addresses, and order/delivery status.
Event listings you create as an organiser, and tickets you purchase, including ticket codes and QR codes issued to you.
1.4 Payment Information
We never ask for, see, or store your mobile money PIN. Payment is made by you, on your own phone, directly to the mobile money merchant code shown at checkout.
We receive the limited payment information needed to match your payment to your order and to confirm it: the mobile money number used to pay, the transaction reference, the amount, the currency (RWF), the time of payment, and the payment status.
Where you pay cash on delivery for a Cart order, we record that the order was paid in cash and the amount.
We are required to keep payment records for tax and accounting purposes. See section 6.
1.5 Device and Usage Information
Device identifiers, operating system and version, app version, crash logs, and diagnostic data.
A Firebase Cloud Messaging (FCM) device token, used to deliver push notifications about your orders, tickets, and account — for example, order confirmations and payment updates.
Log data such as the features you use, screens you view, and timestamps of activity, used to keep the App secure and to improve it.
Locally stored preferences (e.g., onboarding progress, search history) kept on your device.
2. How We Use Your Information
We use the information we collect to:
Create and manage your account.
Operate core features: property search and booking enquiries, event discovery and ticket purchase, and Haul and Cart (browsing, checkout, and order/delivery tracking).
Confirm payments made to our mobile money merchant code, match them to your order, and release your ticket or order once confirmed.
Process refunds, where approved, back to the mobile money number that paid.
Show your location on maps, provide directions, and calculate distance to properties, events, and stores.
Communicate with you about your account, bookings, orders, tickets, and updates to our policies.
Protect the safety and integrity of the platform, including detecting fraud, abuse, or violations of our Terms.
Improve, troubleshoot, and develop new features for the App.
Comply with legal obligations, including tax and accounting record keeping, and respond to lawful requests from public authorities.
3. Legal Basis for Processing
We process personal data in accordance with Rwanda's Law N° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy, and rely on one or more of the following legal bases: (a) your consent (e.g., for location access and marketing communications), (b) performance of a contract with you (e.g., processing a booking, order, or ticket purchase), (c) our legitimate interests (e.g., securing the platform and improving our services), and (d) compliance with legal obligations.
We do not make decisions about you by automated means alone, and we do not carry out profiling that produces legal effects for you or similarly significantly affects you.
4. Who Receives Your Data
We do not sell your personal data. It is shared only as set out below.
4.1 Other users, as the transaction requires
A property host sees the contact details of a student who enquires about their listing.
A shop or store sees the delivery details for an order you place.
An event organiser can see ticket-holder information for their event.
4.2 Service providers
These are the third parties that receive personal data in order to run the App. Each receives only what its function requires and is contractually restricted from using it for any other purpose.
Supabase — database, backend infrastructure, and authentication.
MTN Mobile Money — payment collection and confirmation.
Mapbox — maps, geocoding, and directions.
Google Firebase — push notification delivery.
Brevo — transactional email, such as ticket and order confirmations.
Google and Apple — sign-in, where you choose to use it.
4.3 Other disclosures
For legal reasons, if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Unispace, our users, or the public.
In connection with a business transaction, such as a merger, acquisition, or sale of assets, subject to reasonable safeguards.
With your consent or at your direction, for any other purpose we disclose to you at the time of collection.
5. Where Your Data Is Stored
Your personal data is stored on our hosting provider's infrastructure in the eu-west-1 region, located in Ireland. It is therefore transferred outside Rwanda.
That transfer is made on the basis of your consent and because it is necessary for the performance of our contract with you, as permitted by Article 48 of Law N° 058/2021. We have a written agreement with our hosting provider governing its handling of your data, as required by Article 49.
Article 50 of the same law requires a valid registration certificate from the National Cyber Security Authority authorising storage outside Rwanda. Our registration is with the Authority. We will update this Policy, and its version number, once the certificate is issued.
6. Retention and Security
We retain personal data for as long as your account is active and as needed to provide the App, resolve disputes, and enforce our agreements.
Transaction and payment records are retained for at least five (5) years after the transaction, to meet tax and accounting obligations, even if you close your account.
When you delete your account, we remove or anonymise your profile and activity data except where a record must be kept under the paragraph above.
We use reasonable technical and organisational measures (such as encrypted connections, access controls, and hashed passwords) to protect your information. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
7. Your Rights
Subject to applicable law, you have the right to:
Access the personal data we hold about you.
Request correction of inaccurate or incomplete data.
Request deletion of your personal data or account, subject to legal or legitimate business reasons for retaining certain records (e.g., completed transactions).
Object to or restrict certain processing, including withdrawing consent for location access or marketing communications at any time. Withdrawing consent does not affect processing carried out before you withdrew it.
Request a copy of your data in a portable format, where technically feasible.
Lodge a complaint with Rwanda's National Cyber Security Authority (NCSA) or other competent supervisory authority.
To exercise any of these rights, contact privacy@unispace.co.rw. Most account and privacy settings (such as location permission and profile information) can also be managed directly within the App or your device settings.
8. Location Permission
Location access is optional but required for map-based features such as finding nearby properties and getting directions. You can enable or disable location access at any time through your device settings; disabling it may limit certain features.
9. Children's Privacy
Unispace is intended for use by university students and is not directed at children. We require users to be at least 16 years old (or the applicable minimum age in your jurisdiction) to create an account. We do not knowingly collect personal data from children below this age; if we become aware that we have, we will take steps to delete it.
10. Third Party Links and Services
The App integrates with or links to third party services (including those named in section 4.2). Your use of those services is governed by their own privacy policies and terms, which we encourage you to review.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will notify you of material changes through the App or by other reasonable means, and will update the "Last updated" date above. Continued use of the App after changes take effect constitutes acceptance of the revised Policy.
12. Who We Are, and How to Contact Us
The data controller responsible for your personal data is:
We have appointed a Data Protection Officer. For any question, concern, or request about this Privacy Policy or how we handle your personal data, including to exercise any of the rights in section 7, contact:
Data Protection Officer — privacy@unispace.co.rw
General support — support@unispace.co.rw
You also have the right to complain directly to the National Cyber Security Authority (NCSA) as the supervisory authority in Rwanda.