Privacy Policy

Last updated: 23 October 2026

This Privacy Policy applies to the Hausen mobile applications for Android and iOS and to thehausen.com (together, “Hausen”, “we”, “us”). It explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and the rights you have.

Hausen is a property platform. Depending on how you use the app, you may browse and book short stays, list or manage a property, sign a lease, pay rent or deposits, promote a listing, message other users, or verify your identity.

1. Who we are

Hausen is operated by Northstar Selected (Pty) Ltd, a private company registered in South Africa with registration number 2025/253502/07, whose registered office is at 1000 Timbavati Street, Moreleta Park, Pretoria, Gauteng, 0044, South Africa. We are the responsible party (data controller) for personal information processed through the app and website, under the Protection of Personal Information Act, 2013 (POPIA) and the other data-protection laws listed in section 12.

Information Officer: Morne Frederich du Toit (Director), support@thehausen.com. Contact our Information Officer about this policy, your rights, or a complaint.

2. Information we collect

We collect information you provide, information created when you use Hausen, and information from service providers who help us run the product. For each category below we say why we need it and whether you must provide it.

Account and profile

• Name, email address, and password (or sign-in through Google or Apple) — required to have an account
• Profile photo, bio, languages, and short public answers you choose to share — optional
• Locale, currency, and market (country) — required, set from your choices in the app
• Notification preferences
• Terms of Service version accepted, Privacy Policy version acknowledged, and the time of your agreement
• Counts of completed stays you have hosted or taken, calculated by Hausen

Identity verification (KYC)

To reduce fraud on listings, leases, and payments, we may ask you to verify your identity with Didit. Verification is required for some features (for example signing a lease or receiving payouts) and optional otherwise. The process can include:

• Government identity documents (for example an ID card or passport)
• A selfie or video liveness check, which involves biometric information (your facial image)
• Camera, microphone, and (where supported) NFC/passport-chip access on your device

Biometric information and identity numbers are special or sensitive personal information under POPIA and similar laws. We process them only with your explicit consent, which you give when you choose to start verification, and only to verify who you are and prevent fraud. You can decline; features that require verification will then be unavailable.

Didit processes the document images and biometric checks on our behalf. Hausen does not keep the document images or your selfie. When verification is approved, Hausen stores:

• Verification status and history (for example approved, declined, or resubmission requested) and session identifiers
• Your verified legal name and ID or passport number, so they can be printed on leases you sign. Your ID number is not shown on your public profile.

Listings, stays, and leases

• Property details, photos, amenities, house manuals, calendars, and pricing
• Property addresses and map pins you enter (including autocomplete suggestions from Google Places). We do not collect GPS or precise location from your device
• Booking and lease dates, guests, requests, offers, viewing slots, signed lease documents, and related messages
• For owners: VAT registration and VAT number, the notice address for leases, property income and expense records you enter, and tenants you choose to block from a listing
• Information you provide about other people, such as an emergency contact in a house manual. Please tell them you are sharing it
• Lease templates you upload, so we can extract their text for your lease
• Maintenance tickets, bids, and schedules if you use those features

Reviews

• Ratings and comments you leave, together with your name

Payments

• Payment amounts, currency, status, and references for stays, rent, deposits, boosts, and fees
• Rent auto-pay settings
• Saved payment-method tokens and owner payout / bank account details processed by Paystack

We do not store full card numbers on Hausen servers. Card and bank data is handled by Paystack.

Support and communications

• In-app chat between guests, hosts, tenants, and service providers
• Help requests, including name, email, and message content (including if you contact us while signed out)
• Emails we send about your account, bookings, payments, leases, and support

Device, app, and security data

• Push notification tokens (Firebase Cloud Messaging)
• App version, platform, and crash / performance diagnostics (Firebase Crashlytics and Performance), which may be linked to your account identifier
• App Check / device attestation and, on web, reCAPTCHA Enterprise signals to reduce abuse
• Technical logs such as timestamps and error traces needed to operate and secure the service

3. How and why we use information

• To provide the service you ask for (performance of a contract): create and manage your account, show listings, process bookings and leases, enable messaging, generate and sign leases, run boosts, and take payments, payouts, and refunds
• To keep Hausen safe (our legitimate interests and legal duties): verify identity, prevent fraud and abuse, monitor reliability and security, and enforce our Terms
• To meet legal obligations: tax, financial record-keeping, and responding to lawful requests
• To support you: answer help requests and investigate issues
• With your consent: identity verification using biometric information, push notifications, and any marketing you opt in to

Marketing. We do not send marketing messages unless you opt in, and every marketing message lets you opt out. Transactional messages about your account, bookings, payments, and security are not marketing.

We do not sell your personal information.

Automated decisions

Identity verification decisions (approve, decline, or ask to resubmit) are made automatically by Didit’s document and liveness checks. If a decision affects you and you think it is wrong, email support@thehausen.com. A person at Hausen will review it, and you can give us information to support your case.

Artificial intelligence

If an owner uses the lease wizard to draft extra clauses, the owner’s answers (such as lease style, term, notice period, pet policy, responsibilities, and any special clauses they type) are sent to Google’s Gemini service to generate draft wording. Do not include other people’s personal information in those answers. We do not use Gemini to make decisions about you.

4. How we share information

We share information only as needed to operate Hausen:

• The public and other users: your public profile (name, photo, bio, languages, short answers you choose to share, verification badge, and stay counts), reviews you write (with your name), and listing information you publish.
• Listing location: for short stays, the street address and exact map pin are public on the listing if the owner leaves “share exact location” on (the default). Otherwise, and for all long-term listings, the street address is shared only with a guest once a booking is confirmed or with a tenant once a viewing is confirmed.
• The other party to a booking or lease: the details needed for that transaction. For a lease, this includes each party’s verified legal name, ID or passport number, email address, and the owner’s notice address, which are printed on the lease. Guests with a paid stay can see the house manual, including any emergency contact the owner added.
• Hausen staff: authorised support and operations staff can look up accounts and view profile, booking, lease, payment, and verification information to help you, resolve disputes, prevent fraud, and recover accounts. Access depends on their role, and staff actions are logged.
• Google: Firebase (authentication, database, storage, functions, messaging, App Check, Crashlytics, Performance), Gemini (lease-clause drafting), Google Sign-In, Google Places, Cloud Logging, and Google Play services.
• Apple: Sign in with Apple, and Maps when you choose to open an address in Maps.
• Didit: identity verification and liveness checks.
• Paystack: payments, saved cards, payouts, refunds, and related fraud checks.
• Email delivery providers: transactional mail such as welcome, booking, lease, payout, and support messages.
• Authorities or professional advisers: when required by law, to protect rights and safety, or in connection with a business transfer.

When service providers process data for us, they act as operators / processors on our instructions and under contracts that require them to keep it secure. Some parties, such as Google or Apple for sign-in and Paystack for its own regulatory duties, also act as independent controllers under their own privacy policies.

5. Permissions the app may request

• Camera and photos: identity documents, profile photos, and listing photos
• Microphone: video liveness during identity verification
• NFC: reading a supported passport chip during verification
• Notifications: alerts for messages, bookings, payments, and support
• Internet: to run the service

You can refuse a permission; some features will then be unavailable.

6. How long we keep information

We keep information while your account is active and for as long as needed for the purposes above. After you delete your account, or a record is no longer needed:

• Payment, payout, refund, and fee records: up to 5 years, for tax and financial record-keeping duties
• Lease, booking, and occupancy records, including signed leases: for the life of the stay or tenancy and up to 5 years afterwards, for disputes and legal claims
• Terms agreement records: with the related lease, booking, or legal records, for the same periods
• Support tickets, staff audit logs, and security logs: up to 2 years
• Crash and performance diagnostics: up to 90 days, as set by Firebase
• Identity-document images and biometric checks: held by Didit under its verification flow, and deleted on our instruction when you delete your account

When the period ends, we delete or de-identify the information. See the delete-account page for what happens when you delete your account.

7. Your rights

Depending on the law that applies to you, you have the right to:

• Know whether we hold information about you, and get a copy of it
• Correct or update inaccurate or incomplete information
• Delete information, or your whole account
• Object to or restrict certain processing, including processing based on our legitimate interests
• Withdraw consent you have given (for example to notifications or marketing). This does not affect processing that already happened
• Ask for a person to review an automated decision (section 3)
• Where the law provides it, receive your information in a portable format
• Complain to a data-protection regulator (section 12)

How to use these rights:

• Update profile details in the app
• Turn push or email notifications on or off in Notification settings
• Email support@thehausen.com for access, correction, objection, or a copy of your information. We may ask you to confirm your identity first, and we aim to respond within 30 days
• Request account deletion at thehausen.com/delete-account

Deleting your account removes or de-identifies personal profile data we control, except records we must keep (section 6). Signed leases keep the names and ID numbers printed on them, because both parties hold the lease.

8. Where your information is processed

Hausen’s main database, file storage, and server functions are hosted by Google Cloud in the European Union (Belgium and other EU locations). Some providers also process information in other countries: Google (including Gemini, Crashlytics, and Cloud Logging) and Apple in the United States and elsewhere, and Paystack, Didit, and email providers in the countries where they operate.

When information leaves your country, we rely on safeguards the law allows, such as the recipient being subject to adequate data-protection law, contracts with the provider that protect your information, or the transfer being necessary to provide the service you asked for.

9. Children

Hausen is not directed at children. You must be at least 18 years old to create an account. We do not knowingly collect personal information from children. If you believe a child has provided information, contact us and we will delete it.

10. Security and breaches

We use encryption in transit and at rest, access controls, role-based staff access with audit logs, Firebase App Check, and least-privilege rules on user data. No method of transmission or storage is completely secure.

If a security breach affects your personal information, we will notify you and the relevant regulator as the law requires, as soon as reasonably possible, and tell you what happened and what you can do.

11. Website and cookies

thehausen.com hosts public pages such as this policy. The web app uses browser storage needed for sign-in and app settings, and reCAPTCHA Enterprise and similar security cookies or signals. We do not use advertising or cross-site tracking cookies.

12. Your country and your regulator

The law of the country you live in, or where the property is, may give you extra rights. You can complain to us first, and you can always complain to the regulator. Hausen currently operates in South Africa only; the other countries below apply once we open there:

• South Africa — Protection of Personal Information Act, 2013. Information Regulator: inforegulator.org.za, POPIAComplaints@inforegulator.org.za
• Kenya — Data Protection Act, 2019. Office of the Data Protection Commissioner: odpc.go.ke.
• Ghana — Data Protection Act, 2012 (Act 843). Data Protection Commission: dataprotection.org.gh.
• Nigeria — Nigeria Data Protection Act, 2023. Nigeria Data Protection Commission: ndpc.gov.ng
• Côte d’Ivoire — Law No. 2013-450 on the protection of personal data. ARTCI: artci.ci.

13. Changes

We may update this policy. The “Last updated” date will change, and the current version will always be at https://thehausen.com/privacy. For material changes we will ask you to acknowledge the updated policy in the app, and may also notify you by email.

14. Contact

Northstar Selected (Pty) Ltd (registration number 2025/253502/07)
1000 Timbavati Street, Moreleta Park, Pretoria, Gauteng, 0044, South Africa
Information Officer: Morne Frederich du Toit (Director)
Email: support@thehausen.com
Website: https://thehausen.com