Privacy policy

Your account. Your name, email address or phone number, and a password, which we store only as a secure hash. If you sign up, verify your number or reset your password with a phone number, we text you a one-time code. You can add a mobile money number to pay faster and a tax identification number (TIN) to receive EBM receipts in your name.

Stays and payments on Muraho. The stays and leases you request, dates, number of guests, prices, reviews you write and listings you save. For a long-term lease we record who signed it, when, from which IP address and device. When you pay by mobile money we receive the phone number used, the amount and the payment status. We never receive your mobile money PIN.

Orders, tickets and bookings on Enjoy Kigali. Your contact name, phone and email, a delivery address and note, the date, time and party size of a table booking, the names of ticket holders, and when a ticket is scanned at the door. When you pay a business directly with its MTN MoMo code, we record the transaction ID you report and pass it to the business so it can confirm your payment. We also keep the listings you save and the reviews you write; a review shows your initials only.

Events and invitations on Enjoy Kigali. When you register for an event you give us your name, phone and, if you choose, your email, plus the names (and, if you choose, phone numbers) of up to four people coming with you. When an organiser invites you, they give us your name, phone and, optionally, your email, and we use them to send you the invitation and the organiser's decision.

Your feed on Enjoy Kigali. If you use the feed, we keep your @username, who you follow and who follows you, and the posts you make about your own visits: the place, the date and kind of visit (an order, booking or ticket), your photos and story, an optional star rating (also saved as your review), likes and comments. You choose who sees each post (only you, friends, or everyone). When you tag a friend, the tag shows only after they accept it. To suggest visits to post about, we read your own orders, bookings and tickets.

Identity and check-in. Rwandan accommodation rules require hotels and landlords to keep a guest register. For that, we or your host record your nationality, country of residence, date of birth, the type and number of your identity document and, if you choose, a copy of it. A check-in card can also list the people travelling with you, including children, where you arrived from, where you go next, the purpose of your visit and a vehicle plate.

Details you choose to share. Arrival time and flight, airport transfers, special requests, dietary or accessibility needs and special occasions. Dietary or accessibility needs can reveal health or religious information; we use them only to arrange your stay or order, and only because you gave them to us.

Messages. Messages you exchange with hosts, guests or businesses, and maintenance or service requests. Chat messages between guests and hosts on Muraho, and chat messages and menus on Enjoy Kigali, are translated automatically into the reader's language (English, French or Kinyarwanda, and Chinese on Enjoy Kigali), with the original one tap away. We store the detected language and the translations with the message. Your own messages are translated only for the person you are writing to. If you report a message or a review, we keep a copy of it with your report, and our team reads it to decide whether it breaks our terms. Blocking someone is recorded so we can enforce it.

Hosts and businesses. If you list a property or a business: your legal and trading name, TIN, contact person, phone, email, address and location, verification documents (registration and TIN certificates, the owner's ID, EBM certificate, proof of the payout account), property documents, photos, and the mobile money number for payouts. For team members we record their role, permissions and the changes they make.

Technical data. Your IP address, basic device information, sign-in attempts and error logs, used to keep sign-in secure and to limit abuse. If you tap “near me” on Enjoy Kigali your browser shares your approximate location for that search only; we do not store it. If you turn on notifications we keep your browser's push address. We use essential cookies only: one keeps you signed in, and others remember your language and currency. We do not use advertising or tracking cookies. To show businesses how often their Enjoy Kigali listings are viewed and clicked, we count views and clicks with a random ID kept in your browser's storage; it is not linked to your account and is used only for those counts.

Hotels and landlords can use Muraho's tools to record guests who booked elsewhere, by phone or at the desk. That data belongs to the hotel: it is the data controller and decides what it records, which can include your gender, address, company, preferences, staff notes and a note that it will not rent to you again. Muraho stores it for the hotel as its data processor, under a contract that limits what we may do with it. Only that hotel's team can see it. Ask the hotel about that data first; we will help it answer you.

In the same way, an event organiser on Enjoy Kigali can add you to a guest list, invite you, give you a complimentary ticket, sell you a ticket at the door, or approve or decline your registration. The organiser decides who is on its guest list and is the data controller for it; we store the list and send its invitations as the organiser's processor. Only that organiser's team can see it.

• To create and secure your account and sign you in.
• To handle stays, leases, orders, tickets and bookings, take payments and pay hosts and businesses.
• To keep the guest register that accommodation rules require.
• To send booking and order updates, receipts, reminders, event invitations and security codes by email or text message (SMS), and browser notifications if you turn them on.
• To review reports about reviews, messages and listings, and to enforce blocks and our terms.
• To let you talk to hosts and businesses, translating messages and menus so you understand each other, and to publish reviews.
• To send event invitations and registration updates on an organiser's behalf.
• To give businesses anonymous counts of how often their listings are viewed and clicked.
• To prevent fraud, spam and misuse of the service.
• To meet our legal, tax and accounting obligations, and to respond to lawful requests from authorities.

We use your data because it is needed to provide the service you asked for, because the law requires it, because we have a legitimate interest in keeping the service safe, or because you agreed to it (for optional details such as dietary needs). We do not sell your personal data and we do not make decisions about you by automated means alone.

• Hosts and businesses. When you book or order, the host or business receives your name, contact details and the details of that booking or order. A host sees your identity details only for your current bookings with them. When you register for or are invited to an event, its organiser receives your name, contact details and the names of the people coming with you.
• Service providers who process data for us under contract:
  • Supabase — database, sign-in and private file storage (Ireland, European Union)
  • Contabo — the servers that run our websites, and their logs (European Union)
  • Google Cloud — automatic translation of chat messages on Muraho and Enjoy Kigali and of Enjoy Kigali menus (United States)
  • Google Gemini, through Google Cloud (Vertex AI) — our only AI service. It summarises public news and announcements for Enjoy Kigali's guide from the headlines and excerpts that news outlets and official sources publish. We send it none of your account details, messages, orders, bookings or stays. Under Google Cloud's business terms, Google may not use the data to train its models (United States).
  • Cloudflare — photo storage (Western Europe), and delivering our websites: every visit passes through its network, which encrypts the connection and blocks attacks and bots (global network)
  • Upstash — sign-in rate limiting, keyed by IP address
  • MTN Mobile Money — payments (Rwanda)
  • Pindo — text messages with sign-in codes and order, booking and event updates (Rwanda)
  • Brevo — email for Muraho and Enjoy Kigali (France, European Union)
  • Firebase Crashlytics, by Google — crash and error reports from the Enjoy Kigali phone apps: the app version, phone model and operating system, the screen or request that failed, and your account's internal ID number (never your name, phone, email or what you typed). Kept for 90 days (United States).
  • Your browser's push service, or for the Enjoy Kigali phone apps Expo's push service, which passes them to Apple or Google — notifications, when you turn them on (United States)
• Authorities, when the law requires it, for example accommodation registration or tax rules.

Storing or sending personal data outside Rwanda requires authorisation from NCSA under Articles 48 and 50 of the law. We do so only on that basis and under data processing agreements with each provider. Our main database and the servers that run our websites are in the European Union, where the GDPR applies.

• Account data: while your account is open.
• When you close your account from Enjoy Kigali, we delete straight away your sign-in, name, phone and mobile money numbers, TIN, saved places, notifications, push-notification addresses and the delivery addresses no order used, and your feed: your @username, follows, posts and their photos, comments, likes and tags. Your reviews and the messages you sent businesses stay visible, shown as “Former member”.
• Copies of identity documents: deleted automatically 30 days after your last stay. The ID type and number stay on the guest register for as long as accommodation rules require.
• Booking, order, payment, lease and receipt records: as long as tax and accounting law requires, even after you close your account.
• Sign-in lock records: 90 days after the last attempt. Other security logs: a short period.
• Server logs (IP address, pages requested and errors): 30 days.

When we no longer need data we delete it or anonymise it.

You can:

• download a copy of your data from Account settings;
• correct your details there, or ask us to correct anything you cannot change yourself;
• delete your account. In Enjoy Kigali it happens straight away from Account settings; on Muraho, ask from Account settings and we act within 30 days. You can also follow the steps at ek.murahorw.com/delete-account without the app. Because the account is shared, this closes it on Muraho and Enjoy Kigali. We keep only the records the law requires;
• object to or ask us to limit some uses of your data, and withdraw any consent you gave;
• receive your data in a portable format.

You can also email our Data Protection Officer, CHOU TSAI LUNG, at [email protected]. We reply within 30 days. If you are not satisfied, you can complain to NCSA's Data Protection and Privacy Office (dpo.gov.rw, [email protected]).

The people behind a host or business — owners, contact persons and team members — have every right above over their own personal data. In addition, the records your business creates or keeps on Muraho and Enjoy Kigali are yours: your listings, photos, prices, bookings and orders, the guests and check-ins you record, payments and your team.

• An owner can download them at any time from Account settings (“Download my business data”), or ask the DPO for a copy.
• You can correct your business details in the host dashboard or by asking us.
• We use them only to provide the service to you, to show what you publish, and for anonymous statistics. We never sell them or share them with other hosts or businesses.
• When you leave, you can take a full copy; we then delete or anonymise them within 90 days, except what the law requires us to keep and the booking and payment records your guests still need.

For guests you record yourself, your business is the data controller and we are your processor; see “When a hotel, landlord or event organiser records your data” above and our terms.

We protect data with encrypted connections, hashed passwords, database access rules that limit each person to their own records (and each hotel team member to their properties), private storage for identity documents opened only through links that expire within a minute, an audit log of changes to guest records, and account lock-out after repeated failed sign-ins. If a breach puts your data at risk we notify NCSA within 48 hours and tell you when the risk to you is high. No online service is completely secure, so please keep your password and sign-in codes private.

Accounts are for adults (18 and over), and bookings, orders and tickets must be made by an adult. When an adult checks in with children, the guest register records their names and, where the rules require, their identity details. We do not knowingly collect personal data directly from children.

We may update this policy as our services change. We will post the new version here with a new date, and tell you by email or in the app when a change is significant.

Silkroad Africa LTD (company code 156892165)
Kagara, Nyabisindu, Remera, Gasabo, Umujyi wa Kigali, Rwanda
Privacy requests: [email protected]
Data Protection Officer: CHOU TSAI LUNG, [email protected]

Terms of service · Back to Muraho