Privacy Policy

RE360Muse Ltd. (“we”) provides RE360Muse, a one-stop real-estate operating system. Registered office: Kigali, Rwanda. Contact: info@re360muse.com or re360muse@gmail.com.

This policy covers the public website, the operator OS, owner and tenant portals, listing sites we host, and the API at api.re360muse.com. Each company still issues its own privacy notice to its clients.

We are the controller for accounts we create (name, email, role, billing contact) and for how the platform itself is run.

When a company records properties, leads, leases, tenants, owners, or documents in RE360Muse, that company is the controller of that content. We process it on their instructions to provide the product. Owner and tenant portal access is by invite from that company.

Depending on how you use RE360Muse, we may process:

• Account data: name, email, password hash, role (platform staff or OS operator), company membership.
• Workspace content the company enters: properties, listings, leads, deals, leases, work orders, construction tasks, messages, and uploaded files.
• Billing data: company, plan, Paystack customer and charge references, card last four and brand. We never store a full card number or CVV.
• Technical data: IP address, user agent, session identifiers, first-party visitor analytics (page path, referrer, UTM query params, named CTA events), and server logs needed to operate and secure the service.
• Marketing email addresses you opt in with, stored as a subscriber record until you unsubscribe.
• Contact-form messages sent to RE360Muse Ltd.

We process personal data to run the product you asked for, to bill the company, to keep the service secure, to answer support, to measure first-party conversion from the marketing site to signup, and to meet applicable law, including Rwanda’s Law Nº 058/2021 relating to the protection of personal data and privacy. RE360Muse is for operators worldwide; we do not sell personal data and we do not run advertising pixels on the OS.

Application and API servers run on AWS Lightsail. The system-of-record database is AWS RDS PostgreSQL in eu-west-1 (Ireland). Object storage for uploads uses an S3-compatible bucket (Cloudflare R2). The public app is served via AWS Amplify / CloudFront. Paystack processes card payments outside our servers.

If you operate from Rwanda or any other country, your content may be stored in Ireland and related AWS regions as needed to run the service.

We share data with processors who run infrastructure or payments for us: Amazon Web Services, Cloudflare (R2), and Paystack. We share with the company that invited you when you use a portal. We disclose information if required by law or to protect the service from abuse.

Account profile data stays while the account is open. When you erase the account we remove the sign-in, profile, sessions, and identity documents. We keep the privacy-request record for 2 years, and billing and Paystack references for 5 years after the charge. Server logs are kept for 90 days. Marketing email is kept until you unsubscribe, then the address stays suppressed so we do not mail it again.

Company workspace content stays while that company uses RE360Muse. It is deleted or exported when the company asks. Closing one person’s account does not delete the company’s properties, leads, leases, owners, or tenants.

Under Rwanda’s Law Nº 058/2021 you may request access, correction, deletion, or restriction, and you may object to certain processing. Signed-in operators do this under Account → Privacy. That download covers the account we control. Workspace records are requested from the company that entered them. You can also email info@re360muse.com with the subject “Privacy request”.

A data protection officer is not yet designated. Until that appointment, privacy requests are handled at the email above. You may complain to the Data Protection Office (complaint@dpo.gov.rw) and to the National Cyber Security Authority. If you are in another country, you may also have rights under local law.

RE360Muse Ltd. has not yet been issued a data controller certificate, a data processor certificate, or authorization to store or transfer personal data outside Rwanda. Hosting in Ireland is disclosed here and is not a substitute for those authorizations.

Access to company data is gated by membership. Upload routes require a signed-in session. Passwords are hashed. The Paystack webhook is public and HMAC-verified. Platform staff work in /admin and are not company members. No method is perfect; report suspected abuse to info@re360muse.com.

RE360Muse is a business product. We do not knowingly create operator accounts for children. Portal invites are sent by the company that manages the property.

We will update this page when the product or the law requires it. The date at the top is the current version. Material changes will be noted here and, where required, emailed to the account address.