Legal
Cookie Policy
Every cookie and browser store Propalot sets, named, with what it does and how to be rid of it.
Written to be accurate, pending legal review
This document describes how Propalot actually behaves today rather than repeating boilerplate, and it is written to be read. It has not yet been reviewed by an attorney, and it should be before Propalot relies on it in a dispute. Where it conflicts with a right you hold under South African law, the law wins.
1. The short version
Propalot sets two cookies, and both exist to keep you signed in. It keeps four preferences in your own browser so the site remembers your theme and your saved homes. There are no advertising cookies, no tracking pixels, no third-party analytics, and nothing here is shared with anybody.
2. Cookies and browser storage
A cookie is a small file your browser sends back to a server with every request. It is how a site knows one page view belongs to the same person as the last.
Local storage is different, and better for preferences. It stays in your browser and is never sent anywhere. A preference kept in local storage is one Propalot cannot see, cannot log and cannot correlate with anybody else's.
We use cookies only where a value genuinely has to reach the server, which is to say only for the session. Everything else is local storage, deliberately.
3. Strictly necessary cookies
These two run the seller portal. They are set only once you sign in, they are limited to /list and /auth, and you cannot switch them off and still have an account: they are what being signed in means.
4. Preferences kept in your browser
None of these leave your device. Clearing site data for propalot.co.za removes all four, and the only consequence is that the site forgets your theme and your lists.
Everything Propalot stores
| Name | Kind | Purpose | Lasts |
|---|---|---|---|
sb-access-token | Cookie, strictly necessary | Keeps you signed in to the seller portal. Set by Supabase, refreshed on each request that reaches /list or /auth. | One hour, refreshed while you are active |
sb-refresh-token | Cookie, strictly necessary | Obtains a new access token so a session does not end mid-sentence. Marked HttpOnly, so no script on the page can read it. | Until you sign out, or 30 days idle |
propalot-theme | Browser storage, preference | Whether you chose light, dark or system. Read before the page paints so it never flashes the wrong ground. | Until you clear it |
propalot:saved | Browser storage, preference | The homes you saved, so the list survives a refresh. | Until you clear it |
propalot:compare | Browser storage, preference | The properties currently in your comparison set. | Until you clear it |
propalot:viewed | Browser storage, preference | The listings you looked at recently, which is what the recommendations on the homepage read. | Until you clear it |
5. What we do not set
This list matters more than the one above, so it is stated rather than implied. Propalot does not use:
- advertising or retargeting cookies of any kind;
- third-party analytics such as Google Analytics, Meta Pixel, Hotjar, Mixpanel or Segment;
- tracking pixels in email beyond a plain delivery record;
- fingerprinting, cross-site identifiers, or any cookie whose purpose is to follow you off propalot.co.za;
- data brokers. Nothing about your browsing is sold, rented or syndicated, because that is not the business.
If that ever changes, it changes here first, with notice, and with a consent banner that actually asks rather than assumes.
6. Third parties
Two services touch a page and may set a cookie of their own within their own scope:
- Supabase, which issues the two session cookies above.
- PayFast, when you are sent to their checkout to pay. That happens on their domain, under their own cookie policy, and you return to us with nothing but a result.
Map embeds and photographs are served from allow-listed hosts and do not set cookies for us. Fonts are self-hosted, so no third party sees a request for one.
7. Turning them off
Preferences. Clear site data for propalot.co.za in your browser settings, or use a private window. The theme toggle in the header is the switch for the one preference most people want to change.
Session cookies. Sign out, which discards them. Blocking them entirely is your right, and the public site works perfectly well without them: search, listings, intelligence panels, comparisons and the AI assistant all run signed out. Only the seller portal needs a session, and it cannot work without one.
Every major browser lets you block or delete cookies per site, under Settings, then Privacy. Blocking all cookies everywhere will break most of the web, not only this site.
8. Consent, and why there is no banner
Under POPIA and section 45 of the Electronic Communications and Transactions Act, consent is needed for storage that is not necessary to deliver a service the user asked for.
Every cookie Propalot sets is strictly necessary, and every preference we keep is stored on your own device and never transmitted. That is the category the law does not require consent for, which is why there is no banner in your way. A banner that asks permission for nothing is theatre, and it trains people to click through the ones that matter.
9. Changes to this policy
The table above is maintained alongside the code that sets these values, so it should not go stale. The date at the top is the version you are reading. Anything new and non-essential arrives with notice and with a real choice attached.
10. Asking about this
privacy@propalot.co.za · +27 10 001 0001
Propalot (Pty) Ltd, 12 Fredman Drive, Sandton, 2196, South Africa
The Privacy Policy covers what happens to personal information generally, and the POPIA and PAIA Notice covers your rights over it.
The rest of the register
- Terms of ServiceThe agreement between you and Propalot: what the platform does, what it does not, and who is responsible for what.
- Acceptable Use PolicyWhat may and may not be published, scraped, automated or sent through Propalot, and what happens when that line is crossed.
- Data and AI DisclaimerWhere every figure on a listing comes from, how the AI reaches its estimates, and the weight those estimates should carry.
- Privacy PolicyWhat personal information Propalot holds, why it holds it, who else sees it, and how long it stays.
- POPIA and PAIA NoticeThe lawful basis for each kind of processing, your eight rights under POPIA, and how to make a request for access.
- Pricing, Refunds and CancellationWhat each plan costs, when it renews, how to cancel, when money comes back, and what a failed payment does.
All of it, in one place, at the legal register.