Privacy Policy

1. The short version

We collect the least we can get away with and still run a property marketplace. We do not sell personal information, ever. An enquiry goes to the one seller or practitioner you chose to contact and to nobody else. The listing intelligence on the site is built from public and municipal data rather than from watching you. You can export or delete what we hold from your dashboard, or by sending one email.

The rest of this document is the same thing said properly, because the short version is not what you are entitled to rely on.

2. Who is responsible

The responsible party, in the language of the Protection of Personal Information Act 4 of 2013, is Propalot (Pty) Ltd, registration number 2026/114872/07, of 12 Fredman Drive, Sandton, 2196, South Africa.

The Information Officer is registered with the Information Regulator and is reachable at privacy@propalot.co.za. Section 17 of this policy has the full details.

Where a seller or a property practitioner receives your enquiry, they become a responsible party for that information in their own right, and their own privacy notice governs what they then do with it.

3. What we collect

If you are browsing

• Technical data: IP address, browser and device type, screen size, referring page, and the pages you opened. Used in aggregate to keep the site working and to see what is slow.
• Preferences: your theme, your saved homes, your comparison set and your recently viewed list. These live in your own browser and are described in the Cookie Policy.

If you have an account

• Identity and contact: name, email address, telephone number, and a WhatsApp number if you give one.
• Credentials: a hash of your password. We never hold the password itself and cannot tell you what it is.
• Activity: searches you ran, homes you saved, alerts you set, comparisons you built, and viewing requests you sent.
• Correspondence: enquiries you sent or received, and anything you wrote to support.

If you sell or let through the portal

• Professional details: agency name, Fidelity Fund Certificate number, and the telephone number a buyer should ring. The FFC number is published on your listings on purpose, so a buyer can check it.
• Listing content: the property, its figures, its photographs, and the descriptions you write.
• Leads: the enquiries your listings drew, and any private notes you attached to them.
• Billing: which plan you are on, when it renews, and a record of each payment. Card numbers are held by PayFast and are never sent to us.

What we do not collect

We do not ask for identity numbers, bank account details, salary, credit records or biometric data anywhere on the platform. Nothing on Propalot needs them. If a page ever appears to ask you for one, it is not ours, and we would like to know about it at once.

4. Where it comes from

Almost all of it comes from you, because you typed it. The exceptions are worth naming:

• Technical data is generated by your browser as it loads a page.
• Payment status comes back to us from PayFast when a payment succeeds or fails.
• Property and area data comes from deeds and municipal sources, network operator coverage maps, published crime and schools data, and market transfer records. That is information about places, not about you.

5. Why we process it

POPIA requires a lawful basis for each purpose rather than one blanket consent, so here they are one by one.

• To run your account and publish your listings. Basis: performance of our contract with you.
• To pass an enquiry to the seller you chose. Basis: performance of a contract, and your explicit request, since you pressed the button that sent it.
• To take payment and keep billing records. Basis: contract, and a legal obligation under the Companies Act and the Tax Administration Act.
• To send service email: a lapse warning, a receipt, a password reset, a security notice. Basis: contract. These are not marketing and cannot be switched off while you hold an account, because an account whose owner cannot be warned is worse for you than one that can.
• To keep the platform safe: rate limiting, fraud checks, listing moderation, abuse investigation. Basis: our legitimate interest in a platform that is not a vehicle for fraud, and yours in the same thing.
• To improve the product: aggregate analytics, performance measurement. Basis: legitimate interest, on data that is aggregated so it no longer identifies you.
• To send the monthly newsletter. Basis: your consent, given when you subscribed and withdrawn by one click in any issue.

6. What the AI does with it

The recommendations, the search parsing, the price fairness model and the assistant on a listing page all run on the property data and on your own activity within Propalot. That is the whole scope.

We do not train models on your private documents, your enquiry messages, your notes on a lead or your correspondence with support. Listing intelligence such as price benchmarks, load shedding, fibre, water and safety is derived from public and municipal sources and is the same for every visitor looking at that property. Nobody sees a different number because of who they are.

No decision with a legal or similarly significant effect on you is made by automated means alone. Where the platform declines something, such as a listing failing moderation, a person can and will review it if you ask.

The Data and AI Disclaimer explains how the models reach their estimates and how far those estimates should be trusted.

7. Who else sees it

We do not sell personal information, and we do not share it for anyone else's marketing. It goes to four kinds of recipient and no others.

The seller or practitioner you contacted

Your name, email address, telephone number and message, for the one listing you enquired about. One recipient, not a panel.

Operators who process on our instruction

• Supabase hosts the database, authentication and the photographs, under a written operator agreement.
• Resend sends transactional email, and therefore handles your email address and the content of what we send you.
• PayFast takes payment. They hold the card details; we hold only the result and a reference.
• Vercel serves the site and keeps short-lived request logs.

Each is bound to process only on our instruction, to keep it secure, and to tell us if it is compromised.

Where the law requires it

A court order, a lawful request from the police or a regulator, or a legal obligation. We disclose the minimum the instrument actually demands, and we tell you unless we are forbidden from doing so.

If the business changes hands

In a sale, merger or restructure, account data may pass to the acquirer, who is bound by this policy until it gives you notice of its own and a chance to object.

8. Where it is stored

The database and the photographs sit in a South African or European region, depending on the service. Email delivery and site hosting involve providers with infrastructure outside South Africa.

Where personal information crosses a border, section 72 of POPIA allows it only if the destination is protected by comparable law or by a binding agreement. Each of our operators is either in a jurisdiction with comparable protection or contracted to a standard that provides it, and we hold those agreements on file.

9. How long we keep it

• Account data: while the account is open, and 30 days after you close it, so a closure in error can be undone.
• Listings and photographs: while the listing exists. Deleting it removes the record and queues the photographs for deletion on the nightly sweep.
• Enquiries: five years, because a record of what somebody actually asked is what settles a later dispute about it.
• Payment and billing records: five years from the end of the tax year, which is what the Tax Administration Act requires.
• Email delivery logs: 12 months, to prove a notice was sent.
• Security and abuse logs: 12 months.
• Backups: 35 days, after which they roll over. Deleted data can persist in a backup until that happens.

Past those periods it is deleted or de-identified so it can no longer be tied back to you.

10. How it is protected

• Everything travels over TLS. There is no unencrypted path in.
• Passwords are hashed with a slow, salted algorithm. Nobody at Propalot can read yours.
• The database enforces row level security, so one seller cannot read another seller's listings, leads or billing even if the application asked it to.
• Photograph storage is scoped so an account can only write inside its own folder.
• Payment webhooks are signature-verified, source-checked and posted back for confirmation before anything is believed.
• Access to production data is limited and logged.

No system is perfect, and anyone who tells you otherwise is selling something. If you find a weakness, write to privacy@propalot.co.za and we will treat it seriously and thank you for it.

11. Direct marketing

The newsletter goes only to people who asked for it, and every issue carries a one-click unsubscribe that works immediately.

Section 69 of POPIA and section 45 of the ECT Act govern unsolicited electronic marketing, and we follow both. Service email is separate: a receipt, a warning that a listing is about to lapse, a password reset and a security alert are part of holding an account rather than marketing, and they continue for as long as the account does.

12. Your rights

Under POPIA you may ask us to confirm what we hold, give you a copy, correct it, delete it, stop a particular kind of processing, or stop direct marketing. You may also object to processing we base on legitimate interest, and complain to the Information Regulator if you think we have got it wrong.

The POPIA and PAIA Notice sets out each right, the form a request takes, and what the Regulator's contact details are. In practice, one email to privacy@propalot.co.za does it. We answer within 30 days, we do not charge for a reasonable request, and we do not make you fill in a form to exercise a right you already have.

13. Cookies and browser storage

Propalot sets a small number of cookies and keeps a few preferences in your own browser. Every one of them is named, explained and, where it is optional, switched off in the Cookie Policy.

14. Children

Propalot is for adults buying, selling, letting and renting property. We do not knowingly collect personal information from anyone under 18. If you believe a child has created an account, tell us and we will delete it.

15. If something goes wrong

If personal information is accessed or acquired by somebody who should not have it, section 22 of POPIA requires us to notify the Information Regulator and the people affected as soon as reasonably possible.

We will tell you what happened, what was involved, what we have done, and what you should do. We will do it in plain language and we will not wait to be asked.

16. Changes to this policy

We update this when the product changes or the law does. The date at the top is the version you are reading. For a material change we email account holders 30 days before it takes effect. We do not make a change retrospective, and we do not repurpose information already collected without a fresh basis for it.

17. The Information Officer

The Information Officer
Propalot (Pty) Ltd
12 Fredman Drive, Sandton, 2196, South Africa
privacy@propalot.co.za · +27 10 001 0001

If we have not resolved a complaint to your satisfaction, the Information Regulator of South Africa can be reached at JD House, 27 Stiemens Street, Braamfontein, Johannesburg, or at inforeg@justice.gov.za. You do not need our permission to go to them, and you do not need to come to us first.