Privacy Policy

Last updated: 8 October 2026

POPIA Compliant

1. Responsible Party

The responsible party for purposes of the Protection of Personal Information Act, 2013 (POPIA) is:

Name: Sean Johnson

Operating as: PropKeep

Email: info@propkeep.co.za

Website: propkeep.co.za

2. What Data We Collect

We collect the following categories of personal information:

Account information: name, email address, phone number, company/trading name.
If you sign in with Google: Google shares your name, email address and profile picture with us. We use them only to create and sign in to your PropKeep account. We never see your Google password and cannot access your Gmail, contacts or files.
Property details: property addresses, unit information, rental amounts.
Tenant information: names, contact details, lease terms, payment history, maintenance requests (entered by landlords).
Financial data: invoice records, payment statuses, subscription billing information.
Usage data: pages visited, features used, device type, browser information.

3. Purpose of Collection

We collect and process personal information for the following purposes:

To provide and operate the PropKeep property management service.
To process subscription payments via PayFast.
To send notifications and reminders by email, and to prepare WhatsApp messages for you to send yourself.
To generate reports, invoices, lease agreements, and other documents.
To improve and develop the Service.
To comply with legal obligations.

4. Legal Basis for Processing

We process personal information on the following legal grounds under POPIA:

Consent: you provide consent when you create an account and agree to these terms.
Contract: processing is necessary to fulfil our subscription agreement with you.
Legitimate interest: we may process data to improve the Service, provided this does not override your rights and freedoms.

5. Third-Party Sharing

We share personal information with the following third parties, strictly for service delivery:

PayFast — for processing subscription payments securely.
Supabase (hosted on AWS) — for data storage and authentication.
Vercel — for hosting the Service and running its server-side functions.
Resend — for delivering transactional email, such as invoices, reminders and account notices.
Anthropic and OpenAI (third-party AI providers) — only when you use an AI feature (Remi, dictation, lease reading, drafting), and only after you allow it in the app. What is sent: the portfolio, property and tenant details needed for your request, your question and conversation, any image or document you attach, and voice recordings when you use dictation. It is used only to produce the answer, draft or transcript you asked for. We remove contact numbers and identity numbers before sending where the feature allows it. These providers process the data only on our instructions, may not use it to train their models, and give it the same or equal protection to this policy. You can withdraw AI permission at any time in the app (More → Privacy).
PostHog — for product analytics and session recording, as described in section 11.

WhatsApp: PropKeep does not use the WhatsApp Business Platform (also called the WhatsApp Business API), and does not send messages on your behalf. When you use a WhatsApp feature, PropKeep prepares the wording and opens WhatsApp on your own device with that text ready to send. You send it yourself, from your own WhatsApp account. No personal information is transmitted from PropKeep to WhatsApp or Meta.

We will never sell your personal information to third parties. Data is only shared as necessary to provide the Service.

6. Data Storage

Your data is stored on Supabase cloud infrastructure, hosted on Amazon Web Services (AWS). Data may be stored on servers located outside of South Africa.

Where data is transferred outside of South Africa, we ensure that appropriate safeguards are in place in accordance with Section 72 of POPIA, including ensuring that the recipient country has adequate data protection legislation or that binding agreements are in place.

7. Data Retention

Active accounts: your data is retained for as long as your subscription is active.
After cancellation: your data is retained for 30 days to allow for data export, after which it is permanently deleted.
Payment records: retained for 5 years in compliance with South African tax law (Income Tax Act and VAT Act requirements).

8. Tenant Data

When a landlord inputs tenant data into PropKeep, the landlord acts as the responsible party for that tenant's personal information under POPIA.

PropKeep acts as an operator, processing tenant data on behalf of and under the instruction of the landlord. Landlords are responsible for ensuring they have the appropriate consent or legal basis to collect and store their tenants' personal information.

9. Your Rights Under POPIA

As a data subject, you have the right to:

Access — request confirmation of what personal information we hold about you.
Correction — request correction or updating of inaccurate personal information.
Deletion — request deletion of your personal information, subject to legal retention requirements.
Object — object to the processing of your personal information in certain circumstances.

To exercise any of these rights, contact us at info@propkeep.co.za. We will respond within 30 days. To delete your account and its data, use the account deletion page.

10. Cookies

PropKeep uses minimal, session-based cookies that are essential for the functioning of the Service (e.g., authentication tokens). We do not use third-party tracking cookies, advertising cookies, or analytics cookies that track you across other websites.

11. Product analytics and session recording

To understand how landlords use PropKeep and to find and fix parts of the Service that are confusing or broken, we use PostHog, a product-analytics provider. PostHog processes this data on our behalf in the European Union. We also use Plausible for privacy-friendly, cookieless visitor statistics.

This includes a recording of how a page is used — which screens are opened, where a cursor moves, what is clicked, and where someone stops. These recordings are masked before they leave your device. Specifically:

All text is hidden. Every piece of text on the screen — including tenant names, ID numbers, contact details, rent amounts and lease terms — is replaced with blocks before the recording is sent. We see the layout and the interaction, never the words.
All form inputs are hidden. Anything typed into any field, including passwords, is never captured.
Web addresses are stripped of their parameters, so private access links (such as tenant portal links) are never transmitted.
We do not sell this data or use it for advertising.

The practical effect is that we can see that a landlord struggled on a particular screen, but not who their tenants are or any detail about them. Masking is enforced in the application’s source code, not by a setting that can be switched off in a dashboard.

If your browser sends a “Do Not Track” signal, we do not collect product analytics from you at all. To opt out otherwise, or to request deletion of analytics data associated with your account, email info@propkeep.co.za.

12. Security

We implement appropriate technical and organisational measures to protect your personal information, including:

Encryption in transit: all data transmitted between your browser and our servers is encrypted using HTTPS/TLS.
Encryption at rest: data stored in our database (Supabase) is encrypted at rest.
Access controls: row-level security (RLS) ensures that each landlord can only access their own data.
Authentication: secure password hashing and session management.

13. Children

PropKeep is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will take steps to delete it promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will provide at least 30 days' notice of material changes via the email address associated with your account. The updated policy will be posted on this page with a revised "last updated" date.

15. Information Regulator (South Africa)

If you believe your personal information has been processed in violation of POPIA, you have the right to lodge a complaint with the Information Regulator:

The Information Regulator (South Africa)

Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

P.O. Box: 31533, Braamfontein, Johannesburg, 2017

Email: enquiries@inforegulator.org.za

Complaints email: PAIAComplaints@inforegulator.org.za

Tel: 010 023 5200

Website: inforegulator.org.za

16. Contact Us

For any questions or concerns about this Privacy Policy or your personal information, please contact us:

Email: info@propkeep.co.za Website: propkeep.co.za