Privacy notice

• Your account: your name, email address and password (stored only as a one-way hash we can't read). If you sign in with Google, the Google account id and profile picture Google gives us.
• Your profile: province, what you mainly use Property HQ for, and anything you add about yourself. Estate agents can add their agency, PPRA registration number and a contact number, which are shown on their listings.
• Your profile photo (optional): a small square copy of the picture you choose, made in your browser before it reaches us. It is shown beside your name on your posts and comments and on the leaderboard, and deleted when you remove it or delete your account.
• Your agreement to our terms: the date, and the version of the Terms and Privacy notice you agreed to, and whether you opted in to news and tips - so we can show what you agreed to.
• Listings: the property details and photos you upload when you list a property.
• What it sold or let for (optional): if you tell us when you mark a listing sold or let. It's never shown on its own - only as part of a suburb's typical price or rent, and only once a suburb has at least 20 such figures, so no single home can be picked out.
• Enquiries: when you enquire on a listing, your name, email address, phone number (if you give it) and message.
• Community: your posts, comments and votes, and reports you make about content.
• What you save: saved deals and calculations, saved searches, saved homes (the hearts on listings - private to you) and your portfolio.
• Your budget, if you save one: your gross monthly income, debt repayments and deposit. Only you see it; we use it only to show whether listings fit your budget. You can delete it on your profile at any time, and it's deleted with your account.
• Your purchase tracker: the steps, dates and notes you record for a purchase. Only you see it.
• Outage reports: when you report a power or water outage, the suburb, day and kind of outage. Area pages show only totals, never who reported.
• Proof of ownership, if you list a property as a private seller or landlord: the document you upload (a municipal account or title deed), which your listing needs before it goes live - for security, to keep scam listings off the site and protect real owners. Only our team sees it, only to check you may sell or let the listed property, and we delete it as soon as we've decided - we keep only the decision.
• Payments: your plan, invoices and the PayFast payment reference. Card and bank details are entered on PayFast's pages and handled by PayFast - we never see or store them.
• Technical information: your IP address and basic request details in our security logs, which we use to keep accounts safe and to limit abuse (for example too many sign-in attempts).
• Calculations: when you press Calculate, what you entered and the result, with the date and time (and your account if you're signed in). The result shows a reference number, so if you ever ask us about it we can see exactly what it was. We don't record your IP address with it.
• Messages to us: what you send to our support email or through the contact form, and our replies (each becomes a support ticket). If you send a take-down notice about content, we keep the name and email address you give, your reasons and your IP address (to limit abuse).
• Email delivery: if an email to you bounces because the address doesn't exist, or you mark one as spam, we keep your address on a "do not send" list so none of our email services sends to it again.

POPIA (section 11) lets us process personal information only for a lawful reason. Ours are:

• To provide the service you signed up for (contract): your account, calculators you save, listings, enquiries, the community and your plan.
• To check our calculators and answer questions about a result (legitimate interest): the calculation records.
• To see how many people use the site and which calculators help them (legitimate interest): the visit counter in section 9, which stores nothing on your device and never keeps your IP address.
• To keep Property HQ safe (legitimate interest): preventing fraud, spam, account takeover and abuse, and enforcing our terms.
• To meet legal obligations: keeping tax and payment records, and responding to lawful requests.
• To send you news and tips (your consent): only if you opted in.

We send account emails you need (confirming your email, password resets, receipts, lead alerts you asked for) whether or not you opted in to news.

On the Investor plan and above, when the prime rate changes we email you what it does to the deals you saved (worked out from the figures in them). Turn these rate alerts off with the link in any of them, or under My profile.

Giving us your information is voluntary. Without an email address we can't create an account, and without the details a feature needs (for example a listing's address, or an enquiry's message) you can't use that feature - everything else on the site still works without signing in. Payment records are kept because tax law requires it (Tax Administration Act, section 29).

• Listers you contact: when you send an enquiry, the private seller or estate agent receives your name, email, phone number (if given) and message so they can reply.
• Other members: your display name, province, posts and the community reputation you earn (shown as a Level 1, 2 or 3 badge beside your name and on the leaderboard) are public in the community; agents' agency, PPRA number and contact number are shown on their listings and agent page.
• PayFast, to process payments and subscriptions.
• Google, if you choose "Continue with Google".
• Our email delivery services (such as Brevo, Mailjet and Resend), which deliver account, alert and support emails. We use them one after another, so each sees only the emails it delivers.
• Hosting and infrastructure providers (Cloudflare, Google Cloud), which run and protect the website.
• Our visit counter (our own tool, run on Cloudflare), which counts visits and calculator use as described in section 9. It never receives your name, email or account.
• OpenFreeMap, on pages with a map: your browser fetches the map pictures straight from OpenFreeMap, so it sees your IP address and which part of the map you view. It doesn't see who you are.
• YouTube (Google), Vimeo, Matterport, Kuula and Sketchfab, only if you press "Open the video walk-through" or "Open the 3D tour" on a listing. Until you press the button nothing is loaded from them. When you do, your browser connects to that service, which sees your IP address and device details and may set its own cookies, under its own privacy notice. We use YouTube's privacy-enhanced player. We never send them your name, email or account.
• Authorities, when the law requires it.

We don't sell your personal information and we don't share it with advertisers.

Information sent outside South Africa (POPIA section 72): some of these providers process information on servers outside South Africa. We only use providers that are subject to data-protection laws that give protection similar to POPIA, or that are bound by contract to protect it to that standard.

• Account and profile information: while your account is open. When you delete your account it is deleted or anonymised.
• Community posts and comments: after you delete your account they stay up but show "Deleted member" instead of your name, so conversations still make sense.
• Listings: closed and removed from the site when you delete your account.
• Enquiries: ones you sent keep their message but lose your name, email and phone number when you delete your account; enquiries sent to your listings are deleted with it.
• Invoices and payment records: 5 years, because tax law requires it (Tax Administration Act, section 29). They are unlinked from your profile when you delete your account.
• Security logs: a short period (about 90 days), unless needed to investigate abuse.
• Visit counts (section 9): at most 13 months, then deleted. They hold no name, email or IP address, so they can't be linked to your account.
• Calculation records: 3 years, then deleted - long enough to check our calculators and answer any question about a result. If you delete your account, they're unlinked from you straight away.
• Support tickets (your emails to us and our replies): for as long as we need them to deal with the matter and any follow-up, and no longer than 3 years.
• The "do not send" list: for as long as the address is on it - we can't email it anyway, and keeping it stops it being emailed again by mistake. Ask us and we'll remove it.
• Backups: we back up our databases and listing photos every night, so nothing is lost if a server fails. The backups are kept on our server for 7 days, and a weekly copy is kept on an encrypted computer in South Africa for up to 8 weeks. Information you delete, or that is deleted with your account, can stay in those backups until they're replaced - at most 8 weeks - and then it's gone. Invoices and payment records are kept for the 5 years above.

Passwords are stored as salted one-way hashes; the one-time links we email (confirmation, password reset) are stored only as hashes; the site is served over HTTPS; payments happen on PayFast's PCI-DSS certified pages; and access to our systems is limited to the people who run Property HQ. If a security compromise affects your information, we will tell you and the Information Regulator as POPIA section 22 requires.

Under POPIA (sections 23 to 25, 11(3) and 24) you can:

• See what we hold - use "Download my data" on your profile: a readable PDF, or a JSON file with every detail. It includes your listings, enquiries sent and received, posts, comments, votes, saved items and billing. Other people's words (such as another member's comment) are not included.
• Correct it - edit your details on your profile, or ask us.
• Delete it - use "Delete my account" on your profile.
• Object to processing based on our legitimate interest, and withdraw consent (for example to news and tips) at any time - use the toggle on your profile.
• Ask us anything about your information by email to [email protected], or through the contact form (choose "Privacy/POPIA request").

We respond to requests within a reasonable time and at no charge for a copy of your own information.

We only send news, tips and offers if you ticked "Send me Property HQ news and tips" when you signed up or turned it on in your profile (POPIA section 69). Every such email has an unsubscribe option, and you can switch it off on your profile at any time.

We use only cookies that are strictly necessary for the site to work:

• saph.auth - keeps you signed in.
• saph.external - a short-lived cookie used only while you're signing in with Google.
• An anti-forgery cookie - protects forms (such as sign-out) against cross-site request forgery.
• The live connection the site uses to update pages as you work.

And one preference cookie, set only when you choose it:

• saph_currency - the currency you picked to see amounts in (for example "USD"), kept for a year so the site remembers it after a refresh or signing out. It holds nothing else. Pick "Rands (R)" to go back to rand.

The "Recently viewed" strip on Browse listings is kept in your own browser's storage on your device (the last few homes you opened: their title, suburb, price and first picture). It is never sent to us and isn't linked to your account; press "Clear" on the strip or clear your browser's site data to remove it.

How we count visits. We count visits with our own simple visit counter so we know how many people use the site and which calculators help them. It stores nothing on your device (no cookie, nothing in your browser's storage). For each visit it receives the page you opened, the site you came from, your country and whether you are on a phone or a computer, and when you press Calculate, which calculator you used. To tell one visitor from another on the same day it turns your IP address and browser details into a scrambled code that can't be turned back and changes every day; your IP address itself is never kept. It never receives your name, email or account, isn't shared with anyone and is never used for advertising. The counts are kept for at most 13 months.

We don't use advertising or tracking cookies, so there is nothing to opt in to and no cookie banner. The one exception is something you start yourself: if you press the button on a listing's video or 3D tour, the service that hosts it (see section 4) may set its own cookies in your browser. Those cookies are theirs, not ours, and nothing from those services is loaded before you press the button.

Property HQ is meant for adults. It isn't directed at anyone under 18, and we don't knowingly collect children's information.

Our manual under the Promotion of Access to Information Act (PAIA) is available on request through the contact form.

Please contact us first - we'd like the chance to put it right. You also have the right to complain to the Information Regulator (South Africa): inforegulator.org.za, email [email protected].

If we change this notice in a way that matters, we'll tell you by email or on the site before the change takes effect.