Privacy Policy

Your account. Your email address and password when you register, and your name and, optionally, your phone number. Passwords are stored hashed by our authentication provider; we never see them.

What you put into Proplyst. The records you create to manage your portfolio: properties and their addresses, units, tenants and their contact details, leases, invoices, payments, expenses, budgets, utility meter readings and maintenance items. If you attach a document or photograph — a receipt, a municipal bill, evidence of a repair — we store that file.

Information about tenants and other people. Proplyst lets you record details about your tenants. Where you do that, you are responsible for having a lawful basis to hold that information, and we process it on your behalf and on your instructions.

Identity and financial documents, where you choose to use those features. On the website you can record a tenant's identity number, and you or a prospective tenant can upload an identity document, proof of address, payslip or bank statement as part of a rental application. You can also store an owner's or the organisation's banking details. Identity numbers, bank account numbers and banking details are encrypted in our database rather than stored as ordinary text. The Android app does not collect any of these — it has no field for an identity number and no rental application flow.

Technical information. Ordinary server logs generated when your device contacts our servers, including IP address and timestamps, kept for security and troubleshooting.

On the website you can sign in with an email address and password, or with Google or Apple. If you choose Google or Apple, that provider tells us your email address and confirms who you are; we never see your password for that account, and we do not post anything or read anything else from it.

The Android app uses an email address and password only. It offers no Google or Apple sign-in, so using the app involves no account with either company.

If you switch on fingerprint unlock in the Android app, the check happens on your device through Android's own biometric system. Your fingerprint never leaves the device and is never sent to us — Android only tells the app whether the check passed.

Proplyst contains no advertising, analytics, attribution or crash-reporting software. We do not track you across other apps or websites, we do not build advertising profiles, and we do not collect your location, contacts, calendar, messages or browsing history.

The Android app requests no camera, photo or storage permission. When you attach a photograph or a file, Android's own camera app, photo picker and document picker hand us the single item you chose and nothing else, so Proplyst never has open access to your gallery or your files. The only permissions the app declares are internet access and fingerprint unlock.

• To provide the service and show you your own records.
• To authenticate you and keep your account secure.
• To send service messages you have asked for, such as rent reminders and payment confirmations, including by WhatsApp where you have configured it.
• To meet our legal obligations, including retention of financial records.

We do not sell your personal information, and we do not share it for advertising.

• Supabase — database, file storage and authentication.
• Render — application hosting.
• Meta Platforms — delivery of WhatsApp messages, where you enable them.
• Resend — delivery of email.
• Google Cloud (Document AI) — reading the text out of a document you upload, so its figures can be filled in for you instead of typed. A document is sent to Google only when this runs, Google processes it and returns the text, and Google does not keep the file or use it to train anything. We store what came back alongside the document.
• Cloudmersive — checking every file you upload for viruses and other malware before we store it. The file is sent to Cloudmersive only for that check, and Cloudmersive states that it does not keep the file once the check is complete.
• Google and Apple — only if you choose to sign in with them on the website, and only to confirm who you are.
• PayFast — subscription payments for Proplyst itself. Card details are handled by PayFast and never reach us. Subscriptions are bought and managed on the website; the Android app contains no payment or purchase flow at all.

Each acts only on our instructions, and none is permitted to use your data for their own purposes.

Data is encrypted in transit using HTTPS. Access is enforced at the database level by row-level security, so one organisation cannot read another's records. On Android your session is held in the device's encrypted storage and is excluded from Android's automatic backups, so it cannot be restored onto another device.

We keep your records for as long as your account is active. When you delete your account we erase the personal information attached to it — your name, email address and phone number — and permanently close it so that it can never be signed into again. We keep an anonymised sign-in record with no personal information in it, because the financial and audit entries described below reference the account that made them and would otherwise become untraceable.

We retain accounting records — invoices, payments, expenses and the audit trail — for five years, because South African tax law requires financial records to be kept for that period. Those records stay with the organisation that owns them and no longer identify you personally.

You can delete your account at any time. In the Android app, open More → Account & security → Delete account (tenants: Profile → Account & security → Delete account). On the web, use proplyst.co.za/delete-account, which also explains what to do if you can no longer sign in.

Deleting your account removes you. It does not delete the organisation you belonged to, because the property, tenant, lease and financial records in it belong to that organisation rather than to you personally, and other people may still rely on them.

If you are the only owner of an organisation, deleting your account leaves that organisation with nobody who can reach it. Transfer ownership to someone else first, or ask us to delete the organisation and its data — email notifications@genbridge.co.za from the address on the account. There is no self-service way to delete a whole organisation; we do it for you, and we will confirm when it is done.

Under the Protection of Personal Information Act (POPIA) you may ask us for a copy of the personal information we hold about you, ask us to correct it, or object to how we use it. Contact us at notifications@genbridge.co.za.

If you believe we have not handled your information properly, you may complain to the Information Regulator of South Africa.

Proplyst is business software and is not directed at children under 18.

If we change this policy we will update the version and date above and, for significant changes, tell you in the app or by email.

notifications@genbridge.co.za
https://proplyst.co.za