Privacy Policy

ProperPics · Effective date: 30 September 2026

This Privacy Policy explains how ProperPics collects, uses, shares and protects personal information, in line with the Protection of Personal Information Act 4 of 2013 (POPIA). It is written for two audiences: the estate agents and agencies who use our service, and the people who contact us through this website.

1. Who we are

Warwick Brown (sole proprietor), trading as ProperPics, is the responsible party for the personal information described in this policy. Our Information Officer, registered with the Information Regulator, is Warwick Brown. You can reach us for any privacy matter at privacy@properpics.co.za.

2. Two roles: when we are the responsible party, and when we are only an operator

POPIA treats the two kinds of information we handle very differently, so we set the line out plainly:

  • Our own data: we are the responsible party. This means the website enquiry leads you send us (your name, email, agency and message) and the email addresses of registered account users. This policy governs that information.
  • The listing photographs we stage: we are only an operator. When an estate agency sends us photographs to stage, the agency is the responsible party and we process the photographs only on its instruction. Homeowners or sellers who are identifiable from a listing are not our direct data subjects: their POPIA notice, and any request to access, correct or delete that information, is handled by the instructing estate agency, not by us. If you are a homeowner with a query about a listing, please contact the agency that markets your property.

3. What personal information we collect, and where it comes from

  • Enquiry leads (collected directly from you via our enquiry form): your name, email address, agency or company name (optional), and the free-text message you write. Please do not include unnecessary personal details in the message.
  • Account users (collected when an account is set up): email address, mobile number, role, organisation, and a securely hashed password. If you reached us through one of our campaign links (for example from a social media post or an advert), we also keep that link's campaign words (the campaign's name, and which channel, kind and version of the post it was) and when you first arrived through it against your account, so we know which of our posts bring customers. It does not change what you pay or what you see.
  • Operational and security data: your IP address and timestamps, used to rate-limit the enquiry form and keep security logs. On our public marketing pages your IP address and browser details are also used, for a moment only, to work out an anonymous daily visitor count; nothing that identifies you is kept (see section 13). When you sign up, we also use your IP address to work out, on our own server, the approximate country you are connecting from, and keep only that country (for this purpose, never the IP address itself) to help us check that the details you gave at sign-up, such as the country of your mobile number, look right. It does not change the prices we offer you (country data: IP Geolocation by DB-IP).
  • Incidental information in listing photographs (handled as an operator, on the agency's instruction): the property, its contents and décor tied to a listing address. Photographs flagged as containing people are automatically excluded from staging and are never sent to the image model. Where this information is not collected from you directly, its source is the instructing estate agency.

4. Why we collect it

  • To respond to and follow up your enquiry and prepare a quote or trial.
  • To create, operate and secure user accounts and authenticate access.
  • To deliver the service to the agency (classification, virtual staging, enhancement and listing copy) on the agency's instruction.
  • For security, abuse-prevention and fraud-prevention.
  • To meet our legal, tax and record-keeping obligations.

We do not sell personal information, and we do not use client listing photographs for our own portfolio, marketing or to train AI models. We will only use your enquiry contact details for our own marketing if you have given us consent to do so (POPIA section 69).

5. Is it voluntary?

Sending us an enquiry is voluntary, but we need your name and email to reply. For account users, an email address is required to create and secure the account. For agency clients, supplying the listing photographs is necessary for us to perform the service. When you send us an enquiry, you can ask us at any time to stop using your information, or to correct or delete it (see section 11). We tell you about this right at the point we collect your information.

6. Our lawful basis (POPIA section 11)

We rely on the following justifications: for enquiry leads and account data, your consent, the steps needed to deal with your request, and our legitimate interest in running and securing the service (section 11(1)(b), (d) and (f)); for listing photographs, the instruction and authority of the responsible-party agency (section 20), which carries the homeowner's consent.

7. Who we share it with

We use a small number of operators (processors), each bound by a written contract to keep information secure and use it only on our instruction:

  • Google (Gemini / Google Cloud AI models), to sort and describe the photographs, to find an item you point to or name when you change a photograph in our do-it-yourself tool, and to write listing copy (including reading the details of a listing you import from a property portal or paste in). The photographs and the text are processed on Google's infrastructure outside South Africa (see section 8).
  • OpenAI (OpenAI's GPT Image models, through the OpenAI API), to perform the virtual staging, twilight (dusk) conversions and image edits. The photographs are processed on OpenAI's infrastructure outside South Africa (see section 8).
  • Paystack, our payment processor, when you pay us. Paystack receives your card details directly; we never see or store your full card number. We receive from Paystack a record of each payment and, if you save a card, its brand, last four digits and expiry date.
  • Cloudflare (Turnstile), on our sign-up and password-reset pages only, to check that you are a person and not an automated program. Your browser loads Cloudflare's check, which sends Cloudflare your IP address, browser details and similar technical signals, and we send Cloudflare your IP address to confirm the result. Cloudflare runs the check for us and also uses these signals to improve its own bot detection, and may process them outside South Africa (see our Cookie Notice).
  • Our hosting/infrastructure provider, our email-delivery provider, and our encrypted backup storage, by category.

We do not otherwise disclose personal information except as described here or as required by law.

8. Cross-border transfers to Google and OpenAI (POPIA section 72)

Because the AI models run on Google's and OpenAI's infrastructure outside South Africa, performing the service involves transferring personal information (the listing photographs and generated text) across the border. We rely on the ground in POPIA section 72: a written data-processing agreement with each of Google and OpenAI that provides an adequate level of protection on terms substantially similar to POPIA (including substantially-similar restrictions on onward transfer). Google is contractually bound to no training and no human review on a paid tier. OpenAI does not use data sent through its API to train its models, and keeps the images we send it for up to 30 days solely to monitor for abuse before deleting them. For the agency relationship, the operator agreement authorises these onward transfers. You may ask us for more detail about this safeguard at privacy@properpics.co.za.

9. How long we keep it

Client listing photographs and all staged outputs are automatically deleted after the job's retention window (30 days by default from delivery), and can be deleted sooner on the agency's instruction. The periods are:

  • Listing photographs and everything made from them: 30 days from delivery (14 days for a listing we never started work on).
  • Photographs added to a listing you never send: deleted after 24 hours without activity.
  • Photographs in our do-it-yourself tool: 30 days.
  • A photograph you send us on WhatsApp for a free staged room: 30 days, as in our do-it-yourself tool. We keep a one-way coded version of the number it came from, never the number itself, so each number has one free room.
  • Website enquiries: up to 365 days.
  • Phone-verification codes: 30 days.
  • Records of who accessed or changed personal information: 3 years.
  • Records of the emails we sent you (address, kind and subject, never the message): 90 days.

Account data is kept while your account is open and as long afterwards as our legal record-keeping requires, after which it is deleted or de-identified. When your account is closed, we delete its photographs, any card you saved with us, and the personal details on the account. These records remain afterwards, each for the reason given:

  • Your payments and credits (amounts, dates and what you bought): tax and accounting law requires us to keep them.
  • Free-trial checks: if you claimed a free trial listing, a one-way coded version of the mobile number you claimed it with; if your account received a free trial of our do-it-yourself tool, one-way coded versions of your mobile number and email address. Never the number or address itself. They stop the same number or address claiming a second free trial.
  • Records of who accessed or changed your account, including your closure request: 3 years.
  • The name of the campaign link you first arrived on, if it is one of our own links: it says which of our posts worked, and names no one once the account is de-identified.
  • Records of the emails we sent you: 90 days.
  • A website enquiry you sent us before you had an account: up to 365 days.
  • An invitation to join an agency that was sent to your address, and general feedback you sent us about the service (not about a listing): until you ask us to delete them.

We keep personal information no longer than is necessary for the purpose (POPIA section 14).

10. How we protect it

We use reasonable, appropriate technical and organisational measures (POPIA section 19): HTTPS/TLS encryption in transit; encryption of backups at rest; per-record, owner-scoped access control; least-privilege administrator access; automatic deletion within the retention window; the people-photo exclusion described above; and a written breach-response procedure. If we become aware of a security compromise affecting an agency's client data, we notify the agency without undue delay so it can meet its POPIA section 22 obligations.

11. Your rights, and how to use them

You have the right to: be told what personal information we hold and to access it; ask us to correct or delete it; object to processing; and withdraw any consent you gave. These rights are free of charge. You do not have to use a prescribed form. You may exercise these rights through any reasonable channel: by email to privacy@properpics.co.za, or by post to the address below. We will respond to a request to correct or delete your personal information, and tell you what action we have taken, within 30 days (POPIA sections 5, 11(3) and 23–25, as strengthened by the 2025 Amendment Regulations). Requests about a homeowner's listing photographs run through the responsible-party agency, as explained in section 2.

12. Complaints to the Information Regulator

If you are unhappy with how we have handled your personal information, you may complain to the Information Regulator (South Africa):

  • Email (POPIA complaints): POPIAComplaints@inforegulator.org.za
  • Email (general enquiries): enquiries@inforegulator.org.za
  • Website: inforegulator.org.za · Telephone: 010 023 5200 / 0800 017 160 (toll-free)
  • Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 (postal: P.O. Box 31533, Braamfontein, Johannesburg, 2017)

13. Cookies and analytics

This website sets no tracking cookies and uses no third-party analytics or advertising services. It sets first-party cookies only: the strictly-necessary session cookie that keeps you signed in (and which, before you sign in, may remember the name of the campaign link you first arrived on, described below), and a cookie named nc, set when you sign in, which tells our server not to count that device in the visitor statistics described below (it does not affect the campaign-link counts); and, if you follow a customer's referral link, a ref cookie that remembers whose link it was, so they can be credited if you sign up. Cloudflare's check on the sign-up and password-reset pages is described in section 7. We do count visits to our public marketing pages ourselves, on our own server and without using cookies to do the counting: for each day we keep the page viewed, the domain of the referring website, and a count of views. To estimate how many different visitors a day brings, we compute a one-way code from your IP address and browser details together with a secret value that changes every day. That computation uses information relating to you for a moment, which is why we describe it here, but nothing identifying is kept: your IP address is not stored for this purpose, the code cannot be reversed or linked from one day to the next once the daily value changes, and the codes themselves are deleted by an automatic daily clean-up on the second day after the day they were made, so no code is kept for more than three days; only the counts remain. Signed-in use of the service is not counted in these visitor statistics. See our Cookie Notice for the cookies we set.

Our campaign links. The links in our social media posts and adverts carry the name of their campaign (for example utm_campaign=launch-v3). When someone arrives through one, we add one to that campaign's count of clicks for the day, whether or not they are signed in (our own staff excepted); we keep no IP address or device details for this. If you are not signed in, the session cookie also remembers the campaign name of the first such link, for up to 14 days from your last visit, so that if you sign up we can see which of our posts brought you (section 3).

Our marketing emails. The links in our tips and offers emails (the ones you can unsubscribe from) pass through our own website first, so we record, against your account, whether and when you followed a link in each one. We use this only to see which of these emails are useful. We do not track whether you open an email.

14. Children and special personal information

Our service is offered to estate-agency professionals and is not directed at children. We do not knowingly collect the personal information of children. We do not seek to process special personal information; photographs that contain people, which could incidentally reveal special information, are excluded from staging by default (POPIA sections 26 and 34–35).

Changes to this policy

We may update this policy from time to time; the effective date above shows the current version. Please also read our Terms of Service, Virtual Staging Disclosure and PAIA Manual.

15. If you are in the United Kingdom

This section is for visitors and customers in the United Kingdom. Where we offer our service to people in the United Kingdom, the UK General Data Protection Regulation (the UK GDPR) applies to that processing, alongside POPIA. Everything else in this policy still describes what we actually do: what we collect (section 3), why (section 4), who we share it with (section 7), how long we keep it (section 9) and how we protect it (section 10). This section explains how those same activities are treated under the UK GDPR. Nothing here narrows any right the rest of this policy gives you.

Our lawful bases under the UK GDPR. For the purposes listed in section 4, we rely on the following bases under Article 6 of the UK GDPR:

  • Responding to your enquiry and preparing a quote or trial: steps taken at your request before entering into a contract (Article 6(1)(b)), and our legitimate interest in responding to people who contact us (Article 6(1)(f)).
  • Creating and operating user accounts: where you hold the account under your own contract with us, performance of our contract with you (Article 6(1)(b)). Where you use an account because your agency holds the contract with us, for example as a member of an agency's shared account, our legitimate interest, shared with your agency, in giving its staff working access to the service it has bought (Article 6(1)(f)).
  • Delivering the service on the agency's instruction: for the listing photographs themselves we act as a processor (the UK GDPR term for what POPIA calls an operator), processing them only on the instructing agency's documented instruction. The agency, as controller, is responsible for the lawful basis for those photographs, just as section 2 explains for POPIA. Our own basis for the related account and billing information is performance of our contract with the agency (Article 6(1)(b)).
  • Securing accounts, and security, abuse-prevention and fraud-prevention generally: our legitimate interest in keeping the service, its accounts and its users safe (Article 6(1)(f)).
  • Legal, tax and record-keeping obligations: compliance with a legal obligation (Article 6(1)(c)) where the obligation arises under laws that engage that basis, and otherwise our legitimate interest in meeting the South African laws that apply to us (Article 6(1)(f)).
  • Our own marketing to you: your consent (Article 6(1)(a)), which you may withdraw at any time, as section 4 already says.

Transfers out of the United Kingdom. Two different flows are worth separating here. First, when a UK estate agency sends us listing photographs, the agency, as controller, is making a restricted transfer of personal information out of the United Kingdom to us as its processor in South Africa, with onward processing on Google's and OpenAI's infrastructure as section 8 describes. For that transfer the agency is the exporter, and the safeguard belongs in the agency's written agreement with us (the operator agreement and our terms), not in this notice; we intend it to take the form of an Article 46 safeguard, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses. For the onward flows to Google and OpenAI, we have not yet confirmed which UK transfer mechanism each provider's data-processing terms provide, and we will update this section once that is settled. Second, when you contact us or use the service yourself from the United Kingdom, you are sending your information directly to us in South Africa. That direct disclosure by you is not a restricted transfer under the UK GDPR, so no transfer agreement applies to it; it is the information this notice itself governs, and we protect it as sections 9 and 10 describe. You may ask us for more detail about these safeguards at privacy@properpics.co.za.

Your rights under the UK GDPR. If the UK GDPR applies to you, you have the right to: access your personal information; have it corrected or erased; restrict or object to its processing; receive it in a portable form; and withdraw any consent you gave, without affecting earlier processing. We do not charge a fee for handling these requests, except where the UK GDPR permits a reasonable fee for a request that is manifestly unfounded or excessive. You can exercise them through the same route as section 11: email privacy@properpics.co.za, or post to the address below, and we will respond within 30 days, the same commitment section 11 makes. As with POPIA, requests about a homeowner's listing photographs run through the responsible estate agency (the controller), as explained in section 2.

Complaints to the ICO. If you are in the United Kingdom, you may complain to the Information Commissioner's Office (ICO) as well as, or instead of, the South African Information Regulator listed in section 12:

  • Website: ico.org.uk · Telephone: 0303 123 1113
  • Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom