Privacy Policy

ProperPics · Effective date: 11 August 2026

This Privacy Policy explains how ProperPics collects, uses, shares and protects personal information, in line with the Protection of Personal Information Act 4 of 2013 (POPIA). It is written for two audiences: the estate agents and agencies who use our service, and the people who contact us through this website.

1. Who we are

Warwick Brown (sole proprietor), trading as ProperPics, is the responsible party for the personal information described in this policy. Our Information Officer, registered with the Information Regulator, is Warwick Brown. You can reach us for any privacy matter at privacy@properpics.co.za.

2. Two roles: when we are the responsible party, and when we are only an operator

POPIA treats the two kinds of information we handle very differently, so we set the line out plainly:

Our own data: we are the responsible party. This means the website enquiry leads you send us (your name, email, agency and message) and the email addresses of registered account users. This policy governs that information.
The listing photographs we stage: we are only an operator. When an estate agency sends us photographs to stage, the agency is the responsible party and we process the photographs only on its instruction. Homeowners or sellers who are identifiable from a listing are not our direct data subjects: their POPIA notice, and any request to access, correct or delete that information, is handled by the instructing estate agency, not by us. If you are a homeowner with a query about a listing, please contact the agency that markets your property.

3. What personal information we collect, and where it comes from

Enquiry leads (collected directly from you via our enquiry form): your name, email address, agency or company name (optional), and the free-text message you write. Please do not include unnecessary personal details in the message.
Account users (collected when an account is set up): email address, role, organisation, and a securely hashed password.
Operational and security data: your IP address and timestamps, used to rate-limit the enquiry form and keep security logs. On our public marketing pages your IP address and browser details are also used, for a moment only, to work out an anonymous daily visitor count; nothing that identifies you is kept (see section 13).
Incidental information in listing photographs (handled as an operator, on the agency's instruction): the property, its contents and décor tied to a listing address. Photographs flagged as containing people are automatically excluded from staging and are never sent to the image model. Where this information is not collected from you directly, its source is the instructing estate agency.

4. Why we collect it

To respond to and follow up your enquiry and prepare a quote or trial.
To create, operate and secure user accounts and authenticate access.
To deliver the service to the agency (classification, virtual staging, enhancement and listing copy) on the agency's instruction.
For security, abuse-prevention and fraud-prevention.
To meet our legal, tax and record-keeping obligations.

We do not sell personal information, and we do not use client listing photographs for our own portfolio, marketing or to train AI models. We will only use your enquiry contact details for our own marketing if you have given us consent to do so (POPIA section 69).

5. Is it voluntary?

Sending us an enquiry is voluntary, but we need your name and email to reply. For account users, an email address is required to create and secure the account. For agency clients, supplying the listing photographs is necessary for us to perform the service. When you send us an enquiry, you can ask us at any time to stop using your information, or to correct or delete it (see section 11). We tell you about this right at the point we collect your information.

6. Our lawful basis (POPIA section 11)

We rely on the following justifications: for enquiry leads and account data, your consent, the steps needed to deal with your request, and our legitimate interest in running and securing the service (section 11(1)(b), (d) and (f)); for listing photographs, the instruction and authority of the responsible-party agency (section 20), which carries the homeowner's consent.

7. Who we share it with

We use a small number of operators (processors), each bound by a written contract to keep information secure and use it only on our instruction:

Google (Gemini / Google Cloud AI models), to perform the virtual staging, enhancement and listing-copy generation. The photographs and the text we generate are processed on Google's infrastructure outside South Africa (see section 8).
Our hosting/infrastructure provider, our email-delivery provider, and our encrypted backup storage, by category.

We do not otherwise disclose personal information except as described here or as required by law.

8. Cross-border transfer to Google (POPIA section 72)

Because the AI models run on Google's infrastructure outside South Africa, performing the service involves transferring personal information (the listing photographs and generated text) across the border. We rely on the ground in POPIA section 72: a written data-processing agreement with Google that provides an adequate level of protection on terms substantially similar to POPIA (including substantially-similar restrictions on onward transfer), with Google contractually bound to no training and no human review on a paid tier, and, for the agency relationship, the operator agreement authorises this onward transfer. You may ask us for more detail about this safeguard at privacy@properpics.co.za.

9. How long we keep it

Client listing photographs and all staged outputs are automatically deleted after the job's retention window (30 days by default from delivery), and can be deleted sooner on the agency's instruction. Enquiry-lead records and account data are kept only as long as needed for the enquiry or account relationship and our legal record-keeping, after which they are deleted or de-identified. We keep personal information no longer than is necessary for the purpose (POPIA section 14).

10. How we protect it

We use reasonable, appropriate technical and organisational measures (POPIA section 19): HTTPS/TLS encryption in transit; encryption of backups at rest; per-record, owner-scoped access control; least-privilege administrator access; automatic deletion within the retention window; the people-photo exclusion described above; and a written breach-response procedure. If we become aware of a security compromise affecting an agency's client data, we notify the agency without undue delay so it can meet its POPIA section 22 obligations.

11. Your rights, and how to use them

You have the right to: be told what personal information we hold and to access it; ask us to correct or delete it; object to processing; and withdraw any consent you gave. These rights are free of charge. You do not have to use a prescribed form. You may exercise these rights through any reasonable channel: by email to privacy@properpics.co.za, or by post to the address below. We will respond to a request to correct or delete your personal information, and tell you what action we have taken, within 30 days (POPIA sections 5, 11(3) and 23–25, as strengthened by the 2025 Amendment Regulations). Requests about a homeowner's listing photographs run through the responsible-party agency, as explained in section 2.

12. Complaints to the Information Regulator

If you are unhappy with how we have handled your personal information, you may complain to the Information Regulator (South Africa):

Email (POPIA complaints): POPIAComplaints@inforegulator.org.za
Email (general enquiries): enquiries@inforegulator.org.za
Website: inforegulator.org.za · Telephone: 010 023 5200 / 0800 017 160 (toll-free)
Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 (postal: P.O. Box 31533, Braamfontein, Johannesburg, 2017)

13. Cookies and analytics

This website sets no tracking cookies and uses no third-party analytics or advertising services. It sets two first-party cookies: the strictly-necessary session cookie that keeps you signed in, and a cookie named nc, set when you sign in, which does the opposite of tracking: it tells our server not to count that device in the visitor statistics described below. We do count visits to our public marketing pages ourselves, on our own server and without using cookies to do the counting: for each day we keep the page viewed, the domain of the referring website, and a count of views. To estimate how many different visitors a day brings, we compute a one-way code from your IP address and browser details together with a secret value that changes every day. That computation uses information relating to you for a moment, which is why we describe it here, but nothing identifying is kept: your IP address is not stored for this purpose, the code cannot be reversed or linked from one day to the next once the daily value changes, and the codes themselves are deleted by an automatic daily clean-up on the second day after the day they were made, so no code is kept for more than three days; only the counts remain. Signed-in use of the service is not counted. See our Cookie Notice for the cookies we set.

14. Children and special personal information

Our service is offered to estate-agency professionals and is not directed at children. We do not knowingly collect the personal information of children. We do not seek to process special personal information; photographs that contain people, which could incidentally reveal special information, are excluded from staging by default (POPIA sections 26 and 34–35).

Changes to this policy

We may update this policy from time to time; the effective date above shows the current version. Please also read our Terms of Service, Virtual Staging Disclosure and PAIA Manual.

15. If you are in the United Kingdom

This section is for visitors and customers in the United Kingdom. Where we offer our service to people in the United Kingdom, the UK General Data Protection Regulation (the UK GDPR) applies to that processing, alongside POPIA. Everything else in this policy still describes what we actually do: what we collect (section 3), why (section 4), who we share it with (section 7), how long we keep it (section 9) and how we protect it (section 10). This section explains how those same activities are treated under the UK GDPR. Nothing here narrows any right the rest of this policy gives you.

Our lawful bases under the UK GDPR. For the purposes listed in section 4, we rely on the following bases under Article 6 of the UK GDPR:

Responding to your enquiry and preparing a quote or trial: steps taken at your request before entering into a contract (Article 6(1)(b)), and our legitimate interest in responding to people who contact us (Article 6(1)(f)).
Creating and operating user accounts: where you hold the account under your own contract with us, performance of our contract with you (Article 6(1)(b)). Where you use an account because your agency holds the contract with us, for example as a member of an agency's shared account, our legitimate interest, shared with your agency, in giving its staff working access to the service it has bought (Article 6(1)(f)).
Delivering the service on the agency's instruction: for the listing photographs themselves we act as a processor (the UK GDPR term for what POPIA calls an operator), processing them only on the instructing agency's documented instruction. The agency, as controller, is responsible for the lawful basis for those photographs, just as section 2 explains for POPIA. Our own basis for the related account and billing information is performance of our contract with the agency (Article 6(1)(b)).
Securing accounts, and security, abuse-prevention and fraud-prevention generally: our legitimate interest in keeping the service, its accounts and its users safe (Article 6(1)(f)).
Legal, tax and record-keeping obligations: compliance with a legal obligation (Article 6(1)(c)) where the obligation arises under laws that engage that basis, and otherwise our legitimate interest in meeting the South African laws that apply to us (Article 6(1)(f)).
Our own marketing to you: your consent (Article 6(1)(a)), which you may withdraw at any time, as section 4 already says.

Transfers out of the United Kingdom. Two different flows are worth separating here. First, when a UK estate agency sends us listing photographs, the agency, as controller, is making a restricted transfer of personal information out of the United Kingdom to us as its processor in South Africa, with onward processing on Google's infrastructure as section 8 describes. For that transfer the agency is the exporter, and the safeguard belongs in the agency's written agreement with us (the operator agreement and our terms), not in this notice; we intend it to take the form of an Article 46 safeguard, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses. For the onward flow to Google, we have not yet confirmed which UK transfer mechanism Google's data-processing terms provide, and we will update this section once that is settled. Second, when you contact us or use the service yourself from the United Kingdom, you are sending your information directly to us in South Africa. That direct disclosure by you is not a restricted transfer under the UK GDPR, so no transfer agreement applies to it; it is the information this notice itself governs, and we protect it as sections 9 and 10 describe. You may ask us for more detail about these safeguards at privacy@properpics.co.za.

Your rights under the UK GDPR. If the UK GDPR applies to you, you have the right to: access your personal information; have it corrected or erased; restrict or object to its processing; receive it in a portable form; and withdraw any consent you gave, without affecting earlier processing. We do not charge a fee for handling these requests, except where the UK GDPR permits a reasonable fee for a request that is manifestly unfounded or excessive. You can exercise them through the same route as section 11: email privacy@properpics.co.za, or post to the address below, and we will respond within 30 days, the same commitment section 11 makes. As with POPIA, requests about a homeowner's listing photographs run through the responsible estate agency (the controller), as explained in section 2.

Complaints to the ICO. If you are in the United Kingdom, you may complain to the Information Commissioner's Office (ICO) as well as, or instead of, the South African Information Regulator listed in section 12:

Website: ico.org.uk · Telephone: 0303 123 1113
Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom

Who we are: Warwick Brown (sole proprietor), trading as ProperPics.; Registration: Not applicable (sole proprietorship, no CIPC registration)
Address: 18 Murray Avenue, Morningside Manor, Sandton, Gauteng, South Africa
Contact: General: hello@properpics.co.za; Privacy / data requests: privacy@properpics.co.za
Information Officer (POPIA): Warwick Brown