Privacy policy

HomeFlow is a South African rental management platform operated at homeflow.co.za. For the purposes of the Protection of Personal Information Act, 2013 (POPIA), HomeFlow is the responsible party for the personal information described below.

Information officer contact: privacy@homeflow.co.za.

Account information: name, email address, phone number, profile photo and the role you use (landlord or tenant).

Property information: addresses, descriptions, photos, rent and deposit amounts, lease dates and lease documents.

Vetting information you choose to submit: identity documents, payslips, bank statements, proof of address, employer letters and references.

Financial records: rent, utility and deposit payments, proofs of payment you forward to us, deposit interest calculations and deductions.

Maintenance information: issue descriptions, severity and photos you upload.

Ratings and reviews: star ratings, public comments and private notes exchanged at the end of a lease.

Technical information: log data needed to keep the service secure and working.

To create and operate your account and your landlord or tenant workspace.

To publish listings you ask us to publish, and to match applications to those listings.

To vet prospective tenants where a landlord requires it and you consent to the check.

To record and reconcile rent, utility and deposit payments, and to calculate interest on deposits held.

To manage maintenance requests, lease renewals and end-of-lease reviews.

To send transactional email such as invitations, reminders and statements.

To comply with legal obligations and to prevent fraud or abuse.

Other users only where the relationship requires it: a landlord sees the profile, application and vetting outcome of a tenant who applied to or rents their property; a tenant sees the landlord of a listing they applied to or rent.

Supabase — database, authentication and encrypted document storage.

Resend — outbound and inbound transactional email.

An identity verification provider, where identity checks are performed.

Professional advisers, or authorities where we are legally required to disclose.

We do not sell personal information and we do not use it for third-party advertising.

Some of our processors host data outside South Africa. Where that happens we rely on the processor's contractual safeguards, as permitted by section 72 of POPIA.

Account and lease records are kept for the duration of the relationship and then for as long as required by law (generally five years for financial records).

Vetting documents are kept only as long as needed for the application or lease and are deleted on request once no longer required.

Forwarded invoices and proofs of payment are retained as the financial paper trail for the lease.

You may ask us what personal information we hold about you, ask us to correct or delete it, object to processing, or withdraw consent for optional processing such as vetting.

You can update most details yourself from your profile page. For anything else, email privacy@homeflow.co.za and we will respond within a reasonable time.

You may also lodge a complaint with the Information Regulator (South Africa) at inforeg@justice.gov.za.

Documents are stored in private buckets and are only reachable through short-lived signed links. Database access is restricted by row-level security so records are visible only to the people connected to them. Passwords are hashed and never visible to us.

We use only essential storage: a session token that keeps you signed in and preferences such as your chosen workspace. We do not use advertising or third-party tracking cookies.

If we change this notice materially we will tell you by email or in the app before the change takes effect.