Privacy Policy

Version 2026-10-03.1 · Last updated 3 October 2026

This policy explains how we handle your personal information under the Protection of Personal Information Act 4 of 2013 (POPIA).

1. Who is responsible

The responsible party is SPTFR Solutions (Pty) Ltd, registration number 2026/451023/07.

2. What we collect

  • Account details — your email address.
  • Property information you enter — addresses, purchase prices, deposits and financing, rental figures, renovation costs, and related deal inputs.
  • Photos you add to a deal — property photos you take or choose from your gallery.
  • Subscription information — your plan, status, and the identifier our billing provider assigns you. We never see or store your card details.
  • Usage information — screens visited, features used, device type and app version, unless you opt out (see section 7).

3. Why we process it, and on what basis

We process your account and property information to provide the service you asked for — analysing deals, saving your work, and syncing it across your devices. The lawful basis is the performance of our contract with you.

We process usage information to understand which features are used and where the App is confusing, on the basis of our legitimate interest in improving it. You can opt out of this at any time.

4. Where your information is stored

Your information is stored on managed infrastructure operated by Supabase in London, United Kingdom. That covers your account, your saved deals, every figure and property address you enter, and the photos you attach to a deal. It is not stored in the Republic of South Africa.

This is a cross-border transfer under POPIA. Section 72 permits it where your information receives protection substantially similar to POPIA’s: the United Kingdom applies the UK GDPR, and our agreement with Supabase carries data protection terms to the same effect. Section 5 lists every other operator involved and where each one is.

5. Who else processes it, and cross-border transfers

Our hosting and several features rely on third-party operators, all of which are outside South Africa. Section 72 of POPIA permits these transfers where the recipient is subject to comparable data protection obligations under contract.

  • Hosting, database and photo storage (Supabase) — United Kingdom. Supabase operates the database and the private object storage that hold your account, your saved deals and your deal photos, in London. Photos are stored so that they survive a lost or replaced phone and can be restored to a new device. Before a photo leaves your device we strip its embedded metadata, including any GPS location your camera recorded, so the stored image carries no location trail. Stored photos are not publicly accessible and your email address is not attached to them.
  • AI analysis (OpenRouter, and the model provider it routes to) — United States. When you request an AI analysis, the deal details for that analysis are sent for processing: the property address and price, your financing and rental assumptions, the calculated metrics, and travel times from the property to nearby places. Your email address and name are not included. OpenRouter routes the request to an underlying model provider, so a sub-processor chain applies.
  • Product analytics (PostHog) — European Union. Usage events and session replays. Once you sign in, your email address, an account identifier, and your account type and subscription plan are also sent, so that a session can be linked to your account. Replays are configured to mask every text input and image, so prices and other figures you type are never recorded — only layout and navigation.
  • Maps and places data (Google) — United States. Addresses and coordinates are sent to geocode a property, find nearby amenities, and calculate travel times between a property and nearby places.
  • Transactional email (Loops). Your email address, when we send you a password-reset code or you join a waiting list.
  • Subscription management (RevenueCat) — United States. A pseudonymous subscriber identifier and your subscription status.
  • Payments (Apple, Google) — United States. Handled entirely by the app stores. We never receive your payment details.

6. How we protect it

Your information is held in a managed database and private object storage that the hosting platform encrypts at rest, and all traffic between the App and our backend is encrypted in transit. Database rules restrict every record to the account that owns it, so one account cannot read, change or delete another account’s deals or photos. Access to production systems is restricted to personnel who need it. None of this means your information is never transferred — section 5 sets out the operators we send it to. Session replays mask all text inputs and images, as described above.

7. Your choice about analytics

Usage analytics are on by default. You can turn them off at any time in the App under Settings → Legal & Privacy → Share usage analytics. When you turn them off, no usage events and no session replays are collected from that device.

8. How long we keep it

We keep your account and deal data for as long as your account is active. We do not delete data because an account has been inactive.

When you delete your account, we immediately delete your account details, your profile and settings, every deal you have saved, your deal photos, and your AI usage and nearby-places records. If you cannot sign in, you can ask us to delete your account by email, and we will do so within 7 days. Some information outlives your account:

  • Backups.Our hosting provider’s database backups may hold a copy for up to 7 days, after which it is overwritten.
  • Subscription records. RevenueCat keeps your pseudonymous subscriber identifier and purchase history, and Apple or Google keep their own purchase records under their policies, for billing, refunds and tax.
  • Usage analytics. Events PostHog collected before you deleted your account are not removed automatically. Ask us and we will delete them.

We may retain records for longer where a law requires it. Our account deletion page sets out the steps.

9. Your rights

You have the right to:

  • ask what personal information we hold about you, and get a copy of it;
  • have inaccurate information corrected;
  • ask us to delete your information and close your account;
  • object to processing based on legitimate interest; and
  • complain to the Information Regulator.

To exercise any of these, email support@yieldrise.co.za. You can contact the Information Regulator of South Africa at inforegulator.org.za or enquiries@inforegulator.org.za.

10. Children

Yieldrise is not directed at people under 18, and we do not knowingly collect their personal information.

11. Changes to this policy

We may update this policy. The version number and date at the top of this page identify the current version, and material changes will be communicated in the App or by email.