Privacy Policy

Version 2026-08-04.1 · Last updated 4 August 2026

This policy explains how we handle your personal information under the Protection of Personal Information Act 4 of 2013 (POPIA).

1. Who is responsible

The responsible party is SPTFR Solutions (Pty) Ltd, registration number 2026/451023/07.

2. What we collect

  • Account details — your email address and, if supplied, your first and last name.
  • Financial information you enter — gross income, existing debt, deposit amounts, and budget preferences.
  • Property information you enter — addresses, purchase prices, rental figures, renovation costs, and related deal inputs.
  • Photos you add to a deal — property photos you take or choose from your gallery.
  • Household and lifestyle inputs — household composition, work location, commute origin, and ownership horizon, where you supply them.
  • Subscription information — your plan, status, and the identifier our billing provider assigns you. We never see or store your card details.
  • Usage information — screens visited, features used, device type and app version, unless you opt out (see section 7).

3. Why we process it, and on what basis

We process your account, financial and property information to provide the service you asked for — analysing deals, calculating affordability, saving your work, and syncing it across your devices. The lawful basis is the performance of our contract with you.

We process usage information to understand which features are used and where the App is confusing, on the basis of our legitimate interest in improving it. You can opt out of this at any time.

4. Where your information is stored

Our application servers and database are self-hosted on infrastructure located in the Republic of South Africa. Your account, your saved deals, and every income figure and property address you enter are stored in South Africa and do not leave the country as part of our core service, except for the transfers described in section 5. The one part of your deal data stored outside South Africa is deal photos, described in section 5.

5. Who else processes it, and cross-border transfers

Some features rely on third-party operators, and some of these are outside South Africa. Section 72 of POPIA permits these transfers where the recipient is subject to comparable data protection obligations under contract.

  • AI analysis (OpenRouter, and the model provider it routes to) — United States. When you request an AI analysis, the deal details for that analysis are sent for processing: the property address and price, your financing and rental assumptions, and the calculated metrics. Where you have supplied them, this also includes your household composition, your work situation and work area, your commute destinations and the travel times to them, your stated priorities, and your gross income band. Your email address and name are not included. OpenRouter routes the request to an underlying model provider, so a sub-processor chain applies.
  • Product analytics (PostHog) — European Union. Usage events and session replays. Once you sign in, your email address, an account identifier, and your account type and subscription plan are also sent, so that a session can be linked to your account. Replays are configured to mask every text input and image, so incomes, prices and other figures you type are never recorded — only layout and navigation.
  • Deal photo storage (Cloudflare) — outside South Africa. Photos you add to a deal are stored in private object storage operated by Cloudflare, so they survive a lost or replaced phone and can be restored to a new device. Before a photo is stored, we strip its embedded metadata — including any GPS location your camera recorded — so the stored image carries no location trail. Your name and email address are not attached to stored photos, and the storage is not publicly accessible.
  • Maps and places data (Google) — United States. Addresses and coordinates are sent to geocode a property, find nearby amenities, and calculate travel times between a property and the locations you enter.
  • Transactional email (Loops). Your email address, when we send you a password-reset code or you join a waiting list.
  • Subscription management (RevenueCat) — United States. A pseudonymous subscriber identifier and your subscription status.
  • Payments (Apple, Google) — United States. Handled entirely by the app stores. We never receive your payment details.

6. How we protect it

Identity fields, including your email address and name, are encrypted at rest in our own database. That protects the copy we hold; it does not mean the information is never transferred, and section 5 sets out the operators we send it to. All traffic between the App and our servers is encrypted in transit. Access to production systems is restricted to personnel who need it. Session replays mask all text inputs and images, as described above.

7. Your choice about analytics

Usage analytics are on by default. You can turn them off at any time in the App under Settings → Legal & Privacy → Share usage analytics. When you turn them off, no usage events and no session replays are collected from that device.

8. How long we keep it

We keep your account and deal data for as long as your account is active. When you delete your account, we delete your data immediately — we do not hold it for any retention period afterwards. We do not delete data because an account has been inactive. We may retain records for longer where a law requires it.

9. Your rights

You have the right to:

  • ask what personal information we hold about you, and get a copy of it;
  • have inaccurate information corrected;
  • ask us to delete your information and close your account;
  • object to processing based on legitimate interest; and
  • complain to the Information Regulator.

To exercise any of these, email support@yieldrise.co.za. You can contact the Information Regulator of South Africa at inforegulator.org.za or enquiries@inforegulator.org.za.

10. Children

Yieldrise is not directed at people under 18, and we do not knowingly collect their personal information.

11. Changes to this policy

We may update this policy. The version number and date at the top of this page identify the current version, and material changes will be communicated in the App or by email.