1. Who we are
Usika Digital (Pty) Ltd (“Usika”, “we”, “us”) operates the Usika property management platform at usika.co.za. We are the responsible party for personal information we collect and process, as defined by the Protection of Personal Information Act 4 of 2013 (“POPIA”).
Contact us at: privacy@usika.co.za
2. What information we collect
Landlord account information
- Full name and email address (required for account creation)
- Phone number (optional, used for account identification)
- POPIA consent timestamp (recorded at registration)
Property information
- Property address, type, and rental amount
- Maintenance request details and photos
- Financial records (renovation costs, benchmarks)
Tenant information
- Full name, email address, and phone number
- South African ID number (optional)
- Lease start/end dates and rental amount
- Rent payment history
- Documents uploaded by the landlord (lease agreements, etc.)
- Consent to receive automated rent reminders
Usage information
- Log data (IP address, browser type) retained by our hosting provider (Vercel)
- Email delivery logs (whether a reminder was sent and its status)
3. Why we collect it (purpose)
- To provide the service: Landlord accounts, property and tenant management, rent tracking, and reporting.
- Automated reminders: Sending rent reminder emails and SMS messages to tenants who have explicitly consented to receive them.
- Monthly summaries: Sending landlords a monthly portfolio report via email.
- Security and compliance: Preventing fraud, complying with legal obligations, and maintaining audit logs.
4. Legal basis for processing
We process personal information on the following grounds under POPIA:
- Consent: Landlords provide explicit consent at registration. Tenants provide consent before receiving automated reminders.
- Contractual necessity: Processing required to provide the service you signed up for.
- Legitimate interest: Security logging and fraud prevention.
5. How we protect your information
- All personal data is stored on servers in the United Kingdom (Supabase, hosted on AWS eu-west-2, London). There is currently no Supabase data centre in South Africa. A migration to AWS af-south-1 (Cape Town) is planned following product-market fit. See Section 8 for cross-border transfer disclosures required under POPIA Section 72.
- Database access is controlled by Row Level Security — each user can only access their own data
- All files are stored in private buckets requiring signed URLs
- Passwords are never stored in plain text (managed by Supabase Auth)
- API keys and secrets are never exposed client-side
- All data is transmitted over HTTPS/TLS
6. How long we keep your information
We retain your personal information for as long as your account is active. When you delete your account, all your data — including properties, tenants, payment records, and uploaded documents — is permanently deleted from our systems. Backups may retain data for up to 30 days after deletion.
7. Sharing of information
We do not sell your personal information. We share data only with:
- Supabase — database and authentication (data processor)
- Vercel — hosting and serverless functions (data processor)
- SendGrid (Twilio) — email delivery (data processor, for reminder and summary emails)
- Twilio — SMS delivery (data processor, for SMS reminders)
- Legal authorities, if required by South African law
8. Cross-border transfers (POPIA Section 72)
Usika transfers personal information outside South Africa to the processors listed in Section 7. Supabase, which stores all database, authentication, and file-storage data, processes this data in the United Kingdom(AWS eu-west-2, London). The UK maintains its own comprehensive data protection framework (UK GDPR and the Data Protection Act 2018), separate from the EU’s regime. Usika has not obtained a specific adequacy determination for the UK under POPIA Section 72 and does not rely on one; the lawful bases below are the operative basis for this transfer regardless of jurisdiction. Vercel, SendGrid, and Twilio are US-incorporated processors. Transfers are made on the following lawful bases under section 72 of POPIA:
- Data subject consent: Landlords consent to cross-border processing at account registration. Tenant portal users consent via the POPIA gate before any personal data is displayed.
- Contractual necessity: Transfers are necessary to perform the service agreement between Usika and the landlord.
The processors, their jurisdictions, and the data categories transferred are:
| Processor | Jurisdiction | Data transferred |
|---|
| Supabase Inc | United Kingdom (AWS eu-west-2, London) | All personal data — database, authentication, file storage |
| Vercel Inc | United States (global edge) | Request metadata and server-side logs |
| Twilio SendGrid | United States | Email address, property address, rent amount (email delivery) |
| Twilio Inc | United States | Phone number, property address, rent amount (SMS delivery) |
Each processor operates under a Data Processing Agreement (DPA) with Usika. Usika has reviewed the standard contractual terms of each provider and is satisfied that adequate contractual safeguards are in place for the transfer of personal information.
Planned migration: Usika intends to migrate its primary data store to AWS af-south-1 (Cape Town, South Africa) following product-market fit, which will reduce or eliminate the need for cross-border transfers for database data.
9. Your rights under POPIA
As a data subject, you have the right to:
- Access your personal information held by us
- Correct inaccurate information
- Delete your account and all associated data — available in Settings → Delete account
- Object to processing for direct marketing
- Lodge a complaint with the Information Regulator at inforegulator.org.za
To exercise any of these rights, contact us at privacy@usika.co.za. We will respond within 30 days.
10. Tenant reminder opt-out
Tenants who receive automated rent reminders may withdraw consent at any time by contacting their landlord or by visiting usika.co.za/unsubscribe. Once consent is withdrawn, no further reminders will be sent.
11. Changes to this policy
We may update this policy from time to time. Material changes will be communicated via email or an in-app notice. Continued use of Usika after changes constitutes acceptance of the updated policy.