Privacy Policy

Vumelo is operated by Eazylet Solutions (Pty) Ltd (private company registered in the Republic of South Africa, registration 2025/780828/07 (registered with the CIPC, South Africa)), of 3 Raglan Street, Oakdale, Bellville, Western Cape, South Africa. We are the “responsible party” for the personal information described here. Our Information Officer is Retha van Rooyen (getinfo@mystudenthouse.co.za).

• Account details: your name, email address and your password. Your password is turned into a one-way bcrypt hash on our server; we never store it in a form anyone can read.
• Your sign-up, before you confirm it: your email address, name, password hash, consent choices and a hashed copy of your IP address, kept until you use the link we email you. The link works for 24 hours, and when you open it we ask for the password you chose, so it only works for the person who filled in the form. Your account only exists once the link is confirmed.
• A keyed hash of your email address (in a standard, normalised form) when you start a free trial, so each person gets one free trial.
• Your property and accreditation data: addresses, room and bed details, compliance documents, grading and deal inputs, and cash-tracker figures.
• Documents you upload, such as title deeds and certificates, and a security log of who opened, downloaded or deleted each one and when (section 7).
• Billing details: our payment provider, Paystack, processes your card. We keep the plan, amounts, dates, payment references and the card’s brand and last four digits, never the full card number.
• Your email choices and consent records: which emails you turned on or off, and what you agreed to, which version and when.
• Technical and security data: IP address, device and browser details, and the log records we need to run and secure the service. Our sign-up, log-in and password reset forms, and a few other account steps, can run a bot check (Cloudflare Turnstile, section 5) to tell people from bots; when it runs, Cloudflare processes your IP address and browser signals.
• Advertising-measurement data collected by the Meta Pixel on our public pages and when you sign up, open the checkout or pay (see section 3 and our Cookie Notice).

Where you upload information about another person (for example a tenant or student), you are the responsible party for that data. See section 10.

We process your information to provide the service you signed up for: creating your account, running the grading, deal-analysis and cash-tracking tools, storing your documents, sending your renewal reminders and billing you. Our lawful basis is POPIA s11(1)(b): processing that is necessary to conclude and perform our contract with you. We also process to meet legal obligations (for example tax records) and to protect the security of the service, including rate limits and, when it runs, the bot check (our legitimate interest, s11(1)(f)).

One free trial per person: when you start a trial we compare a keyed hash of your email address with those of earlier trials. This stops the free trial being claimed again and again, which is our legitimate interest (s11(1)(f)). We keep the hash, never the email address itself, for 24 months. Sign-ups from throwaway email domains are not accepted.

Advertising measurement: we use the Meta Pixel to see which of our Facebook and Instagram adverts bring people to Vumelo and lead to sign-ups and paid plans. It runs on our public pages (home, sign-up, log-in and legal pages), where it reports a page view and, on the sign-up page, that you created an account. It also loads on the checkout and payment confirmation pages, only to report that you opened the checkout for a paid plan or that a payment was confirmed (with the plan name and price). It sees only the site and the path of each page: we take advert parameters off the address first, and keep an advert’s click id (fbclid) only as Meta’s own _fbc cookie. These events also pass through Datahash, our operator for Meta’s Conversions API Gateway, which forwards them to Meta from its own servers. Our own server also sends the sign-up, checkout and payment events to Meta (the Conversions API) with a hashed (SHA-256) copy of your email address and account number, your IP address and browser details, so Meta can match them to a Facebook or Instagram account. We may also give Meta a hashed list of customer email addresses to build advert audiences (people similar to our customers, and excluding people who already subscribe). We never send your name or anything you keep in your account. Our lawful basis is our legitimate interest in measuring and improving our advertising (POPIA s11(1)(f)). You may object at any time (s11(3)) by switching it off on the Cookie Notice or in your account settings, which also stops our server sending your events and leaves you out of customer lists; we send nothing when your browser sends a Global Privacy Control or Do Not Track signal.

Email: accreditation renewal reminders and notices about your subscription (receipts and the annual renewal notice) are part of the service. So are security notices: we email you when your password is changed, when your data export is downloaded and when your account is deleted, so you notice if someone else did it. In a team, we email the team owner when someone joins with the team code, every member when the owner switches on cross collaboration, and every member when the team closes (the owner disbands it or deletes their account). NSFAS news alerts and product updates are marketing: we send them only if you turn them on (POPIA s69), we record that choice with the date, and you can turn them off at any time in your account settings or with the unsubscribe link in every one of those emails. We record that too.

The account and service data above is required to use Vumelo. Without it we cannot provide the tools you are paying for. Marketing consent is entirely voluntary, and objecting to the Meta Pixel does not affect your account either.

We do not sell your personal information. We share it with the service providers (POPIA “operators”) that help us run Vumelo. Each may use it only to provide its service to us, and must keep it secure and confidential and tell us about a breach, under the data-processing terms it offers its business customers:

• Supabase: database, sign-in and private document storage (European Union).
• Paystack: card payments and subscriptions (South Africa / Nigeria).
• Resend: account, billing and alert emails (renewal reminders, and NSFAS news if you turn it on) (United States / EU).
• Vercel: application hosting and server logs (United States / global edge network).
• Upstash (Upstash, Inc.): security rate limits (short-lived counters keyed by IP address, account number or a hashed email address), the site’s access setting, sign-in session records for our own staff, and a short-lived advert-measurement record for checkouts (your account number, a hashed email address and a hashed account number, Meta’s cookie ids, IP address and browser details) (outside South Africa).
• Cloudflare Turnstile (Cloudflare, Inc.): a bot check our sign-up, log-in and password reset forms, and a few other account steps, can run to tell people from bots; when it runs, Cloudflare processes your IP address and browser signals (outside South Africa).
• Datahash: Meta Conversions API Gateway: receives our Meta Pixel events and passes them on to Meta (outside South Africa).

We also share limited information with Meta for advertising measurement. Meta acts in two roles. When it matches our events and hashed customer lists to Facebook and Instagram accounts and reports the results back to us, it processes that information for us under its business terms for these tools. When it uses the information to deliver and improve adverts and its own products, it is a separate responsible party and its own privacy policy applies.

• Meta Platforms Ireland Limited (Meta Platforms, Inc. in the United States): measuring and improving our Facebook and Instagram adverts: the Meta Pixel, events sent from our server (Conversions API) with a hashed email address and account id, and hashed customer email lists for advert audiences (Ireland / United States).

We may also disclose information where the law requires it, or to establish, exercise or defend a legal claim.

Most of the providers in section 5 process information outside South Africa; section 5 says where, or “outside South Africa” where we cannot name a single country. We transfer information to them only on a basis POPIA section 72 allows:

• For our database, hosting, payments and email (Supabase, Vercel, Paystack and Resend), the transfer is necessary to perform our contract with you (s72(1)(c)).
• Our operators (Supabase, Paystack, Resend, Vercel, Upstash, Cloudflare and Datahash) process it under their data-processing terms, which oblige them to protect it in a way substantially similar to POPIA, including for any further transfer (s72(1)(a)).
• Meta Platforms Ireland Limited is subject to the EU General Data Protection Regulation, a law that gives protection substantially similar to POPIA, including for further transfers (s72(1)(a)). Meta’s own transfers to Meta Platforms, Inc. in the United States are made under the safeguards that law requires.

• Your account, properties, gradings, deals, cash records, documents and settings: While your account is open. Deleting the account deletes them; stored files are removed from storage within about 24 hours of the property or account being deleted.
• A sign-up you have not confirmed (email address, name, password hash, consent choices and a hashed IP address): Deleted as soon as you use the link we email you. The link works for 24 hours; a sign-up whose link was never used is deleted within a day after it expires. The account only exists once the link is confirmed.
• An account whose email address was never confirmed: Deleted by our daily clean-up once it is 48 hours old, so within about 72 hours.
• A keyed hash (HMAC-SHA256) of the normalised email address of every account that had a free trial: 24 months, even after the account is deleted, so that each person gets one free trial.
• Consent records (what you agreed to, which version and when): 5 years after the account is deleted. At deletion we remove the hashed IP address and browser details and keep only a SHA-256 hash of your email address.
• Payment records (amount, date, plan and payment references, trimmed of card tokens, contact details and IP address): 5 years from the date of the payment, for tax (Tax Administration Act), even if the account is deleted sooner.
• A checkout you started but did not pay for (plan, price and payment reference): Deleted after 30 days.
• A security log of who opened, downloaded or deleted each stored document (the file, the organisation, the acting account’s id, the action and the time): 12 months, and deleted with the organisation it belongs to. If someone you shared a property with deletes their own account, their account id stays in your log.
• A record of each account deletion (a SHA-256 hash of the email address, the organisation ids deleted, who asked for it and how each step went): 5 years, so we can show that the deletion was done.
• A record of each action our staff take on an account (what was done, when, by which staff member, the account’s email address and, for trial changes, the previous trial settings): Kept for security and accountability. The account’s email address is removed after 12 months, or sooner when the account is deleted, and the staff member’s IP address and network and browser tags after 12 months.
• Service health records (error alerts and scheduled-job runs): 90 days.
• Security rate-limit counters, staff sign-in session records and alert markers in Upstash: Between 10 minutes and 24 hours.
• The advert-measurement record for a checkout, and markers that stop one advert event being reported to Meta twice (an account number or a payment reference): The checkout record up to 14 days; the markers up to 400 days.

Apart from these, we delete or de-identify personal information when it is no longer needed for the purpose it was collected for or to meet a legal obligation. Copies in our providers’ backups are overwritten on their normal backup cycle.

Under POPIA you may: ask what personal information we hold about you and get a copy; ask us to correct or delete inaccurate, irrelevant or excess information; object to processing on reasonable grounds, including the Meta Pixel at any time (switch it off on the Cookie Notice); and withdraw any consent you gave, for example to marketing email, in your account settings or with the unsubscribe link in those emails. To exercise any of these, contact getinfo@mystudenthouse.co.za. You also have the right to complain to the Information Regulator (details in section 15).

Our grading and deal-analysis tools produce scores and indications from the inputs you provide. These are decision-support outputs, not automated decisions that are made about you with legal or similarly significant effect. If you believe an output has materially affected you and want it reviewed by a person, contact getinfo@mystudenthouse.co.za and we will review it.

If you upload a tenant’s, student’s or other person’s personal information, you are the responsible party for that information and you confirm you have a lawful basis and, where required, their consent, and that you have given them the notice POPIA requires. We process it only as your operator, to provide the service to you, on the terms in section 9 of our Terms of Service (POPIA s21).

We use appropriate technical and organisational security measures (POPIA s19): encrypted connections, private-by-default document storage with short-lived signed access, per-account data isolation, passwords stored only as bcrypt hashes, rate limits on sign-up and sign-in, access controls and logging. No system is perfectly secure, but we work to protect your information and to detect and respond to incidents.

If there are reasonable grounds to believe your personal information has been accessed by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, as POPIA s22 requires.

We use a small number of cookies and some browser storage to keep you signed in and the service secure, and the Meta Pixel on our public pages to measure our adverts. When our sign-up, log-in and password reset forms run the Cloudflare bot check, it may also keep a little data in your browser. If you switch the Meta Pixel off, our server sets a cookie that remembers that choice for 400 days. See our Cookie Notice for the full list of cookies and browser storage keys, and your choices.

Vumelo is for people aged 18 or older (see section 3 of our Terms of Service) and is not aimed at children. We do not knowingly collect the personal information of a person under 18 who is not legally competent without the consent of a competent person (POPIA s34–35). If you believe a child’s information has reached us, contact getinfo@mystudenthouse.co.za and we will address it.

Our Information Officer is Retha van Rooyen, getinfo@mystudenthouse.co.za. If we cannot resolve a concern, you may complain to the Information Regulator (South Africa): complaints.IR@inforegulator.org.za · https://inforegulator.org.za.

We may update this policy. When we make a material change we will update the “last updated” date and, where the change affects how we use your information, ask you to review and accept it again.

Privacy questions: getinfo@mystudenthouse.co.za. General support: getinfo@mystudenthouse.co.za. Post: 3 Raglan Street, Oakdale, Bellville, Western Cape, South Africa.