Privacy Policy

1. Introduction

THEPA is a South African property operating platform. This Privacy Policy explains how we collect, use, store, and share personal information when you use www.thepa.app, dashboard.thepa.app, auth.thepa.app, invoice.thepa.app, and related THEPA services (together, the Platform).

Our processing of personal information is governed primarily by the Protection of Personal Information Act 4 of 2013 (POPIA). THEPA is the Responsible Party for platform account, billing, security, and marketing-form processing. When a customer organisation stores tenant, contractor, or property records in the Platform, that organisation is typically the Responsible Party for those records and THEPA processes them on the organisation’s behalf.

This policy should be read with our Cookie Policy, which describes cookies and similar technologies in more detail.

2. Information we collect

2.1 Information you provide

• Account: name, email address, and credentials (password, passkey, magic link, or optional Google Sign-In). You may add a profile image.
• Organisation and property data: properties, units, contacts, reservations, invoices, documents, messages, maintenance, and related records you create in the dashboard.
• Billing: organisation subscription details in THEPA. Card numbers are collected and stored by Polar, not in THEPA’s database.
• Support and waitlist: contact details you submit on public forms.

2.2 Information collected automatically

• Approximate country: we read a country code from Cloudflare or Vercel request headers to frame the public homepage map. That country code is not written to our database and is not used to decide whether to show the cookie banner.
• Session: an HttpOnly authentication cookie issued after you sign in (Better Auth). Absolute lifetime is 7 days, with a 24-hour rolling refresh and a 5-minute cookie cache.
• Analytics and measurement: page views and similar events via Google Analytics 4, Google Tag Manager, Microsoft Clarity, and Vercel Analytics when those tools are configured in production. See the Cookie Policy for which of these wait for banner consent.
• Error monitoring: diagnostic events sent to Sentry (stack traces, URLs, and related technical context). We set sendDefaultPii to false and mask session replay text; that is not a guarantee that no personal information ever appears in an error payload.
• Maps: Mapbox receives map tile, geocode, and (on the dashboard) interactive map requests. The public homepage uses Mapbox static images; signed-in maps use Mapbox GL.
• Security signals: Cloudflare Turnstile when captcha keys are set; Have I Been Pwned range checks on password paths; rate-limit and security-event records in our database.

3. How we use information

• Provide, secure, and operate the Platform (accounts, organisations, property operations, hosted invoices).
• Authenticate you and keep you signed in.
• Send transactional email (verification, password reset, invitations, product notices) via Resend.
• Deliver in-app notifications via Knock.
• Bill subscriptions and issue invoices (Polar holds cards).
• Measure product and marketing performance (GA4, GTM/Ads conversion events, Clarity, Vercel Analytics).
• Detect and fix errors (Sentry).
• Frame public map content by approximate country.
• Power optional AI features using platform or organisation-configured language-model providers.
• Comply with law and protect the security of the Platform.

4. Operators and other recipients

The operators in the current product are:

• Convex (Ireland, eu-west-1): primary product and authentication database, including small files.
• Vercel: application hosting and edge.
• Cloudflare R2: large file storage. Cloudflare Turnstile provides captcha when enabled.
• Better Auth: self-hosted authentication on Convex.
• Resend: transactional email.
• Knock: in-app notification feed.
• Polar: subscriptions and card vault. Cards stay at Polar.
• Sentry: error monitoring.
• Sanity: public CMS for marketing and legal pages.
• Mapbox: maps and geocoding.
• Google: optional Sign-In; Tag Manager; Analytics 4; Ads conversion tags configured in the GTM container.
• Microsoft Clarity: session and interaction analytics after analytics consent.
• Vercel Analytics: first-party performance measurement, not gated by the cookie banner.
• Have I Been Pwned: compromised-password range checks.
• Language-model providers: AI chat and embeddings, either from platform configuration or keys an organisation stores for its own workspace.

Each operator has its own privacy terms. Cross-border processing (including Ireland, the United States, and other operator regions) is a fact of this stack. Contractual safeguards and POPIA section 72 assessments are maintained by THEPA’s privacy function, not in this page.

5. Storage and security

• Database: Convex in Ireland, encrypted at rest by the platform.
• Files: Convex file storage for small objects; Cloudflare R2 for large/multipart uploads, with short-lived signed URLs.
• Sessions: HttpOnly, Secure (on HTTPS), SameSite=Lax cookies. Platform admin uses a separate HttpOnly cookie (thepa_admin_jwt, 1 hour), not a token in localStorage.
• Passwords: hashed; minimum length 15; Have I Been Pwned checks; sessions revoked on password reset.

We do not run a customer-managed encryption key vault, and we do not store bank account / IBAN fields on financial accounts. Cards are at Polar.

6. Your rights (POPIA)

You have rights under POPIA, including to request access to, correction of, or deletion of your personal information, and to object to certain processing. You can delete your own account from signed-in settings. Organisation-held tenant or contractor records are managed by that organisation.

You can change analytics-banner preferences through the cookie banner (stored as cookie-consent in localStorage for 365 days). Declining analytics stops Google Tag Manager and Microsoft Clarity from loading. It does not currently stop landing Google Analytics 4, Vercel Analytics, or Sentry.

If you are in the European Economic Area, additional rights under EU data protection law may also apply to you. THEPA’s primary legal framework remains POPIA.

To exercise these rights, use in-app account settings or the contact options on our support page.

7. Retention

We do not operate a product-wide job that deletes or anonymises personal information 30 days after account closure.

• Your account: deleted immediately when you delete it in settings.
• Organisation product data and files: retained until the organisation (or the relevant product records) is deleted. File bytes are purged after organisation offboarding.
• Finance and CRM records: retained for the life of the organisation. There is no automatic year-based purge.
• Security events: retained with the organisation; no time-to-live job today.
• Backups: Convex Cloud managed snapshots of the live database. Restoring a snapshot can reintroduce deleted rows until that snapshot ages out under Convex’s backup retention, which is configured in the Convex dashboard rather than in application code.
• Operator logs: Resend, Sentry, Google Analytics, Clarity, GTM, Polar, Knock, and similar vendors retain data under their own policies. THEPA does not drive a 30-day wipe in those systems.

8. Cookies and similar technologies

Details, including which tools wait for the banner, are in the Cookie Policy.

The cookie banner is shown to all visitors. It is not limited to the EEA. Approximate country is not used to gate the banner.

9. Changes

We will update this page and the “Last updated” date when our processing changes in a material way. The published policy is meant to describe the Platform as it actually runs.

10. Contact

Questions about this policy, or POPIA access, correction, or deletion requests, can be sent through the contact options on our support page. Information Officer appointment is a separate THEPA governance step.

11. Payment processing

Paid plans and guest invoice payments are processed by Polar. Polar is an operator for card vault and checkout. THEPA stores plan slug, Polar customer and subscription identifiers, invoice records, and billing contact email. We do not store full card numbers. Guest invoice payers provide the details needed to complete that payment.