Operator Agreement

You decide why and how your clients’ personal information is processed, so you are the Responsible Party for it. We process that information only to provide the service to you, so we are the Operator. We remain the Responsible Party for your own account data — your name, contact details, billing records and usage.

We process the categories of personal information you choose to record, which typically include your clients’ names, contact details, property addresses, inspection findings, photographs taken on site, quotations and invoices. We process it for the duration of your subscription and only to operate, support, secure and back up the service.

We process personal information only with your knowledge or authorisation, and only as reasonably necessary to provide the service. We do not sell it, and we do not use your clients’ personal information to market to them.

Where we use aggregated, de-identified information — for example the frequency with which a defect type appears in an area — it contains no personal information and cannot be linked back to an individual or a property.

We treat all personal information processed on your behalf as confidential, and we maintain appropriate, reasonable technical and organisational measures as required by section 19 of POPIA. These include database-level isolation between subscriber accounts, encryption in transit, access controls restricting our staff to what is necessary for support, and regular backups.

We use third parties to host and operate the service. At the date of this agreement these are Supabase (database and file storage), Vercel (application hosting), Resend (email delivery), PayFast (payment processing) and Anthropic (AI-assisted drafting features). We remain responsible to you for their processing, and we will tell you before adding a sub-operator that materially changes how your data is handled.

Some sub-operators process information outside South Africa. Section 72 of POPIA permits this where the recipient is subject to laws or binding agreements providing an adequate level of protection. We contract with each sub-operator on terms that require protection substantially similar to POPIA.

If we have reasonable grounds to believe personal information we process on your behalf has been accessed or acquired by an unauthorised person, we will notify you without undue delay and in any event within 72 hours of becoming aware of it, with the information you need to meet your own notification obligations under section 22 of POPIA to the Information Regulator and to affected data subjects.

Your clients’ requests to access, correct or delete their information should be directed to you, as the Responsible Party. Where a data subject approaches us directly we will refer them to you. We will assist you in responding, and the tools in the service let you export or delete the records concerned.

You may export your data at any time while your subscription is active. On termination we retain it for 30 days so you can retrieve it, after which we delete it from live systems on request or at the end of that period. Encrypted backups are overwritten on their normal cycle, within 90 days. We retain the minimum records we are independently required to keep — invoices and payment records — as permitted by section 14 of POPIA.

You warrant that you have a lawful basis for the personal information you record here, that you have given your clients the notice section 18 of POPIA requires, and that you will keep account credentials secure and remove users who leave your business. We are not responsible for the accuracy of information you enter, nor for inspection findings, which are the professional judgement of the inspector who made them.

Nothing in this agreement excludes liability that cannot lawfully be excluded. Subject to that, our aggregate liability arising from the processing of personal information under this agreement is limited to the subscription fees you paid us in the twelve months before the claim arose. We are not liable for the content or consequences of inspection reports produced using the service.

Queries about this agreement, or requests relating to personal information, go to hello@homeinspect.co.za.

This document is provided for use between us and our subscribers. It is not legal advice. If you have particular obligations to your own clients, take your own advice on them.