Privacy, in plain language

Who we are

Deed is operated by ONDEED (PTY) LTD, registration number K2026637325, a company incorporated in South Africa. For POPIA, ONDEED (PTY) LTD is the responsible party for your account data, and the operator for the client data you load into Deed.

Our Information Officer is Marius du Toit, reachable at hello@ondeed.co.za. Any privacy question, request or complaint can go straight to that address.

What we collect

Your account details: name, email address and, if you link it, your WhatsApp number.

Your workspace content: the contacts, listings, deals, notes and messages you bring into Deed or connect through channels like WhatsApp, your calendar or portal imports.

Technical basics: sign-in events and logs that keep the service secure and let us fix problems.

Giving us this information is voluntary, but Deed cannot run without an email address to sign you in, and connected channels only work with the details those channels need.

Why we collect it

Only to run Deed for you: drafting replies for your approval, keeping your book tidy, showing your diary, and letting your team work together.

We never sell your data, we never share it with advertisers, and we don't use your book to market to your clients.

How the AI handles messages

When Deed drafts a reply, the message is processed by an AI model. Before that happens, personal identifiers such as ID numbers, card numbers, email addresses and phone numbers are automatically redacted.

The AI provider processes that redacted text in the United States, under contract terms that forbid using it to train models. If that guarantee cannot be confirmed for a request, Deed falls back to a plain template instead of sending anything to the model.

Nothing is ever sent to a client without you approving it first, unless you have explicitly switched on a rule that says otherwise, and every AI action is recorded in an audit trail you can inspect.

Who helps us run Deed

A small set of service providers process data on our instructions, as POPIA operators. Supabase hosts our database, sign-in and file storage in Ireland. Vercel hosts the application itself. Meta's WhatsApp Business Platform carries WhatsApp messages. Resend carries transactional and forwarded email. If you connect your Microsoft 365 or Google account, those providers process your calendar and mail under the access you granted, which you can revoke at any time.

Each of them is bound by contract to protect your data and to use it only to provide their service to us.

Where your data lives

Your data is stored in Ireland, inside the European Union, where data protection law offers safeguards substantially similar to POPIA.

Two things cross to the United States: redacted message text sent to our AI provider for drafting, and email passing through our email provider. Both transfers rest on contracts that hold the recipient to obligations consistent with POPIA, as section 72 requires.

Your clients' data

Your book stays yours. As the agent or agency, you are the responsible party for the client information you load into Deed; we process it on your instructions as your operator, and protect it accordingly.

Your rights under POPIA

You can ask what we hold about you, ask us to correct it, ask us to delete it, or object to how we process it. Email hello@ondeed.co.za and we'll act on it promptly, and at no charge for a first request.

If you believe we've handled your information badly and we haven't put it right, you can complain to The Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001, or by email to POPIAComplaints@inforegulator.org.za.

Keeping and protecting data

We keep your data while your account is active and delete it on request when you leave. Data is encrypted in transit and at rest, access is tightly controlled, and changes are audited.

Access to records (PAIA)

Our manual under the Promotion of Access to Information Act, which explains how to request records we hold, is published at ondeed.co.za/paia.

Changes

Deed is in early access, so this policy will grow with the product. When it changes, the update lands on this page with a new date at the top.