Privacy Notice

1. Who is responsible for your information

13TH SQUARED ENTERPRISES, trading as RentalTax Hub, is the responsible party (data controller) for the personal information described here. We process personal information in line with the Protection of Personal Information Act, 2013 (POPIA). You can contact us about privacy at support@rental-tax-hub.lovable.app.

2. What we collect and why

• Account details — name, email address and login credentials, used to create and secure your account and to contact you about the service. Legal basis: performance of our contract with you.
• Tax profile information — taxpayer type and tax reference number where you choose to provide it, used to label your tax pack. Legal basis: contract and, for optional fields, your consent.
• Rental records and uploaded documents — property details, invoices, statements, bond schedules and the figures extracted from them, used to produce your rental profit or loss calculation. Legal basis: performance of our contract with you.
• Practitioner sharing details — the email address of a tax practitioner you invite, used only to grant them read-only access you have authorised. Legal basis: contract.
• Usage, security and audit data — log-in events, actions taken in your workspace, device and browser information and IP address, used for security, fraud prevention, troubleshooting and to meet our record-keeping obligations. Legal basis: legitimate interests and legal obligation.
• Support messages — what you send us when you ask for help, used to answer you. Legal basis: legitimate interests.
• Consent records — a record of the privacy and processing consents you gave and when. Legal basis: legal obligation.

3. AI-assisted document processing

If you enable AI processing, the content of documents you upload is sent to our AI processing provider to extract dates, amounts, suppliers and categories. That content is processed to return a result to you. You can turn AI processing off in your settings and capture figures manually.

4. Who we share it with

• Service providers (operators) — our hosting, database, file storage, authentication and AI processing providers, who process personal information on our instructions only.
• Paddle.com — our Merchant of Record, for the sale of the product, payments, invoicing, refunds and tax compliance. Paddle collects and handles your payment details directly; we never see your full card details.
• Your tax practitioner — only the specific person you invite, and only the records you have shared with them.
• Professional advisers — legal and accounting advisers where necessary.
• Authorities — where we are required to disclose by law.

We do not sell your personal information and we do not use your tax records for advertising.

5. Cross-border transfers

Some of our providers process information outside South Africa. Where that happens, we rely on providers who are bound by contractual terms requiring a level of protection substantially similar to POPIA.

6. How long we keep it

We keep your account, rental records and documents for as long as your account is open, and for a reasonable period afterwards where we need to for tax, accounting or legal reasons. Payment and audit records are kept for as long as the law requires. When information is no longer needed it is deleted or anonymised. You can delete your account at any time from Settings, which removes your profile, rental records and stored documents.

7. Your rights

Under POPIA you have the right to:

• ask what personal information we hold about you and get a copy of it;
• have inaccurate or incomplete information corrected;
• have information deleted or destroyed where we no longer have grounds to keep it;
• object to processing based on legitimate interests;
• withdraw a consent you gave, without affecting processing already carried out;
• complain to the Information Regulator (South Africa) at inforegulator.org.za.

Email support@rental-tax-hub.lovable.app to exercise any of these; we aim to respond within 30 days.

8. Security

We apply appropriate technical and organisational measures, including encryption in transit, encrypted storage, private document buckets scoped to your account, row-level access controls so users can only reach their own records, and audit logging of sensitive actions. No system is perfectly secure, but we will notify you and the Information Regulator of a compromise where the law requires it.

9. Cookies and similar technologies

We use strictly necessary cookies and browser storage to keep you signed in, remember your theme preference and protect the service. Our payment provider sets cookies needed to complete checkout. We do not use advertising cookies. You can clear or block cookies in your browser, but the service will not work properly without the essential ones.

10. Changes

We may update this notice. Material changes will be notified in the app or by email, and the "last updated" date above will change.