Privacy Policy

The Service is operated by SA-ArchPro (Pty) Ltd (“SA-ArchPro”, “we”, “us”), a company registered in the Republic of South Africa with registration number 2026/049810/07 and registered address at 14A Malva Rd, Dana Bay, Mossel Bay, Western Cape, South Africa.

For the purposes of POPIA, our Information Officer can be reached at info@mail.sa-archpro.com. You may direct any privacy question, request or complaint to that address.

SA-ArchPro is a practice-management platform for South African architectural practices. It holds two different roles under POPIA depending on the data in question:

• Responsible Party — for the account and identity data of the professionals who sign in (for example your name, email, phone number, SACAP registration number and professional designation, and the practice’s subscription and billing records). We decide the purpose and means of processing this data.
• Operator — for the practice data that a subscribing firm loads into the Service about its own employees, clients, consultants, contractors and projects. Here the subscribing practice is the Responsible Party and instructs us; we process that data on the practice’s behalf, under this policy and our Terms, and only to provide the Service.

If you are an employee or client of a practice that uses SA-ArchPro and you want to know how your data is handled, or to exercise your rights over it, please contact that practice (the Responsible Party) in the first instance. We will assist them as their Operator.

We collect the following categories of personal information:

• Account & profile — email address, password (stored only as a salted hash by Firebase Authentication, never in plain text), first/last name, phone number, SACAP registration number and category, professional role/designation, practice name, and — where you enable it — two-step verification with an authenticator app (the enrolment is held by Firebase Authentication; we never see the codes or the secret).
• Practice & team — firm details (name, VAT number, physical and postal address, contact email and phone, SACAP number, professional-indemnity insurance details), and employee records including role, contact details, SACAP number and remuneration data (hourly rate, hourly cost, monthly salary) that a firm chooses to capture.
• Clients, consultants & projects — client contact details and, where entered by the practice, VAT and identity (ID) numbers; consultant and contractor contacts and registration numbers; and project information such as briefs, property details (erf number, address, coordinates, zoning), budgets, documents and photographs you upload, timesheets and billing entries.
• Communications — where you link an email account, the content, subjects, recipients and attachments of messages you send and the messages the Service reads to associate them with projects (see the Google section below), and calendar events you sync. Where you connect a mailbox over IMAP, we store the mail-server address, your mailbox username and your mailbox password (encrypted at rest) solely to retrieve new messages from that mailbox on a schedule; if you choose a tidy-up option for a connected mailbox, the Service moves or deletes messages on your mail host only after they have been safely stored here, exactly as you configured. Disconnecting a mailbox deletes the stored credentials. Where you forward mail to your personal portal address, each forwarded message is received for us by our email provider (Resend) and stored in your mailbox here: its sender, recipients, subject, text, pictures and attachments, together with the results of the standard checks on whether it really came from its sender (SPF, DKIM and DMARC), which decide whether it is filed to your inbox or to Spam. Mail filed to Spam is kept, not bounced; its pictures and attachments are fetched only if you move it out of Spam.
• Billing — subscription tier, plan, status, amounts (in ZAR), payment references and an opaque PayFast recurring-payment token. We do not store your card number — see “Payments” below.
• Signatures — if you choose to save one, an image of your signature (drawn or uploaded), held so it can be applied to documents you sign. It is private to you: nobody else in your practice can see or use it, and it is never sent to any AI feature. When a document is signed we also keep a record of who signed, when, the wording they agreed to, and a digest of the exact document signed. Where a client accepts a fee proposal through a signing link, that record additionally names the email address the link was sent to, and notes that a one-time code sent to that address was verified. We keep that address solely as evidence of the signature and for security investigation — it is not used for analytics, tracking, profiling or marketing.
• Your acceptance of our terms — when you accept the Terms of Service and this Privacy Policy, the versions you accepted, when, how (at sign-up, on joining a practice, or after a change), and the IP address and browser you accepted from; and, in the same way, when you acknowledge that output from the AI features is decision support only. We keep this solely as evidence of your acceptance, and delete it with your account.
• Waitlist — if you joined our waitlist before the Service opened: your email address, your name if you gave it, and the browser you used. We use it only to send you one email when the Service opens, and delete it 30 days after we send, or try to send, that email.
• Technical & security — a hashed record of your last sign-in IP address, device/browser information and push-notification tokens for notifications, and security/audit logs (including, for team invitations, the IP address and user-agent recorded when an invitation link is opened or an account is claimed, and for signed documents, the IP address and user-agent recorded at the moment of signing).

Some of the information above is special personal information or otherwise sensitive under POPIA, and some firms may capture data about their staff and clients that falls into these categories. In particular:

• Financial information — employee remuneration (hourly rate, cost, monthly salary), practice and client VAT numbers, project budgets and billing records.
• Identity numbers — South African ID numbers and property-owner identifiers that a practice may enter for a client or a property record.

Where SA-ArchPro acts as Operator, the subscribing practice is responsible for having a lawful basis (including any consent required under POPIA) to load this information and to instruct us to process it. When a practice invites a team member, the inviting administrator must confirm an explicit data-processing consent before an invitation is sent; the Service enforces this consent gate.

We use personal information for the following purposes:

We do not sell your personal information, and we do not use it for automated decisions that have legal or similarly significant effects on you without a lawful basis and appropriate safeguards.

We rely on the following processors and third parties to run the Service. Each receives only the data needed for its function. Their locations are relevant to the cross-border section below.

We keep this list current as our processors change. We do not sell personal information to any of these parties or to anyone else.

AI assistant providers you connect yourself (for example Anthropic, OpenAI, xAI, or another provider a member selects) are not SA-ArchPro sub-processors and are deliberately left out of the table above. They are selected and contracted by the member and their practice, not by SA-ArchPro, and receive only what the assistant requests through the optional MCP connector described in the “AI assistant connections” section below.

If you connect a Google account, you may grant SA-ArchPro access to Google Calendar and Google Drive. The scopes we request, and only for the features you enable, are:

• calendar.app.created — to create a dedicated “SA-ArchPro” calendar in your Google account and manage the events on it, so appointments planned in the Service appear on your own devices. This scope reaches only the calendar the Service creates — it cannot see, change or delete events on your personal or any other calendar.
• drive.file — to upload and reference practice documents you attach to projects and email. This scope reaches only the files you pick and the files the Service itself creates — never the rest of your Drive.
• userinfo.email — to confirm which Google account you linked.

Separately, if you sign in using Continue with Google, Firebase Authentication requests the standard sign-in scopes openid, email and profile to establish who you are. They identify your account only; no practice data is read through them.

We do not read your mailbox. Doing so needs a Google restricted scope, and SA-ArchPro no longer requests it — mailbox linking is shown in the Service as “coming soon”. If we introduce it, it will run as a separate Google application with its own verification and independent security assessment, and this policy will be updated before it is switched on. Mail you send from the Email hub goes through our own delivery provider, not through your Google account.

You can disconnect a linked Google account at any time from within the Service. When you unlink an email account, we also ask Google to revoke the stored token. You can review and revoke access directly at myaccount.google.com/permissions.

If you connect QuickBooks Online, SA-ArchPro uses the Intuit Accounting scope (com.intuit.quickbooks.accounting) to synchronise practice data. Depending on the features you use, this involves reading and writing your company (realm) identifier, employee names and emails and their bill rates, and customer/client records, so that timekeeping and billing stay aligned between the two systems.

• QuickBooks data is used only to provide the accounting-sync feature you enabled.
• We do not sell QuickBooks data, and we do not use it for advertising.
• Access tokens are stored encrypted (see “How we protect information”) and are never exposed to your browser.
• You can disconnect QuickBooks at any time from the integration settings. On disconnect we make a best-effort call to Intuit’s token-revocation endpoint and remove the stored credentials. You can also disconnect from within your Intuit account.

A practice administrator may connect the practice’s own Xero organisation, operated by Xero Limited (processed in the United States and New Zealand), using OAuth 2.0. Where connected, the Service may, at the practice’s instruction, create or update contact records from the practice’s client contact details, create fee invoices, and read back invoice and payment status.

• No employee or payroll information is transmitted — the Xero integration reads no team-member record of any kind.
• Xero remains the accounting system of record; we store linkage identifiers and a cached copy of invoice status only.
• Access tokens are stored encrypted (see “How we protect information”) and are never exposed to your browser or to any other party.
• Xero data is used only to provide the feature you enabled; it is not sold, not shared with any third party, not used for advertising, and not used to train any AI model.
• You can disconnect Xero at any time from the integration settings. On disconnect we make a best-effort call to Xero’s token-revocation endpoint and delete the stored credentials.

Several optional features use Google’s Gemini API to generate output — for example analysing a project brief, drafting reports and social content, classifying an email to a project, resolving an address, and mapping spreadsheet columns during import. AI features operate on a strict data-minimisation basis: each feature transmits only the specific, minimal content it needs — for example a project’s title, brief, complexity and a banded budget range (never the client’s name or the exact contract value); spreadsheet headers together with sample values that are first automatically redacted; an email’s subject line and the sender’s domain (never the message body, recipients or the sender’s address); or the photos and instruction you explicitly select when generating social content.

AI features have no access to your employee records, salaries or rates, identity numbers, banking details or practice financial records, and none of them reads your stored documents unless you explicitly attach a document to a request (see Archie below). Before transmission, text inputs are automatically screened. Patterns resembling South African ID numbers and bank account numbers are removed and are not restored. Email addresses, phone numbers, South African business identifiers (company registration, IBAN, SWIFT and bank branch codes) and the names of your own clients, contacts and staff are replaced with placeholders before the text is sent, and the real values are substituted back into the reply once it returns — so the AI provider does not receive them, while the answer still reads normally. Text we can read inside an attachment (Word, plain text, CSV, Markdown and HTML files) is screened the same way; the contents of PDFs, images and voice notes cannot be screened and are transmitted as you attached them.

Archie, the built-in AI advisor, cannot browse, list or search any practice, project, client, employee or financial data held in the Service, and it never selects a file on its own. The content sent to the Gemini API is the text you type (after the screening described above), any voice note you record, and the specific files you choose to attach to a message — attached files are transmitted in full, so you are shown a confirmation explaining this before you attach one for the first time in a session. Choose which model handles a message from the options your platform administrator has enabled; a daily per-person limit may apply to each. Recordings are transcribed and then discarded — the audio is not stored. Files Archie produces stay in your browser unless you choose to download them or save them to your practice storage. Your Archie conversations are stored in your own private, per-user history within the Service and can be deleted by you at any time.

Please avoid pasting information into free-text AI features that you do not wish to send to this processor. As noted in the Google section, data obtained from Google Workspace scopes (Calendar/Drive) is not used to train generalised AI models. Your use of the Gemini API is additionally subject to Google’s applicable terms.

SA-ArchPro offers an optional connector, built on the open Model Context Protocol (MCP), that lets a member connect an AI assistant of their own choice (for example Anthropic Claude, OpenAI ChatGPT or xAI Grok) to their SA-ArchPro work. It is off by default. A practice owner or admin must first switch it on for the practice (Practice Settings, AI Assistant Access), and each member must then approve every connection on a consent screen while signed in to the Service. Nothing is shared with any assistant until both of those steps have happened.

Who discloses the information. When a member connects an assistant, practice and project information that the assistant requests is transmitted to that assistant’s provider and handled under that provider’s privacy terms. The member, and the practice that enabled the connector, make that disclosure; SA-ArchPro does not select, contract with or pay the provider, and the provider is not an SA-ArchPro sub-processor. The consent screen states this plainly before a member approves a connection. Members should read the chosen provider’s privacy terms, including any statement about whether conversations are retained or used for training, before connecting.

What is transmitted. The connector acts as the member. It exposes only a defined set of tools, and each tool returns only what the assistant asks for and only what the member’s own role permissions in the practice allow. The categories an assistant can request are: the practice profile and summary figures; project details and status; tasks and the member’s own timesheet; document metadata and the text of generated documents; the names of contacts and clients; quotes (where the member’s role permits); risks; calendar entries; and email drafts that the member asks the assistant to write.

What is never transmitted. The connector never sends the contact details of clients, consultants, contractors, suppliers or staff: no email addresses, telephone numbers, identity numbers or registration numbers. It never sends employee remuneration or rates, banking details, or document files or file contents. Fee figures are provided as percentages only, never as currency amounts. Contacts are referred to by name and an opaque handle; when the member asks the assistant to draft an email, SA-ArchPro resolves the addresses itself when it saves the draft, so the assistant never sees them.

What the assistant cannot do. There is no tool through which an assistant can send email, sign, issue, approve or void a document, delete a record, or download a file. Those remain actions that a person performs in the Service, and the connector cannot be configured to perform them.

Security, records and revocation. Connections are authorised with OAuth 2.1 and PKCE; no client secrets are issued. Access tokens expire after one hour, and refresh tokens expire 30 days after they are first issued, so a member must re-consent at least monthly. Every action taken through the connector is recorded in the practice audit log under the member’s name. A member can revoke a connection at any time (My Account, AI Assistant Connections), and a practice owner or admin can revoke every connection in the practice by switching the connector off. SA-ArchPro stores only the connection record and the audit entries; it does not receive or store the assistant’s conversation. The assistant provider may be located outside South Africa; the cross-border section below applies to information the member chooses to disclose in this way, on the basis of the member’s consent.

Subscription payments are processed by PayFast, a South African payment gateway. When you subscribe or change plans, we send PayFast the amount (in ZAR), an item description and identifiers for your practice and account. Your card or banking details are entered on PayFast’s secure pages and are handled by PayFast — SA-ArchPro never receives or stores your full card number. For recurring billing we store only an opaque token issued by PayFast, which cannot be used to reconstruct your card. Payment-outcome notifications from PayFast are validated (by signature, passphrase and source) before we act on them.

We rely on the conditions in section 72 of POPIA for these transfers, namely one or more of the following:

• the recipient is subject to a law, binding corporate rules or a binding agreement that upholds principles of lawful processing substantially similar to POPIA and that includes provisions substantially similar to POPIA’s own conditions for onward trans-border transfer (we contract with our processors on data-protection terms to this effect);
• the transfer is necessary for the performance of the contract between you (or your practice) and us, or to take steps at your request before entering into it; or
• you have consented to the transfer.

Where you are in the EEA or UK, we likewise rely on appropriate safeguards (such as the relevant standard contractual clauses) for transfers outside your region.

We take the security of personal information seriously and apply technical and organisational safeguards, including:

• Encryption in transit using current TLS, and application encryption of the stored OAuth tokens (both refresh and access tokens) for Google Calendar, Google Drive, QuickBooks, Xero and BuildSphere, and of mailbox passwords for IMAP connections, using AES with a key held in Google Secret Manager. This is in addition to the encryption at rest that Google Cloud applies to all stored data.
• Server-only secret storage. Sensitive data — including OAuth state and integration tokens — is held in database tables that browsers cannot read or write at all; only our own server-side services can reach it.
• Access control. Each person in a practice holds one of seven roles (Intern, Candidate, Junior Professional, Senior Professional, Admin, Partner and Owner), and the practice can adjust what a role, or one person, may do. Our servers check these permissions on every request, and the database itself keeps each practice’s data separate from every other practice’s.
• Abuse and bot protection via Google reCAPTCHA Enterprise and Firebase App Check, and optional two-step verification for sign-in with an authenticator app.
• Minimised sensitive handling. Team-invitation links are stored only as SHA-256 hashes; passwords are hashed by Firebase Authentication; and security and billing audit logs are append-only.

If a breach happens. We record every suspected or confirmed security breach involving personal information in our breach register as soon as we discover it. Where the information belongs to a practice (we are its Operator), we tell the practice within 72 hours, and help it notify the Information Regulator and the people affected. Where the information is our own (for example your account details and the invoices we issue), we notify the Information Regulator and the people affected ourselves, without undue delay, as section 22 of POPIA requires.

No method of transmission or storage is perfectly secure. While we work to protect your information, we cannot guarantee absolute security; we are continuing to strengthen our controls.

We keep personal information for as long as your account or your practice’s account is active and as needed to provide the Service, and thereafter as required by law or for legitimate business records:

• Financial, billing and audit records — written by our systems only, and not editable or deletable from within the Service, so they form a tamper-evident history of your billing. We keep them for as long as your practice’s account exists. This in-Service history is not archived independently of your account: if the practice is closed and the deletion period elapses, it is deleted along with the rest of the practice’s data. (The invoices we issued to you are a separate record that we must keep — see the next point.) You can export the full billing history as a CSV file at any time, and you should do so if you need to satisfy your own statutory record-keeping obligations.
• Invoices we issue to you, and our own accounting records — when your practice pays us for a subscription or an add-on, we issue an invoice in our own name (a tax invoice, once we are registered for VAT) and keep a copy, together with the corresponding entry in our own accounting records. We are obliged to retain these: the Companies Act, 2008 requires a company to keep its accounting records for seven years, and the Tax Administration Act, 2011 separately requires tax records to be kept for five years. We apply the longer period — seven years, the same period we already apply to the minimal record kept after a practice is purged — so we keep them even after your practice’s account has been deleted, and we cannot delete them at your request while that obligation runs. This is permitted under section 14 of POPIA, which allows us to retain records for longer where retention is required or authorised by law.
• What those records contain — only what an invoice must show and what our books must record: your practice’s name and address, its VAT number if it has given us one, what was bought, the amount and VAT, the date, and the payment reference. They are held separately from your practice’s working data in the Service, are used only for accounting, tax and audit purposes, and are not used to contact you, to build a profile, or for any form of analysis or marketing. Where we record these amounts in our own accounting software, individual practices are not identified to that provider — the entries are aggregated and carry only our own invoice number and the payment reference.
• Account, practice and project data — retained while the account is active; on termination it is exported or deleted as described in our Terms and below.
• Security and dispatch logs — retained for a period proportionate to the security, audit and abuse-prevention purpose for which they are kept.

Subject to POPIA (and, if applicable to you, the GDPR/UK GDPR), you have the right to request access to the personal information we hold about you; to have it corrected or updated; to have it deleted; to object to certain processing; to withdraw a consent you have given; and, in some cases, to data portability. You will not be unfairly discriminated against for exercising these rights.

The Service already provides several ways to exercise these rights directly:

• Correct your profile and practice details in the account settings.
• Remove a team member — a practice owner/admin can remove a member, which revokes their access to the practice across every layer.
• Disconnect integrations — unlink Google, QuickBooks, Xero, BuildSphere or a mailbox connected over IMAP, which removes the stored tokens or credentials and (for the email link, QuickBooks and Xero) asks the provider to revoke access.
• Revoke an AI assistant connection from My Account (AI Assistant Connections); a practice owner or admin can switch the connector off for the whole practice in Practice Settings.
• Export your billing history to CSV from the subscription area.
• Take a full copy of your data — practice and project records, contacts and documents can be downloaded from within the Service at any time, including while a practice is read-only.
• Delete your account from My Account. A member’s access ends at once; an owner deleting the practice starts a 30-day window in which it can be restored, after which its data is permanently erased (subject to the records we must keep, above).

For any request we cannot fully action in-product — including access to, or deletion of, data held about you — contact info@mail.sa-archpro.com (or your practice, where it is the Responsible Party). If you are not satisfied with how we handle your request, you may lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za (or, if you are in the EEA/UK, with your local supervisory authority).

SA-ArchPro uses cookies and browser local storage that are essential for sign-in, session security and remembering your preferences, and analytics to keep the Service reliable and improve it. Where enabled, limited marketing/personalisation features may also be used. We ask for your cookie preferences when you first use the Service, in line with POPIA, and you can change them at any time from “Cookie preferences” in the footer of our public pages. Analytics is Google Analytics, which runs only if you allow analytics cookies. We also use Google reCAPTCHA Enterprise and Firebase App Check for security, and Google Maps Platform for maps and address search inside the Service; these set their own cookies and are subject to Google’s privacy terms.

The Service is a professional tool intended for registered architectural professionals and their practices. It is not directed to children and we do not knowingly collect personal information from children. If you believe a child’s information has been provided to us, please contact us so we can address it.

We may update this Privacy Policy from time to time. When we make material changes we will update the effective date above and ask you to accept the revised policy the next time you sign in; we record the version you accept and when.

Questions, requests or complaints: info@mail.sa-archpro.com (Information Officer) · SA-ArchPro (Pty) Ltd, 14A Malva Rd, Dana Bay, Mossel Bay, Western Cape, South Africa.

Our manual in terms of section 51 of the Promotion of Access to Information Act, 2 of 2000, sets out the records we hold and how to request access to them. It is available free of charge: download the PAIA Manual (PDF).