Privacy policy

This policy explains what personal information RealShare collects, why we collect it, who we share it with and what you can do about it. It is written to meet the Protection of Personal Information Act, 2013 (POPIA).

We have tried to write it in plain language. If anything here is unclear, write to us and we will explain it.

Who we are

RealShare is a product of Sticky Pebble, a private company registered in South Africa under registration number 2026/566743/07. We are the responsible party for the personal information described here. The address below is the company's registered office as recorded with CIPC. The quickest way to reach us is always by email.

What we collect

Information you give us

• Your account: your name, email address and a password. We never store the password itself, only a one way cryptographic hash of it, which cannot be turned back into your password.
• Your professional profile: agency name, job title, PPRA registration number, phone number, WhatsApp number, public email address, website, office location and the areas you serve. This information exists so it can be placed on the marketing you publish, so most of it is intended to be public.
• Your brand images: the headshot and agency logo you upload, and the colours taken from that logo.
• Support messages you send us, and the account they relate to.

Information we collect when you use the service

• Property listings you import. When you paste a listing address, we read the public listing page and store what it contains: the property address, price, room counts, description and photographs, together with any edits you make.
• Your channel connections. When you connect a channel, we store the account name and identifier, and an access token that lets us publish on your behalf. Tokens are encrypted before they are stored.
• The posts you create, including the wording generated for you, your edits, when you published or scheduled them, and whether publishing succeeded or failed.
• Performance figures read back from the platforms for the posts we published for you, such as reach, likes, comments and clicks.
• Subscription and usage records: your plan, trial dates, counts of how much you have used each month, and a record of each payment: the date, the amount and Paystack's reference for it.
• Technical and security records: an activity log of what happens in your account, and a tamper evident audit trail of important account actions, which records the IP address and device details each action came from. The audit trail is kept after an account is closed, so that break in attempts can still be investigated, as Delete my data explains. For a short period we also keep your IP address and email address against failed sign in attempts, so we can stop people trying to break into accounts.

What we do not collect

We do not store card numbers. Payments are taken by Paystack on its own secure page, so your card number, expiry date and security code go to Paystack and never reach us. From Paystack we keep only what we need to run your subscription: its references for you and your subscription, and the card type and last four digits, so you can recognise which card is on file.

We do not read your Facebook or Instagram messages, your friends, or anyone else's posts. Our access is limited to the Pages and accounts you choose, and to the posts our own app created.

Why we use it, and on what legal basis

Who we share it with

We do not sell your personal information, and we do not share it for anyone else's marketing. We use the following companies to run the service. POPIA calls them operators. Each one is bound to use the information only for the purpose we give it.

A social platform only receives a post when you publish or schedule one to it. Once a post is on your own Facebook Page or Instagram account, it is governed by that platform's own terms and privacy policy, and by your relationship with them.

YouTube API Services

If you connect a YouTube channel, RealShare uses YouTube API Services to publish videos to it on your behalf. This section explains what that involves, in addition to what is already described above.

What we access. When you connect your YouTube channel, we read your channel id and channel name, so the app can show you which channel it will upload to.

What we upload. Only the video and wording you have composed and approved inside RealShare, and only to your own channel. We never upload anything you have not approved, and never to a channel other than the one you connected.

What we store. Your channel id, your channel name, and an access token and refresh token that let us publish on your behalf. The tokens are encrypted before they are stored, the same as every other channel connection described above. We do not keep the video itself for this purpose beyond the media storage already described earlier on this page, under What we collect.

We access, store and use this information only to publish the videos you approve to your own YouTube channel, and for no other purpose.

Using this feature also means you agree to the YouTube Terms of Service. Google explains what it does with your information in its own Privacy Policy.

You can revoke RealShare's access to your YouTube channel at any time from Google's own permissions page at myaccount.google.com/permissions, or disconnect it inside RealShare from the Connections page using the Disconnect button.

TikTok

If you connect a TikTok account, RealShare uses TikTok's Login Kit and Content Posting API to publish posts to it on your behalf. This section explains what that involves, in addition to what is already described above.

What we access. When you connect your TikTok account, we read the identifier TikTok assigns to it, along with your username, display name and profile photo, so the app can show you which account a post is about to go to. Before each post we also read the posting settings your account allows, such as which visibility choices are available and whether comments, duet and stitch are enabled, so the send screen only ever offers what your account permits.

What we post. Only the content and wording you have composed and approved inside RealShare, and only to your own account. Property listings are promotional, so every post carries TikTok's promotional content disclosure.

What we store. Your account identifier, your username, an access token and refresh token that let us publish on your behalf, and the posting choices you make for each post, such as its visibility and interaction settings. The tokens are encrypted before they are stored, the same as every other channel connection described above.

We access, store and use this information only to publish the posts you approve to your own TikTok account, and for no other purpose.

Using this feature also means you agree to the TikTok Terms of Service. TikTok explains what it does with your information in its own Privacy Policy.

You can revoke RealShare's access to your TikTok account at any time inside the TikTok app, under Settings and privacy, then Security and permissions, then Manage app permissions, or disconnect it inside RealShare from the Connections page using the Disconnect button.

Sending information outside South Africa

The companies above operate servers outside South Africa, mainly in Europe and the United States, so your information is stored and processed there. That includes Paystack, which processes your card payments and may handle your payment details outside South Africa. The companies that run the service for us are contractually bound to protect it to a standard comparable to POPIA, as section 72 of the Act allows. Email you send us passes through ImprovMX and Gmail under their own terms, because you chose to write to us, and a post reaches a social platform only because you asked us to publish it there.

Cookies

We only use the cookies the service needs to work: one that keeps you signed in, one that remembers your sign up while you enter the code we email you, short lived ones that keep a channel connection secure while you connect it, and one that marks when our administrator is viewing an account to help its owner. We do not use advertising or tracking cookies.

How long we keep it

• Your account and profile: for as long as your account is open.
• Draft posts you never send: deleted automatically after 24 hours.
• Listings, posts and performance figures: while your account is open, because they are your marketing record.
• Activity log: cleared from time to time, once its entries have been dealt with.
• Audit trail: kept after your account is closed, as Delete my data explains.
• Failed sign in records: a short period, then deleted automatically.
• Financial records: five years, as South African law requires.
• Backups: database backups are stored encrypted and kept for up to twelve months, then deleted. Information you delete can survive in a backup until that backup expires.

How we protect it

• The site is served only over an encrypted connection.
• Passwords are hashed, never stored or recoverable in readable form.
• The access tokens for your social channels are encrypted before being stored.
• Sign in, sign up and password reset are rate limited to slow down anyone guessing at accounts.
• Important account actions are written to an audit trail that shows if it has been tampered with.

No service can promise perfect security. If a breach affects your personal information, we will notify you and the Information Regulator (South Africa) as POPIA requires.

Your rights

Under POPIA you may:

• ask what personal information we hold about you, and get a copy
• ask us to correct anything that is wrong or incomplete
• ask us to delete your information, subject to records we must keep by law
• object to a particular use of your information
• withdraw a consent you gave, such as a connected channel
• complain to the regulator

Most of this you can do yourself inside the app: your profile is editable at any time, and a channel can be disconnected from the Connections page whenever you like. For anything else, write to support@realshare.co.za and we will tell you in writing what we have done within 30 days. To delete your account and its data, see Delete my data. To ask for a copy of records we hold, see our PAIA manual.

If you are not satisfied with our answer, you may complain to the Information Regulator (South Africa) on its eServices portal or by email to POPIAComplaints@inforegulator.org.za. Its office is at Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191, and its phone number is 010 023 5200.

Information about other people

When you import a property listing you are giving us information created by someone else, and when you publish it you are marketing a property you must be entitled to market. You are responsible for having the right to do both. We ask you to confirm this before a listing is imported.

Children

RealShare is a tool for working estate agents and is not intended for anyone under 18. We do not knowingly collect information about children.

Changes to this policy

If we change how we use personal information, we will update this page and change the date at the bottom. If the change is significant we will tell you in the app or by email rather than relying on you noticing.