Privacy notice

Ameon Group (Pty) Ltd (registration number 2026/014079/07), trading as EasyLandLord, operates this service. Physical and postal address: 16 St Tropez, Verdun Road, Lorraine, Gqeberha, 6070, South Africa. Cheryl van Zyl is the Director and the head of the private body.

A landlord who loads a tenant, applicant, or vendor into a portfolio is the responsible party for that person's information. EasyLandLord is the operator for that processing: it stores and displays the information on the landlord's instructions. EasyLandLord is the responsible party for landlord account information, staff logins, and subscription billing. The operator terms a landlord accepts are in the terms.

Neill Kemp is the Information Officer, duly authorised by Cheryl van Zyl, Director. Contact privacy@easylandlord.co.za. The Information Regulator registration reference is 2026-068922. We reply to emails within 2 business days.

Depending on the account and what a landlord records, this includes:

• Identity: first and last name, and a South African ID or passport number when one is stored.
• Contact: email, phone, physical address, and emergency contact name and phone.
• Lease and income: employer, monthly income, rental history, and references on an application profile.
• Signatures: the name signed on a lease, the signature image, and the IP address captured at signing.
• Inspection and maintenance photos, and the file names of lease scans and application documents.
• Rent records: invoices, charges, receipts, and ledger amounts linked to a lease. The platform does not receive tenant rent.
• The landlord's bank account details, stored so they can be printed on invoices, leases, and receipts. The account number is encrypted.
• Company mailbox settings used to send tenant email, including an encrypted password.
• Account security: a password hash, session records, and the IP address and browser stored when you accept this notice.

To create and secure accounts, invite tenants and vendors, manage properties and leases, issue invoices and record payments the landlord has received, handle maintenance, and show a person the information held about them.

Accepting this notice is stored when a landlord registers and when a tenant, vendor, or staff member accepts an invite. The record keeps the notice version, the time, and, when the request includes them, the IP address and user agent. That record shows which version was shown. It is not the lawful basis for running the service.

Landlord account and subscription information is processed to perform the contract. Tenant, applicant, and vendor information is processed by EasyLandLord as the landlord's operator, on the landlord's instructions. Where the Protection of Personal Information Act gives a right to object to processing, email privacy@easylandlord.co.za.

Tenant rent and deposits are paid into the landlord's own bank account. EasyLandLord never holds tenant money. A deposit is paid to the landlord, who must keep it in the landlord's own interest-bearing account. Paystack is used only for the landlord's subscription to this service.

These operators process information to run the service. The same names are in the PAIA manual: Vultr, domains.co.za, the mailbox provider the landlord configures, Paystack South Africa Proprietary Limited, Sentry, Cloudflare R2, OpenAI.

• Vultr hosts the application servers on a VPS in Johannesburg, South Africa. The database and the uploaded files for the application run on that server.
• domains.co.za (South Africa) provides DNS hosting and mailbox and email hosting for easylandlord.co.za, including privacy@easylandlord.co.za and support@easylandlord.co.za, and sends platform email: invites, password resets, landlord verification, subscription mail, and operations alerts.
• The mailbox provider the landlord configures sends that landlord's email to tenants and vendors. EasyLandLord does not choose that provider. The mailbox password is stored encrypted. Where that provider stores the message is the landlord's arrangement.
• Paystack South Africa Proprietary Limited (part of Stripe) processes the landlord's subscription card payment and stores the card authorisation used for later renewal charges. It does not collect tenant rent. Card numbers are collected by Paystack and are not stored on EasyLandLord servers.
• Sentry receives error reports, a sample of performance traces, and masked session replays when error monitoring is turned on. Text and inputs in a replay are masked, media is blocked, and Sentry is configured not to collect cookies.
• Cloudflare R2 stores off-site backups of the database and uploaded files.
• OpenAI receives the question and a selection of that landlord's portfolio records when the landlord uses the AI assistant.

A landlord's staff see the portfolio the landlord gives them. A vendor sees the jobs assigned to them. Personal information is not sold.

Some operators process information outside South Africa. Each transfer is made under section 72 of the Protection of Personal Information Act, on that operator's data processing agreement.

• Sentry (error monitoring and masked session replay): United States. Safeguard: Sentry's data processing agreement and section 72.
• OpenAI (the AI assistant, when a landlord uses it): United States. Safeguard: OpenAI's data processing agreement and section 72.
• Cloudflare R2 (off-site backups): Cloudflare, Inc., United States. The backup job does not pin the bucket to South Africa. Safeguard: Cloudflare's data processing addendum and section 72.
• Paystack South Africa Proprietary Limited processes the subscription card payment in South Africa. As part of Stripe, Stripe group companies may process that card data in the United States. Safeguard: the Paystack and Stripe data processing terms and section 72. Paystack does not collect tenant rent.

Vultr hosts the application servers in Johannesburg, South Africa. domains.co.za hosts DNS and the company mailboxes in South Africa. Tenant email goes through the mailbox the landlord configures. Where that provider stores the message, and in which country, is the landlord's arrangement, not a transfer chosen by this platform. The landlord's bank receives tenant payments directly. That banking relationship is the landlord's, not a transfer by this platform.

The service uses strictly necessary cookies to keep you signed in and to check that a form was sent by the site. There is no advertising cookie and no consent banner. The lifetimes below are the ones the service sets.

• ell_access. Session access token for the API. 15 minutes, or 10 minutes for a platform administrator. HttpOnly.
• ell_portal. A copy of the access token so the site can open the right portal. Same lifetime as ell_access. HttpOnly.
• ell_refresh. Refresh token, sent only to the sign-in routes. 7 days, or 2 hours for a platform administrator. HttpOnly.
• ell_csrf. Matches a header on forms that change data. 7 days. The page can read it. It is not an access token.
• ell_reset_token. Password-reset handoff. 1 hour. HttpOnly.
• ell_verify_token. Email verification handoff. 24 hours. HttpOnly.
• ell_mfa_pending. Holds the platform-administrator sign-in between the password and the authenticator. 10 minutes. HttpOnly.
• ell_impersonation. Set only while a platform administrator is viewing a landlord account. 15 minutes. HttpOnly.

Signing out clears the session cookies. While error monitoring is turned on, the browser sends error and performance events to Sentry and may record a masked replay for that browser session. About 1 in 100 ordinary sessions is recorded. A session that hits an error is recorded. Sentry does not read these cookies.

The signed-in site also keeps a few preferences in local storage on this device, such as which dashboard cards are hidden, and may keep a return path or a form draft in session storage for the tab. Passwords are not stored there. That storage stays on the device.

These are the product defaults. The same periods are written in the product retention note.

• While the subscription is active, tenant, property, lease and other operational records, and the files a landlord uploads, stay so the service can run.
• On the day a subscription or account is cancelled, normal processing and automation stop. We email the account address with a link to export the data.
• For 30 days after that cancellation the account is read-only. The landlord can export the data or reactivate the subscription. Creating and changing records stays off.
• After those 30 days a daily job deletes or irreversibly anonymises the landlord's tenant, property, lease and other operational personal information, and deletes the uploaded files themselves, not only the database rows.
• Billing and invoice records this company must keep for tax stay separately, with only the minimum details, for 5 years after the financial year they belong to. The same daily job then deletes them. The company is not VAT-registered.
• Completing an erasure request anonymises the personal fields and deletes that person's uploaded files immediately. Rent amounts, invoice totals, and ledger entries are not deleted by an erasure request.
• Bank statement lines are kept for 5 years. A daily job then redacts the description and reference. The amount stays.
• Records of the notice version you accepted are kept for at least 5 years after the account is closed. The daily deletion job does not delete them.
• A daily job deletes outbound email log rows, login-event records, and platform billing-event rows after 5 years, and deletes error-log rows after 90 days.
• Backups of the database and uploaded files expire after 35 days. Local copies and the off-site Cloudflare R2 copies are deleted after 35 days.

After you sign in, open Privacy in your portal to download a JSON or zip copy of your personal information, or to ask for erasure. A landlord administrator handles tenant and vendor requests. A platform administrator handles a landlord account-holder request.

Erasure replaces your name, email, phone, identity number, address, signature, and similar fields with an anonymised value, deletes your uploaded files, and signs you out. Rent amounts, invoice totals, and ledger entries are not deleted. You can correct contact details from the profile screens already in the portals.

You may object to processing where the Act gives that right, by email to privacy@easylandlord.co.za. You may complain to the Information Regulator if a request is refused or ignored. Website: inforegulator.org.za. Email: POPIAComplaints@inforegulator.org.za. Postal address: P.O. Box 31533, Braamfontein, Johannesburg, 2017. The PAIA manual is on the PAIA page. We reply to emails within 2 business days. Questions that the in-app page does not cover: support@easylandlord.co.za.