Privacy Policy

Selara is used by estate agencies and their agents (our “customers”). We handle two broad groups of information: (a) our customers’ account information, and (b) information about the property enquirers (“leads”) who contact those agencies. When an agency uses Selara to handle enquiries, the agency is the responsible party for its leads’ information, and Selara acts as its operator (processor).

• Account information: name, email, phone number, agency/branch details, and login credentials.
• Listing information: property details you enter to generate content and publish listings.
• Enquiry (lead) information:a lead’s name, WhatsApp or phone number, and the content of messages they send, so we can respond and arrange viewings.
• Review information: publicly available Google review content and author names, where the agency has connected its Google Business Profile.
• Calendar information:where an agent connects their Google Calendar, the times they are busy or free, and the viewing appointments Selara creates on their behalf — including the date, time, property address, and the lead’s name and email address as an invitee.
• Usage information: basic logs needed to operate and secure the service.

• To generate listing descriptions and marketing content at the agent’s request.
• To draft and, with approval, publish responses to reviews.
• To reply to property enquiries on the agency’s behalf, qualify enquiries, and schedule property viewings.
• To provide, secure, support, and improve the service.

AI-generated drafts pass through a human approval step before anything is published, and agents can take over any conversation at any time.

Where an agency connects a WhatsApp Business number, we receive messages that leads send to that number via the WhatsApp Business Platform (Meta) so that we can respond within WhatsApp’s service window. We use this content only to answer the enquiry and arrange a viewing. Your use of WhatsApp is also subject to Meta’s own terms and privacy policy.

If an agent chooses to connect their Google Calendar, Selara requests a single permission — the ability to see and edit calendar events (calendar.events). We use it for one purpose: to create, update and cancel the viewing appointments an agent has agreed to, and to notice when the agent later changes or deletes one of those appointments so that the buyer can be told.

Selara only ever reads back the specific events it created itself, by their event identifier. It does not list the contents of an agent’s calendar, does not read their other appointments, and does not query their free/busy times. The times Selara offers a buyer come from the availability the agent sets in Selara and from viewings Selara itself has booked — not from their calendar.

We do not:

• use calendar information for advertising, or transfer it to anyone for advertising;
• sell it, or share it with third parties for their own purposes;
• use it to train generalised artificial-intelligence models;
• allow anyone to read it, except where you have asked us to, or where it is necessary for security, to resolve a support issue you have raised, or to comply with the law.

Selara’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Artificial intelligence and Google user data.Selara uses AI models to write listing descriptions and to hold the WhatsApp conversation with a buyer. No information received from Google Workspace APIs — raw, aggregated, anonymised or derived — is ever sent to any AI or machine learning model, whether our own or a third party’s. Calendar information is used only by Selara’s own scheduling code, which makes no AI calls. Accordingly, Google user data is never used to create, train or improve any foundational or generalised AI/ML model, by us or by anyone else.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Who Google user data is shared with.Calendar information is processed only by Selara and by the hosting and database provider that runs Selara’s infrastructure in the European Union, acting on our instructions as a processor. It is not shared with any other party — not with advertisers, not with data brokers, not with AI providers, and not with other agencies using Selara. Each agency’s data is isolated from every other agency’s.

How Google user data is protected.Access and refresh tokens and the appointment records derived from them are held in our database, hosted in the European Union and encrypted at rest by our hosting provider. All traffic between Selara, Google and the browser travels over TLS. Access is restricted by row-level security in the database, so an agent’s calendar connection can only be read by their own organisation; server-side scheduled jobs use a separate credential that is never exposed to the browser. Administrative access is limited to what is necessary to operate the service, resolve a support request you have raised, or comply with the law.

How long Google user data is kept, and how it is deleted. The access and refresh tokens are kept only while the calendar remains connected, and are deleted immediatelywhen an agent disconnects in Selara or revokes access in their Google Account. The only calendar-derived information Selara retains is the identifier of each event it created and the invited buyer’s response to it, stored against the viewing record because the agency needs its own record of appointments; no other calendar content is copied or stored. That record is kept for as long as the agency uses Selara, and is deleted when the agency’s account is closed or on request. Deleting a Selara account deletes the calendar connection and everything derived from it.

An agent can disconnect their calendar at any time in Selara’s settings, or revoke access directly at myaccount.google.com/permissions. On disconnecting, we delete the stored access and refresh tokens and stop receiving calendar updates. Appointments already created remain on the agent’s own calendar, which stays theirs to edit or delete.

We share information with trusted providers who process it on our behalf, only as needed to run the service:

• Hosting & database (application hosting and a database in the European Union).
• AI providers that generate drafts and interpret messages.
• Messaging (Meta / WhatsApp Business Platform) for enquiry conversations.
• Google for review data and, where an agent connects it, calendar scheduling.
• Payments for subscription billing.

Some providers process information outside South Africa (including in the European Union and other countries). Where information is transferred across borders, we take reasonable steps to ensure it remains adequately protected, consistent with POPIA.

We keep personal information for as long as needed to provide the service to the agency, and thereafter only as required for legal, accounting, or security reasons. Agencies can request deletion of their data.

We use technical and organisational measures to protect personal information, including access controls, encryption in transit, and tenant isolation so each agency’s data is kept separate. No system is perfectly secure, but we work to protect information against loss, misuse, and unauthorised access.

Subject to applicable law, you may request access to, correction of, or deletion of your personal information, and object to certain processing. If you are a lead who contacted an agency, please contact that agency directly, as they control your information; we will support them in fulfilling your request.

We may receive requests from public authorities — such as law enforcement, courts, or regulators — for personal information. We disclose personal information to an authority only where we are legally compelled to do so, and only after reviewing the request’s legal validity. We challenge requests we consider unlawful or overbroad, disclose only the minimum information necessary to comply with a valid request, and keep a record of each request and our response. Where the law permits, we will notify the affected person.

For privacy questions or requests, contact Induna Software (Pty) Ltd at support@indunasoftware.com.