Privacy Policy

1. Introduction

Seamless Software Solutions CC, trading as GAVL ("GAVL", "we", "us", or "our"), is committed to protecting the privacy of all individuals who use our platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered property platform and associated services.

This policy applies to all users of the GAVL platform, the gavl.co.za website, and any associated services. By accessing or using our Service, you consent to the data practices described in this policy.

This Privacy Policy is designed to comply with the Protection of Personal Information Act 4 of 2013 (POPIA) of South Africa and the General Data Protection Regulation (GDPR) of the European Union where applicable.

2. Who We Are

Seamless Software Solutions CC is the responsible party (data controller) for personal information processed through the Platform.

• Entity: Seamless Software Solutions CC
• Email: privacy@gavl.co.za
• Website: gavl.co.za

3. Information We Collect

3.1 Account Information

When you create an account (including via Google sign-in), we collect:

• Full name
• Email address
• Profile picture
• Account identifier

3.2 Google Workspace Data

Where you grant the Platform access to your Google account for AI-assisted executive features, we may access:

• Calendar events, scheduling details, and availability
• Email messages and metadata for summarisation, drafting, and follow-up
• Contact information for intelligent correspondence

This data is accessed solely to provide AI executive assistance features and is handled in accordance with Section 6 below.

3.3 Property & Business Data

When you use the Platform to create proposals or manage mandates, we process:

• Property addresses and stand numbers
• Property valuation and comparable sales data sourced from third-party providers
• Seller names and contact information as provided by you
• Brokerage and agent details
• Brand assets (logos, colours, templates) uploaded by your organisation

3.4 Document & Signing Data

• Generated proposals, mandates, and marketing documents
• Electronic signature records and signing timestamps
• Document revision history

3.5 Usage & Technical Data

• IP address and approximate geolocation
• Browser type and version
• Device information
• Pages visited and features used
• Session duration and interaction patterns
• Referral source

3.6 Lead Form Data

When you submit a form on our marketing website, we collect:

• Name, email address, and company name
• Business metrics you voluntarily provide (agents, listings, sales volume)

4. How We Collect Information

5. Purpose of Processing

We process your personal information for the following purposes, as permitted under POPIA:

6. Google Services & API Usage

6.1 Authentication

We use Google OAuth for secure sign-in. During authentication, we access your name, email address, and profile picture to create and maintain your GAVL account.

6.2 Calendar & Scheduling Access

With your explicit consent, GAVL may access your Google Calendar to provide AI-powered scheduling assistance, including viewing your availability, suggesting meeting times, and managing calendar entries on your behalf.

6.3 Email Access

With your explicit consent, GAVL may access your Gmail or Google Workspace email to provide AI executive assistance features, including email summarisation, draft composition, follow-up tracking, and intelligent correspondence management.

6.4 How We Use Google Data

• Google data is accessed only for the specific features you have authorised
• We do not use Google user data for advertising purposes
• We do not sell, rent, or trade Google user data to any third party
• We do not allow employees to read your emails or calendar unless required for support at your explicit request and with your consent
• Google data is processed by our AI systems solely to deliver the features described above and is not retained beyond what is necessary to provide those features

6.5 Revoking Access

You may revoke GAVL's access to your Google account at any time through your Google Account Permissions page. Revoking access will disable the associated features until you re-authorise the connection. Your core GAVL account and data remain unaffected.

7. AI Processing of Your Data

GAVL uses artificial intelligence to provide core platform features including content generation, property analysis, and executive assistance. We are transparent about how your data interacts with AI systems:

7.1 What Data May Be Processed by AI

• Property addresses and characteristics for description generation
• Comparable sales data for reserve price analysis
• Seller and property details for proposal personalisation
• Document template content for AI-assisted correction
• Calendar and email data (where authorised) for scheduling and correspondence assistance

7.2 How AI Data Is Handled

• Data sent to AI services is processed via enterprise-grade APIs under our service agreements with those providers
• Your data is not used by our AI providers to train their general-purpose models
• AI outputs are stored as part of the generated documents or features you use
• We minimise the data sent to AI systems to only what is required for the specific task

7.3 Your Control

All AI-generated content is presented for your review and editing before it is finalised. You can modify or reject any AI suggestion. You may disable AI-assisted features that require access to your Google Workspace data at any time.

8. Third-Party Services

We engage third-party service providers to operate the Platform. These providers fall into the following categories:

• Authentication & identity providers — for secure sign-in and account management
• AI & machine learning services — for content generation, analysis, and executive assistance
• Cloud hosting & infrastructure — for application hosting, databases, file storage, and content delivery
• Property data providers — for deed registry lookups, valuations, and market data enrichment
• Electronic signing services — for mandate and document signing workflows
• Analytics services — for anonymous product usage analytics and improvement
• Mapping & geolocation services — for property location visualisation
• Customer relationship management — for managing leads submitted via our website

Each provider receives only the data necessary to perform its function. We do not sell your personal information to third parties. We do not share your data with advertisers.

9. Cookies & Analytics

9.1 Cookies We Use

9.2 Managing Cookies

Essential cookies are required for the Platform to function. You can disable non-essential (analytics) cookies through your browser settings, though this may limit our ability to improve the product based on usage patterns.

10. Data Storage & Location

Your data is stored on secure cloud infrastructure operated by reputable, enterprise-grade providers. Our hosting provider operates a global network, and your data may be processed in data centres located outside South Africa. Appropriate safeguards are maintained for international data transfers.

Data categories stored include:

• Structured data: User accounts, property records, and document metadata
• Files: Generated documents, uploaded templates, and brand assets
• Session data: Authentication tokens and session state

11. When We May Disclose Data

Beyond the categories of service providers listed above, we may disclose your personal information:

• Legal obligation: When required by law, regulation, legal process, or enforceable governmental request
• Protection of rights: To protect the rights, property, or safety of GAVL, our users, or the public
• Business transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred to the successor entity
• With your consent: When you explicitly authorise us to share information with a specific party

12. Your Rights

Under POPIA (and GDPR where applicable), you have the following rights:

• Right of access: Request a copy of the personal information we hold about you
• Right to correction: Request correction of inaccurate or incomplete personal information
• Right to deletion: Request that we delete your personal information, subject to legal retention requirements
• Right to object: Object to the processing of your personal information for specific purposes, including direct marketing
• Right to data portability: Request your data in a structured, commonly used, machine-readable format
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent (including Google Workspace access)
• Right to lodge a complaint: Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, contact us at privacy@gavl.co.za. We will respond within 30 days as required by POPIA.

13. Children's Privacy

The Service is intended for use by property professionals and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will take steps to delete it promptly.

14. International Data Transfers

Some of our service providers operate internationally. When your data is transferred outside South Africa, we ensure that:

• The recipient is subject to a law, binding corporate rules, or agreement that provides an adequate level of protection (as required by Section 72 of POPIA)
• You have consented to the transfer (through acceptance of these terms)
• The transfer is necessary for the performance of a contract between you and GAVL

15. Data Retention

After the applicable retention period, data is securely deleted or anonymised.

16. Security Measures

We implement appropriate technical and organisational measures to protect your personal information:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2+
• Encryption at rest: Documents and data stored in our databases and file storage are encrypted at rest
• Authentication: Secure authentication via Google OAuth; session management with HTTP-only cookies
• Access controls: Role-based access controls and tenant isolation ensure users can only access data belonging to their organisation
• Infrastructure security: Hosted on enterprise-grade infrastructure with DDoS protection and web application firewalls
• Incident response: We maintain incident response procedures and will notify affected users and relevant authorities within 72 hours of becoming aware of a data breach, as required by POPIA

While we strive to protect your personal information, no method of transmission or storage is 100% secure. We encourage you to keep your authentication credentials confidential.

17. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Effective Date" at the top of this page
• Notify you by email or a prominent notice on the Platform
• Where required by law, seek your renewed consent

We encourage you to review this Privacy Policy periodically.

18. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Privacy Officer: privacy@gavl.co.za
• General Enquiries: hello@gavl.co.za
• Website: gavl.co.za