Privacy policy

ResMate is a student accommodation website and app made by Eclipse Softworks. This notice explains how personal information is handled when you browse, register or use student, landlord and administration features. It should be read with our terms and conditions.

For privacy questions, access requests, corrections, account closure or deletion, contact support@resmate.co.za and state that your request concerns privacy. You can also request the responsible party's legal contact details through this channel.

What we receive depends on the features you use. Browsing does not require the same information as verification, applying, signing an agreement or receiving a payout. Do not submit identity, financial or other sensitive documents unless the relevant feature asks for them.

We receive information you supply, information generated by your use of a feature, and relevant records supplied by a provider, such as an invoice or lease. Sign-in providers may supply your account identifier, name, email address and profile image.

We use information to provide the feature you request, maintain accounts and records, handle support, protect the platform, and meet applicable obligations. Optional analytics depends on your choice. Other processing may be necessary for a contract, a legal obligation or a legitimate purpose permitted by POPIA.

Fields needed for a feature are identified in the relevant form. If you do not provide them, that feature may be unavailable. You can browse without enabling optional analytics, decline browser location, keep a roommate profile hidden and choose whether to receive WhatsApp updates.

Institution verification and roommate compatibility are feature-specific checks or suggestions. A compatibility score does not itself decide your housing eligibility. Ask support for a review of a verification or campaign outcome, and raise accommodation decisions with the provider responsible for them.

• Residence providers: receive relevant applicant or tenant information when you apply, communicate or enter a tenancy workflow with them. They are responsible for their own handling of that information.
• Conversation participants: see messages you send in that conversation. An in-app message is not a public review and is not advertised as end-to-end encrypted.
• Public visitors: can see published property content and published reviews. A public leaderboard may show display name, institution and score. Do not include private contact or document information in public content.
• Roommate matches: can see the display name, image, biography and preference details made visible for matching. Email addresses are not requested by the roommate matching interface. Use the visibility control to pause discovery.
• Authorised staff: may access relevant records to support users, review verification or ownership claims, moderate abuse, reconcile transactions or investigate security issues.
• Service providers and authorities: may receive information needed for the service, a lawful request, fraud prevention or a legal obligation.

Personal information is not offered for sale. Do not assume a provider's external website, email conversation or WhatsApp account follows this notice; its own privacy practices also apply.

• Clerk: account authentication and session management, including connected sign-in such as Google. ResMate does not ask you to send your sign-in password to support.
• Paystack: payment checkout, transaction processing and relevant payout services where enabled. Card information is entered in the processor's checkout; the ResMate payment interface uses payment references and status.
• Mapbox: maps and location or travel features. Requests may include the coordinates required for the selected map or route and technical connection information.
• PostHog: optional product analytics where configured and allowed by your cookie choice. The application excludes account names, emails, raw search text, payment references and private URL details from these event payloads and disables session recording.
• Sentry: production fault reporting where configured. Application filtering removes user records, request content, breadcrumbs and extra contextual data before sending diagnostic errors; performance tracing is disabled in this configuration.
• Infrastructure and communication providers: website and API hosting, databases, uploaded-file storage, email delivery and opted-in notification delivery process the information needed to provide those functions.

Enabled services depend on the deployment and feature. A provider receiving a network request can also receive technical connection information such as an IP address. Contact support if you need the current provider or processing-location details for your information.

Google Analytics: optional website analytics uses Google's tag (G-R0SF1EFQHS) after you allow analytics. Our page-view events remove query strings and fragments, group private account pages together and mask individual residence identifiers. Advertising consent and Google advertising signals remain disabled. You can withdraw analytics consent using the controls below.

Essential cookies and similar storage support sign-in, security and choices you make, such as display settings. Local or session storage also holds cookie choices, temporary sign-up and referral intent, and a limited cache of public residence information.

Optional product analytics stays off until you allow it. Choosing essential only, closing the consent banner or withdrawing analytics consent keeps new analytics collection off. Choices apply in this browser; other devices need their own setting. Consent is requested again after six months or when the consent format changes. Browser Do Not Track and Global Privacy Control signals are respected.

The service worker caches bundled public assets for performance and an offline page. It does not put API responses, uploaded documents or private account pages into its offline cache. Signing out clears the application's account cache; on a shared device, also close private tabs and clear browser storage where needed.

Location is optional and controlled by your browser or device permission. Nearby-campus search uses your position to choose a nearby campus in the browser. You can instead select an institution or campus manually and revoke location permission in device settings.

File access occurs when you select a file for upload. Upload only the material needed for student verification, a listing or an agreement. Selecting an image or document does not authorise access to all files on your device.

Push notifications need browser or device permission. Your subscription includes a delivery endpoint and associated keys. Notifications can appear on a lock screen, so manage their visibility in device settings. WhatsApp updates use the mobile number and opt-in choice you supply; change that choice in your profile. Service messages and marketing are different purposes: a service-notification choice is not blanket consent to unrelated advertising.

Application safeguards include sign-in and role checks, limits on browser permissions, protections against embedding the website, restricted offline caching and reduced telemetry content. Production access should use HTTPS. These measures do not guarantee absolute security or replace access controls on the API, database and uploaded-file service.

Never share your password, payment PIN, one-time sign-in code or signing link in a public review or support message. Use a secure device, sign out on shared computers and report suspected exposure to support promptly. If a personal-information compromise occurs, notification to affected people and the Information Regulator must follow applicable legal requirements.

Information should be kept only for the feature or purpose that requires it and any lawful retention obligation. Account, verification, message, application, tenancy and transaction records have different purposes; there is no blanket promise that every record is kept for five years or erased immediately on request.

Request closure, access or deletion through support. We may need proportionate identity confirmation. Records may need to be retained for a current tenancy, payment reconciliation, a dispute, fraud investigation or a legal obligation. Ask which records are retained, why, and the applicable retention period. Retained information should be restricted to that purpose.

Closing a Clerk sign-in account alone may not remove all ResMate service records, uploaded files, provider copies or payment-processor records. A data request should cover those service records as well. Separate providers remain responsible for information they lawfully hold.

Subject to applicable legal conditions, you can request access to your personal information, correction or deletion, object to certain processing, and withdraw consent where processing relies on it. Withdrawal does not undo earlier lawful processing. You may also ask about recipients and raise concerns about an automated outcome.

Email support@resmate.co.za with a description of your request and the account email address. Do not email passwords or a full identity-document copy unless a secure, proportionate verification process has been explained to you.

You can complain directly to South Africa's Information Regulator. Contacting ResMate first does not remove that right.

Some service providers may process information outside South Africa. Such transfers must have an appropriate lawful basis and safeguards under POPIA, including adequate protection or another permitted transfer ground. Contact support for the current locations and safeguards; using an international service does not itself establish compliance.

ResMate accounts are intended for people aged 18 or older. If you are younger, contact support with a parent or guardian before registering or supplying documents. If you believe a child's information was supplied without the required authority, contact support to request review and appropriate removal.

Only supply another person's information if you have authority and a legitimate reason. Providers must inform applicants and tenants how they handle their information.

Updates are published here with a revised date. Material changes should be brought to your attention through the service or an appropriate account contact channel. A revised notice does not automatically grant consent for a new optional purpose.

For questions about this notice or a data request, contact support@resmate.co.za.