Help A Plumber

POPIA Notice:HAP processes personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”). You have the right to access, correct, and request deletion of your personal information. Contact us at info@hapsa.co.za.

1. Who We Are

HAP (Help A Plumber) is operated by Justin Deacon, Gqeberha (Port Elizabeth), Eastern Cape, South Africa (“HAP”, “we”, “us”). We are the responsible party for your personal information as defined under POPIA.

Contact: info@hapsa.co.za

2. What We Collect

For plumbing contractors (registered users):

• Full name, mobile number, and email address (for account creation and OTP login)
• Business name, address, registration number, and trade registration numbers you choose to add
• Bank account details (used only for displaying on your invoices — see Section 5 for how these are currently protected)
• Profile photo and business logo
• Job, quote, invoice, and customer data that you enter into the platform
• Device and session information for security purposes

For homeowners and customers:

• Name and contact details when a plumber adds you as a customer
• Job and quote information associated with work done at your property

Automatically collected:

• IP address and browser/device type (for security and fraud prevention)
• Pages visited and features used (to improve the platform)

3. Why We Collect It

We process your personal information only for the following lawful purposes:

• To create and manage your account, and authenticate your identity via OTP
• To provide the core platform features: quotes, invoices, job management, and recording/attaching your Certificate of Compliance (CoC) — HAP helps you record and attach a CoC you have issued; HAP itself does not issue CoCs
• To send you important service notifications (login codes and alerts about your account, such as a customer's reply to a quote)
• To improve platform features and fix technical issues
• To comply with our legal obligations under South African law
• To protect HAP and its users from fraud, abuse, and security threats

We will never use your personal information for unsolicited marketing without your explicit consent, and we will never sell or rent your personal information to third parties.

4. Who We Share It With

We share your personal information only where necessary to operate the platform:

• Supabase (database hosting) — your data is stored on Supabase servers in the EU (eu-west-1). Supabase is GDPR-compliant and contractually bound to protect your data.
• Twilio — Twilio delivers one-time login codes — to plumbers signing in to HAP, and to customers opening their own job or invoice portal — and sends HAP's own alerts to plumbers about their account (for example a customer's reply to a quote). These alerts may include your customer's name and job details. HAP never uses Twilio to message a customer about a job, quote or invoice: those messages are sent from the plumber's own WhatsApp number.
• Resend — your email address is shared with Resend to deliver OTP login codes and optional invoice notifications and, when you choose to email a quote or invoice, your customer's email address and the document.
• Vercel and Vercel Blob — the platform is hosted on Vercel infrastructure, and files you upload (such as photos and documents) are stored on Vercel Blob storage. Request metadata passes through Vercel servers.
• Anthropic — if you use the AI assistant feature, your query and the relevant job and customer details (such as the customer's name and contact details) are sent to Anthropic's API to answer it. If you use AI Bathroom Design (Design AI), the room measurements, door and window positions, style preference and any notes you enter — and, if you add one, a photo of the existing bathroom — are sent to Anthropic to generate the design. If you use Scan Receipt, the receipt photo (as a link to where it is stored) is sent to Anthropic to read the supplier, date, total and line items. If you upload a supplier quote under Supplier Quotes, its pages (a PDF or photos) are sent to Anthropic to read the quoted lines.
• OpenAI (Whisper) — if you use voice-to-quote or voice transcription, your audio recording is sent to OpenAI's Whisper API to convert it to text.
• Sentry — error and crash reports (which may include technical details about your request) are sent to Sentry to help us find and fix bugs.
• PayFast — if you subscribe to a paid HAP plan, or a customer pays an invoice online, PayFast receives the payer's first name and email address to process the payment.
• AI bathroom image render — if you use the AI image render feature, your room description — and, depending on which image provider is configured, a reference image of your floor plan, 3D view or an existing photo — is sent to an image-generation provider to produce the render. Depending on our configuration this may be Google (Gemini), OpenAI (DALL-E 3), Stability AI, or Pollinations; only one provider is active at a time.
• Push notification services — if you enable notifications, your device's push subscription is used, via the standard Web Push protocol, to deliver them to your browser or device.
• n8n Cloud and Telegram — when a plumber signs up, their name, business name, phone number and email address are sent through HAP's n8n Cloud workflow to a private Telegram channel to notify the HAP team.

We do not share your data with any other third parties beyond those listed above. All service providers are contractually required to process your data only as instructed by us and to maintain appropriate security. Some of these providers process data on servers located outside South Africa (including the EU and the United States) — by using HAP you consent to this cross-border processing, which is necessary for us to provide the service.

5. How We Protect Your Data

• All data is transmitted over HTTPS with TLS encryption
• Bank account details: we are rolling out encryption at rest for bank account numbers. Until that rollout is complete and verified, some existing bank account numbers are stored in plain form in our database, protected only by the access controls below. We will update this notice once encryption is confirmed complete for all accounts.
• Authentication: you can sign in with a one-time code (OTP) sent by SMS, WhatsApp or email — no password needed for that. If you choose to also set a password, it is stored hashed by our authentication provider (Supabase Auth) — we never store or can see your password in plain text.
• Sessions use HttpOnly, Secure cookies with HMAC-SHA256 signing
• Access to production data is restricted to authorised personnel only
• Security headers (including HSTS and X-Frame-Options) are applied to all responses
• Database access is protected by row-level security and connection pooling

6. How Long We Keep It

We retain your personal information for as long as your account is active and for a reasonable period after deletion to comply with legal obligations (typically 5 years for financial records as required by South African tax law).

You may request deletion of your account and associated data at any time by emailing us at info@hapsa.co.za. We will action deletion requests within 21 days, subject to legal retention obligations.

7. Your Rights Under POPIA

You have the right to:

• Access a copy of the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal information (subject to legal retention requirements)
• Object to the processing of your personal information
• Lodge a complaint with the Information Regulator of South Africa (inforegulator.org.za)

To exercise any of these rights, contact us at info@hapsa.co.za. We will respond within 30 days.

8. Cookies

HAP uses the following cookies:

• hap_session — an HttpOnly session cookie that keeps you logged in for 30 days. Essential for the platform to function.
• hap_customer_session — an HttpOnly cookie for the customer portal login; it keeps a customer signed in to their own job or invoice portal for 30 days.
• hap_trusted_device — an HttpOnly cookie set when you log in, to remember this device for 180 days so HAP recognises it on your next sign-in.
• hap_phone_proof — a short-lived HttpOnly cookie (15 minutes) used for the signup phone check: it records the phone number you have just verified so your signup can complete.
• hap-theme — set when you choose an appearance; it stores your light/dark preference for 1 year.
• hap_maint_bypass — set for 30 days when you open a valid maintenance bypass link, whether or not maintenance mode is active.

We do not use advertising cookies, tracking pixels, or any third-party analytics cookies.

9. Children

HAP is a business tool intended for adults. We do not knowingly collect personal information from anyone under the age of 18. If you believe we have inadvertently collected such information, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the platform or by email. Continued use of HAP after changes are posted constitutes acceptance of the updated policy.

11. Contact & Complaints

For privacy enquiries or complaints: info@hapsa.co.za

If you are not satisfied with our response, you may contact the Information Regulator of South Africa.