Privacy Policy

Last updated: 17 August 2026

This Privacy Policy explains how CoreX OS ("CoreX", "we", "us"), the real-estate operating system owned and operated by R R Technologies (Pty) Ltd, collects, uses, stores and protects your information. It is provided in line with the South African Protection of Personal Information Act (POPIA) and applies to all users of CoreX, including estate agents and agencies who use CoreX and connect their social-media accounts to it.

1. Who we are

CoreX OS is software owned and operated by R R Technologies (Pty) Ltd, used by real-estate agencies to manage properties, contacts, deals and marketing. The responsible party (data controller) for personal information processed through CoreX is R R Technologies (Pty) Ltd. For any privacy query you can reach us at support@corexos.co.za.

2. Information we collect, and how

We collect the following categories of information:

• Account & profile information — your name, email address, phone number, role and agency. This is created for you by your agency administrator when your account is set up (CoreX is invite-only) and can be updated by you or your administrator afterwards.
• Property, deal and contact data — property listings and their photographs, buyer/seller/tenant contact records, buyer requirement profiles, tasks, calendar events and deal/transaction records that you or your agency create and manage in CoreX as part of normal use.
• FICA and compliance documents — identity, proof-of-address and other documents uploaded to verify clients under South Africa's Financial Intelligence Centre Act (FICA) and PPRA record-keeping requirements.
• Push notification tokens — a device-specific token registered automatically when you enable notifications, used only to deliver notifications to that device (see section 6).
• Voice recordings made through Ellie — audio captured only while you are actively pressing and holding the microphone button to speak an instruction to Ellie, our in-app voice assistant (see section 4).
• Social-media connection data — when you connect a Facebook or Instagram account (see section 5).
• Usage data — log records, device and browser information used to keep the service secure and reliable.

3. How we use your information

• To provide and operate the CoreX platform and its features.
• To let your agency manage properties, contacts, deals, documents and communications.
• To verify client identity where required by FICA/PPRA.
• To deliver push notifications you have enabled.
• To turn a spoken instruction to Ellie into a draft calendar entry or task (section 4).
• To publish the marketing content you create to the social accounts you connect, and to show you analytics on it.
• To secure the service, prevent abuse and meet our legal obligations.

4. Ellie voice assistant — speech-to-text and Anthropic (Claude)

Ellie lets you speak an instruction (for example, "book a viewing with the Springfields for Friday at 10") instead of typing it. Here is exactly what happens to that recording, step by step:

• Recording — audio is captured only while you press and hold the microphone button, and only after you have granted the app microphone permission and given explicit in-app consent to use Ellie's voice feature before the first time it is used.
• Speech-to-text (self-hosted, no third party) — the audio is sent to our own self-hosted transcription service, running on our own infrastructure. It is converted to text there and the audio is then discarded — it is not written to any long-term storage, and it never leaves our infrastructure or goes to any third party.
• Anthropic (Claude API) — only the resulting text of your instruction is sent to Anthropic's Claude API, which interprets it and returns a draft calendar entry or task. Nothing else is sent: not your contact list, not client records, not photographs, not your location, not your credentials, and no device or advertising identifiers. Anthropic processes this text under commercial API terms that provide protection equivalent to this policy, and Anthropic does not use it to train its models.
• What we store afterwards — the transcript text (not the audio) is saved as part of the calendar event or task it created, so you can see what Ellie heard. It is retained for as long as that calendar event or task exists, and is removed when the event or task is deleted.

5. Facebook & Instagram (Meta) integration

CoreX lets you connect your Facebook Page and linked Instagram Business account so you can publish property marketing posts directly from CoreX. When you choose to connect, Meta asks you to authorise CoreX. With your permission we access only what is needed to publish and measure your posts:

• The list of Facebook Pages you manage, so you can pick which Page to post to.
• Permission to publish posts to the Page you select, on your behalf.
• Post performance insights (reach, impressions, likes, comments, shares) so you can see how your listings performed.
• Your linked Instagram Business account details, where you choose to publish to Instagram.

To make publishing work we store a Page access token issued by Meta, the Page (or Instagram account) ID and name, and the token's expiry date. We do not collect your Facebook password, your private messages, your friends list, or any personal content beyond what is described above. CoreX never posts without an explicit action by you.

You can disconnect a connected account at any time from within CoreX. Disconnecting removes the stored token so CoreX can no longer access that account.

6. Property24, and push notifications (Firebase)

Property24 — reference property data flows into CoreX from Property24 to support our workflows. When your agency syndicates one of its own listings to Property24, CoreX also sends the listing details (address, description, price, photographs) and, so that enquiries can reach the right person, the listing agent's name and profile photo to Property24. No client, buyer or contact data is sent to Property24 — only the listing and its listing agent.

Google Firebase Cloud Messaging (FCM) — we use Firebase solely to deliver push notifications (new leads, messages, deal and task updates) to your device using its push token. Firebase is not used for analytics, advertising or attribution in CoreX.

7. No analytics, advertising or tracking

CoreX OS contains no analytics SDK, no advertising SDK, and no cross-app or cross-site tracking of any kind. We do not use your data for advertising, and we do not sell or rent your personal information to anyone.

8. How we share information

We do not sell your personal information. We share it only as described above, with:

• Anthropic, the transcribed text of an Ellie voice instruction only (section 4).
• Meta Platforms, when you publish to or read insights from Facebook/Instagram (section 5).
• Property24, listing data and the listing agent's name/photo when your agency syndicates a listing (section 6).
• Google Firebase, for push notification delivery only (section 6).
• Service providers who host and operate CoreX on our behalf, under confidentiality obligations.
• Authorities, where we are required to by law.

9. Deleting your account

You can permanently delete your CoreX account yourself, in the app, at Settings → Delete account. No email or phone call is needed. Deletion is immediate: your login credentials are removed, every active session and device token for your account is revoked, and you cannot sign back in to that account — it cannot be undone by you.

Deleting your login does not delete your agency's business records. Property, deal and FICA/compliance data tied to your account is retained by the agency as a business record, as required under the Financial Intelligence Centre Act (FICA) and PPRA record-keeping rules — deletion removes your personal login, not the agency's transaction history.

If you have connected a Facebook or Instagram account, see our Data Deletion page for how to remove that connection's data specifically.

10. How long we keep information

• Account & profile data — for as long as your account is active, and removed on account deletion (section 9).
• Contact, consent and access-log records — a minimum of 5 years, as configured by your agency, in line with FICA/POPIA record-keeping obligations.
• Communications archive (email/WhatsApp sent through CoreX) — 5 years.
• Signed documents and e-signature audit logs — 7 years, per Property Practitioners Act record-keeping requirements.
• FICA verification — revalidated on a rolling basis; verification records are kept as required by FICA.
• Ellie voice transcripts — tied to the calendar event or task they created; removed when that event or task is deleted (section 4). The audio itself is never stored (section 4).
• Push notification tokens — for as long as needed to deliver notifications to your device, and removed when a token becomes invalid or you sign out.
• Social-media access tokens — kept only while the connection is active and removed when you disconnect the account or request deletion.

11. Your rights under POPIA

Personal information is processed under the South African Protection of Personal Information Act (POPIA), on the basis that processing is necessary to perform our services to you and your agency, and to meet our legal obligations (including FICA and PPRA). You have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of your personal information, subject to section 9 above.
• Object to certain processing, and withdraw consent where processing is based on consent.
• Lodge a complaint with our Information Officer (below) or with the South African Information Regulator (inforegulator.org.za) if you believe your information has been mishandled.

12. Security

We use appropriate technical and organisational measures to protect your information, including encrypted transport (HTTPS) and restricted access to stored credentials.

13. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of this page reflects the most recent change.

14. Contact us

For any privacy question or request, email support@corexos.co.za.