Privacy Policy

1. Who is responsible for your information

For account administration, operating and securing the Service, handling support enquiries and meeting our own legal obligations, Reign determines the purposes and means of processing and acts as a responsible party under South Africa's Protection of Personal Information Act 4 of 2013 ("POPIA"). Where the EU General Data Protection Regulation ("GDPR") applies, this role is called a controller.

Your body corporate, homeowners association or other organisation managing your community (the "Community Organisation") generally determines why community records are created, who may access them and how they are used. For those records, Reign generally acts as an operator under POPIA, or a processor under applicable GDPR, on the Community Organisation's documented instructions. These records may include incident reports, announcements, photos and documents. The actual purpose of each processing activity determines the parties' roles.

Your Community Organisation should provide its own privacy information and contact details. This Policy does not replace that notice. If your request concerns records controlled by a Community Organisation, we will help identify the responsible organisation and assist it with the request as appropriate. We remain responsible for our own processing and obligations.

2. How to contact us

Responsible party: Reign IT Solutions (Pty) Ltd

Information Officer or privacy contact: Information Officer

Privacy and account deletion email: info@reignitsolutions.com

Business or postal address: 106 Beach Rd, Strand, Cape Town

Public account deletion page: https://body-beacon-pro.base44.app/account-deletion

Please identify BodyCorp Beacon and describe your request. Do not send passwords or unnecessary identity documents. We may ask for proportionate information to verify your identity or your authority to act for another person.

3. Information processed through the Service

Account and contact information includes your name, email address, phone number, account identifier and assigned role as a Resident, Trustee, Building Manager or Admin. Information linking your account to a community, building or unit is processed where supplied or needed for your access.

Community content includes incident descriptions, emergency details, announcements, uploaded photos, PDFs and other documents, and information contained within those files. It also includes supplier names and contact details, quotations, approval records, duties, assignments, completion evidence and building emergency contacts where entered. Email delivery records and in-app notifications are also stored. Reports and attachments may identify residents, visitors, staff or other people. Files may contain embedded metadata, including dates or location information, even when that information is not visible in the file preview.

Service correspondence includes information you provide when requesting help, reporting misuse, making a privacy request or asking for account deletion. Please limit correspondence to information needed to resolve the issue.

Technical processing: Administrative edit audit entries record an IP address from the request header and a browser or device user-agent string to support accountability for changes. Backend logs relating to sign-in attempts, permission denials and status changes may contain email addresses and record identifiers. These logs are accessible to the app owner for administration and investigation. Hosting and platform services also process technical information to deliver, secure and diagnose the Service. The analytics processing described below includes device and usage information.

Cookies and browser storage: The app uses browser storage for sign-in and session information, including a platform sign-in token, a resident record identifier and trusted-device token, and manager or trustee profile identifiers, session tokens and expiry information. Sessions are cleared on sign-out and through the in-app account deletion action. An interface component may store a sidebar display preference in a cookie. The app's own code does not set advertising or analytics cookies; Base44 also processes platform usage information as described below.

Analytics: Base44's built-in analytics tracker is enabled in the app configuration. The provider describes analytics covering visits, visitors, visit duration, pages, referrers, device type, operating system and country. These statistics support understanding use of the Service. Provider documentation states that page-view and app-user login events continue even when analytics is disabled. Session recording was disabled in the app settings when checked on 27 September 2026. Base44 describes a 60-day analytics history. This does not establish when underlying logs or backups are erased. The Service currently has no individual analytics opt-out control; contact us to raise an objection or request details about your information.

Advertising: The app code contains no active advertising, ad-measurement or data-broker integration and does not implement a sale of personal information or sharing for advertising. This description does not make a claim about the provider's independent activities beyond the app configuration. Provider AI data use is addressed separately in section 7.

We receive information directly from you and, where relevant, from authorised users and your Community Organisation. For example, a Building Manager may invite you or submit a report that concerns you. Technical information comes from your interaction with the Service to the extent described above.

4. Why information is used

We use information to create and manage accounts, authenticate users, assign authorised access, deliver community features, store and display uploaded content, respond to enquiries and process privacy and deletion requests. We also process relevant information to maintain service security, investigate misuse, resolve disputes and comply with legal obligations.

Community Organisations use community records to communicate with residents and manage building matters, including assessing and responding to incidents. They are responsible for ensuring that their instructions and use of those records are lawful and proportionate.

Providing information is generally voluntary. Information identified as required during registration or use of a feature is necessary for that function: without it, we may be unable to create an account, deliver a report or respond to an enquiry. Optional uploads should contain only what is necessary. We do not treat acceptance of the Terms of Service as blanket consent to every use of personal information.

5. Grounds for processing

Depending on the activity, we rely on performance of a contract with you or steps you request before a contract, compliance with a legal obligation, consent, or a legitimate interest recognised by applicable law. Our relevant interests include operating a reliable service, preventing unauthorised access, assisting customers and protecting legal rights. We assess the effect on individuals before relying on those interests.

Consent is used where required, including for relevant optional activities. You may withdraw consent through the relevant control or by contacting us. Withdrawal does not invalidate earlier lawful processing; another lawful ground may justify limited continued processing. Where GDPR applies, the corresponding grounds are Article 6(1)(a), (b), (c) or (f), as appropriate. A Community Organisation must determine its own lawful grounds for community records.

Information about health, alleged offences or other sensitive matters may require additional legal conditions. An ordinary contractual or legitimate-interest ground alone does not authorise every use of such information. We and the relevant Community Organisation must meet the applicable additional requirements before processing it.

6. Photos documents and incident reports

Before uploading material, consider whether names, faces, vehicle registrations, contact details or sensitive facts are needed. Crop, obscure or remove unnecessary details where practical. Do not upload identification documents, medical records, financial credentials or information about children unless the particular community matter lawfully requires it and an appropriate restricted channel is available.

Incident allegations should be factual, relevant and shared only with authorised recipients. A report is an allegation or account of events, not a verified finding. Contact the relevant Community Organisation or our privacy contact if information is inaccurate, excessive or available to an inappropriate audience.

Where the app requests camera, photo or file access, that access should relate to the upload you choose. Device permission is separate from permission to process information about other people. You may manage device permissions in your operating system settings, although disabling access can prevent the relevant feature from working.

Uploaded file access: New uploads use private storage. The Service checks access before issuing a temporary download link, which is configured to expire after 60 seconds. Access depends on the relevant account, building, role and record. Authorised recipients can download copies, and a temporary link can be used by someone who obtains it until it expires. These controls do not erase copies already downloaded.

Earlier public uploads: Earlier test uploads have been replaced in app records with private copies. The original public storage objects have not yet been confirmed removed; their old links may remain usable. Contact info@reignitsolutions.com about removal or suspected exposure. Creating a private replacement does not itself revoke an earlier public URL. These earlier uploads were made during testing. Their removal is separate from the controls used for new uploads.

7. Who can receive information

Authorised community users receive information according to the relevant feature, their assigned role and the Community Organisation's access arrangements. Trustees, Building Managers and authorised Admin users may require access to records to carry out their duties. Announcements and documents intended for a community audience may be visible to that audience. A report should not be assumed to be anonymous or confidential from every other user; check the intended audience before submitting it.

Reign personnel may access information where needed for support, security, maintenance or legal compliance, subject to appropriate authorisation and confidentiality obligations. Service providers may process information for hosting, storage, authentication, communications or other specified support functions under appropriate contractual arrangements.

Service providers and processing locations: Base44 supplies hosting, the database, authentication, file storage, email delivery and analytics. The current workspace uses the Builder plan. According to the provider information supplied for this app, workspace data and uploaded media are stored in the United States. The app also presents Google sign-in for administrators. The duty-document feature uses Base44 document extraction for PDF processing; this can involve AI-assisted processing of document content. Outputs should be checked by the authorised user before use. Base44 publishes its current subprocessors at https://base44.com/dpa/exhibitc. The list includes hosting, storage, analytics, email, logging and AI providers; inclusion does not mean that every provider receives every upload. Its data processing agreement is available at https://base44.com/dpa.

We may disclose relevant information where lawfully required by a court or authority, to protect rights or address a serious safety concern where legally permitted, or to professional advisers subject to confidentiality. A restructuring or transfer of the Service may involve necessary disclosure to an acquiring entity with appropriate privacy safeguards and notice where required. These circumstances do not authorise unrelated use of community information.

An emergency services directory entry or external link may take you to a separate provider. Information you give that provider is governed by its practices and applicable law. Using the directory does not itself authorise Reign to share your incident report with an emergency service.

Provider AI data use: Base44's published privacy and security documentation states that workspace data on non-Enterprise plans can be used to train AI models, while Enterprise has an automatic exclusion. This app's reported plan is Builder. We have requested clarification of the scope for live app users and private uploads and the applicable contractual safeguards. We do not represent that all app data is excluded from provider training. For details of this provider practice, see https://docs.base44.com/Community-and-support/Privacy-and-security. Acceptance of our Terms is not treated as consent to unrelated AI training.

8. Processing outside South Africa

Where providers store information abroad or personnel access it from another country, we require an applicable legal basis for that transfer. POPIA section 72 may require adequate protection through law or a binding agreement or another permitted basis. Where GDPR applies, transfers outside the European Economic Area must also meet its transfer requirements, such as an applicable adequacy decision or appropriate safeguards, with supplementary measures where needed.

You may contact us for information about relevant destinations and safeguards, including how to obtain a copy or description subject to lawful confidentiality limits. This Policy and your use of the Service do not amount to blanket consent to international transfers.

9. Retention and deletion

The current app has no scheduled automatic deletion of community records. Issues and comments, attachments, announcements, approvals, duties and assignments, in-app notifications, email delivery records and audit entries persist unless separately removed. Audit entries have no in-app deletion control. This describes the present implementation; it does not establish a lawful reason to retain every record indefinitely. Retention must still be justified by the relevant purpose and applicable law.

Account details are kept while access is needed and then reviewed when access ends or deletion is requested. Community records are reviewed against the continuing community-management purpose, applicable recordkeeping duties and any outstanding dispute or legal claim. Support correspondence and deletion-request records are kept only as needed to resolve the request, demonstrate its handling and address a related complaint or claim. Email delivery and audit records are reviewed for their continuing delivery, security and accountability purpose. Where retention remains necessary, access should be restricted and the information removed or de-identified when that purpose ends. These are manual retention criteria; there is no automatic expiry schedule for these app records.

Resident access codes expire after seven days and are single-use, with access blocked after five incorrect attempts. Manager and trustee sessions last 30 days. Resident trusted-device tokens have no time-based expiry in the app and remain valid until replaced or access is suspended or deleted. The platform manages the duration of its own sign-in tokens. These credential settings do not set the retention period for community records.

To request deletion, use the account-deletion control in the app's account settings. To request deletion without signing in or reinstalling the app, visit https://body-beacon-pro.base44.app/account-deletion and supply your email address or phone number; a reason is optional. You may also email info@reignitsolutions.com. We may need proportionate verification before removing information.

The in-app request records a restricted request for administrator handling. For a verified Resident, Building Manager or Trustee request, the app disables the custom account's access and invalidates its stored session. It also revokes app-issued access to private files recorded as owned by that account. These actions do not themselves permanently erase stored files, related records or a platform authentication account. Your independent Google account is not deleted.

Public requests await verification; verified in-app requests await administrator review. Requests cover the account and associated personal information and uploads. Administrators must review related records, complete removal through the appropriate system and provider processes, and explain any justified retention. Completion is recorded only after the required removal and communication steps have been verified. The Service does not claim that submitting the request completes erasure. We handle requests without undue delay and within applicable legal response periods. We will explain any verification needed, information retained and justified delay; we do not promise instant or automatic permanent erasure.

Where particular records must be retained, the responsible party must identify the purpose, lawful justification, access restrictions and period or criteria. The absence of an automatic deletion feature is not itself a retention justification. A request about remaining records or files can be sent to our privacy contact.

Base44's user-deletion guide describes removal of platform app users and associated table records as permanent operations performed separately in the Users and Data sections. The Builder plan does not include the customer-facing automatic data-backup feature offered on higher plans. This does not establish that internal provider backups, logs or caches do not exist. Base44 support has confirmed that deleting a database record does not delete its uploaded file. Permanent removal of public or private uploaded files requires a support request identifying the exact file URLs and authorising removal. After storage deletion, cached copies may remain accessible for up to 36 hours; Base44 can also be asked to clear the app’s CDN cache at deletion. We use this provider process when completing an applicable file-erasure request. Base44’s agreement describes backup deletion at set intervals but does not specify an interval. We have not received confirmed erasure periods for its internal runtime logs, email-delivery logs or downstream AI processing. Contact us for the current position; we will not describe those copies as erased without confirmation.

Uninstalling the app, logging out or removing community access does not itself erase an account. Copies previously downloaded by recipients are outside our direct control and remain subject to their legal obligations.

10. Security and incidents

We are responsible for reasonable technical and organisational safeguards appropriate to the information and risks, including access management and oversight of service providers. No service can guarantee absolute security. Protect your login credentials, use a secure device and promptly report suspected unauthorised access to our contact in section 2.

If a security compromise affects personal information, we will investigate, take appropriate remedial steps and notify the relevant responsible party, regulator and affected people as required by applicable law. Where we act as an operator or processor, we will assist the Community Organisation with its obligations. Statutory notification requirements are not replaced by a general service announcement.

11. Your privacy rights

Subject to applicable law, you may ask whether information about you is held, request access, ask for correction or deletion, and object to certain processing. You may withdraw consent where processing relies on it and object to direct marketing. Requests concerning another person's rights or legally protected records may require limits, redaction or a lawful refusal, which we will explain.

Where GDPR applies, you may also have rights to restriction of processing and data portability, and protections concerning decisions based solely on automated processing that produce legal or similarly significant effects. The grounds and exceptions for each right differ. GDPR requests are ordinarily answered within one month; a permitted extension of up to two further months will be explained within the initial month. Other requests are handled within the periods required by applicable law.

Automated functions: The app routes new issues to the building manager, sets emergency issues to an In Progress status, derives overdue indicators from due dates, and updates approval status from majority vote totals. It also blocks invalid, expired or revoked sign-in attempts. These are workflow and security functions. PDF document extraction is a separate feature described in section 7. An automated status update does not mean a human has reviewed an emergency report or begun responding. A Community Organisation remains responsible for the authority and legal effect of its approvals. If a workflow result affects you, contact the organisation or our privacy contact to request review and correction of inaccurate information.

Contact us using section 2 to exercise a right. We will not require unnecessary information or make exercising a right unreasonably difficult. Any lawful fee or reason for declining a request will be explained. You may complain directly to the Information Regulator in South Africa at https://inforegulator.org.za/complaints/ or POPIAComplaints@inforegulator.org.za. Where GDPR applies, you may also complain to the competent supervisory authority, including in the country of your habitual residence, workplace or an alleged infringement. You need not complete our internal process before contacting a regulator.

12. Children and communications

The Service is intended for adult community users and is not directed at children. We do not invite children to create accounts. If a community record necessarily includes a child's information, the responsible party must establish the required authority and safeguards, including competent-person authorisation where required. Please contact us if a child has created an account or unnecessary information about a child has been uploaded.

Account, security and community service messages are distinct from optional marketing. Where we send direct marketing, we will meet applicable consent or other legal requirements and provide an appropriate way to opt out. Opting out of marketing does not prevent essential account or security messages.

13. Changes to this Policy

We may update this Policy when our practices, the Service or legal requirements change. The version on the public /privacy page shows its Last Updated date. We will provide appropriate notice of material changes and obtain fresh consent where required. New wording does not retrospectively authorise an incompatible use of previously collected information.