Last updated: 13 April 2026
MiAgentDesk is committed to protecting your personal information. This Privacy Policy explains what data we collect, how we use it, who we share it with, and the rights you hold over your information. It applies to the MiAgentDesk mobile application and any associated services, including cloud data storage via Supabase, and integrations with Google Calendar and WhatsApp Business.
MiAgentDesk is a mobile productivity application built for real estate professionals. The application is developed and operated by MiAgentDesk ("we", "us", or "our"). Our Information Officer and registered contact for data-related matters is listed in Section 14 of this policy.
We operate under the following applicable frameworks:
| Permission | Purpose | Required |
|---|---|---|
INTERNET |
API communication (Supabase, Google Calendar, WhatsApp Business API) | Yes |
POST_NOTIFICATIONS |
Sending local push reminders for upcoming viewings | Optional |
RECEIVE_BOOT_COMPLETED |
Re-registering background reminder tasks after device restart | Optional |
On iOS, Apple requires apps to declare a usage description for each permission requested. MiAgentDesk requests the following:
| Permission key | Purpose | Required |
|---|---|---|
NSUserNotificationUsageDescription |
To send you local reminders ahead of scheduled viewings | Optional |
Apple requires apps to declare their data practices in the App Store listing. The following reflects MiAgentDesk's declarations:
| Data type | Collected | Linked to you | Used for tracking |
|---|---|---|---|
| Email address | Yes | Yes — linked to your account | No |
| Name (of your clients) | Yes | Yes — stored against your account | No |
| Phone number (of your clients) | Yes | Yes — stored against your account | No |
| Other user content (notes, addresses, event details) | Yes | Yes — stored against your account | No |
| Device identifier (notification token) | Yes | No — used locally only | No |
| Crash data / diagnostics | No | No | No |
| Location | No | No | No |
| Camera / microphone | No | No | No |
| Browsing or search history | No | No | No |
| Purchases / financial info | No | No | No |
Data you enter into MiAgentDesk (contacts, properties, events, and account credentials) is stored on secure cloud servers operated by Supabase and is scoped exclusively to your account. It is not accessible to other users or to MiAgentDesk staff except where required by law. Data shared with Google and Meta is limited strictly to the integrations you opt into (see Sections 5 and 6).
We do not request access to your camera, microphone, location, system contacts list, or any other sensitive device resource beyond those listed above.
We process personal data only where we have a valid legal basis to do so. The following table summarises our basis for each type of processing:
| Processing activity | Lawful basis (GDPR) | POPIA basis |
|---|---|---|
| Creating and authenticating your account (email, hashed password) | Contract performance — necessary to provide account-based access to the app | Contractual necessity |
| Storing contacts, properties, and events on our servers (Supabase) | Contract performance — necessary to provide the app's core features and sync across sessions | Contractual necessity |
| Sending push notification reminders | Consent — you grant notification permission on your device | Consent |
| Sending WhatsApp reminders to your contacts | Legitimate interests — you initiate the message to your own clients | Legitimate interest of the responsible party |
| Syncing events to Google Calendar | Consent — you explicitly connect your Google account | Consent |
| Storing your app preferences | Contract performance — necessary for consistent app behaviour | Contractual necessity |
We use the data we collect only for the following purposes:
We do not use your data for advertising, profiling, marketing, or any purpose other than operating the features you actively use.
MiAgentDesk's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for any purpose other than providing the in-app Google Calendar sync feature. We do not transfer Google user data to third parties, use it for advertising, allow humans to read it (unless required by law or with your explicit consent), or use it to develop, improve, or train generalised AI or ML models.
Specifically:
https://www.googleapis.com/auth/calendar.events scope.MiAgentDesk integrates with the WhatsApp Business API (provided by Meta Platforms, Inc.) to allow you to send automated reminders and confirmations to your clients directly from your own WhatsApp Business number.
To use this feature, you connect your own WhatsApp Business account via Meta's Embedded Signup flow. This is a Meta-managed OAuth process that authorises MiAgentDesk to send messages on your behalf. The resulting access token is stored securely in your account on our servers (Supabase) and is used solely to send messages from your number. You can disconnect your WhatsApp Business account at any time in the app's Settings, which revokes the stored token.
When you send an interactive viewing reminder, your client receives a WhatsApp message with Yes/No confirmation buttons. When the recipient taps a button, Meta sends a webhook notification to our backend containing their reply (confirmed or declined). We store this confirmation status against the relevant calendar event in your account — no message content or conversation history is received or stored.
By enabling this feature, you confirm that:
Your contacts may opt out of receiving WhatsApp messages at any time by:
We transmit only the recipient's phone number and a pre-approved message template to Meta's API. For interactive reminders, we also receive and store button reply confirmation status (yes/no) delivered by Meta's webhook. We do not receive, store, or process any WhatsApp message content or conversation history beyond this. Meta's Privacy Policy governs how Meta processes data on their platform.
All account, contact, property, and event data you create — including your WhatsApp Business API access token and any viewing confirmation status received via Meta webhooks — is stored on servers operated by Supabase, Inc., our backend database and authentication provider. Supabase hosts its infrastructure on Amazon Web Services (AWS) in the United States. Your data is scoped exclusively to your account and is not accessible to any other user.
Supabase provides the following security measures:
Supabase's privacy practices and sub-processor list are documented at supabase.com/privacy.
Your Google OAuth tokens and a local cache of app state are stored on your device using secure local storage. These are not transmitted to MiAgentDesk's servers.
Push notification tokens are generated by your operating system and used only to deliver local reminders on your device. They are not transmitted to or stored on our servers.
We use HTTPS for all API communications. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security against all threats. If you become aware of any security concern relating to your account, contact us immediately at info@miagentdesk.com.
Your data is processed and stored by sub-processors operating servers in the United States. Specifically:
These transfers are made in accordance with applicable data protection law:
We do not sell, rent, or trade your personal information. Data is shared only with the following sub-processors and only in these limited circumstances:
No other third parties receive your data.
Depending on your location, you may have the following rights:
To exercise any of these rights, email us at info@miagentdesk.com. We will respond within 30 days.
Because your app data is stored on our servers, deleting the app from your device does not delete your server-side data. To fully delete your data:
To revoke Google Calendar access, visit myaccount.google.com/permissions and remove MiAgentDesk.
MiAgentDesk is intended for use by real estate professionals aged 18 and over. We do not knowingly collect personal information from children under 18. If you believe a child has submitted personal information through the app, contact us at info@miagentdesk.com and we will delete it promptly.
Your account and app data (contacts, properties, events, preferences, and WhatsApp Business API access token) is retained on our servers for as long as your account remains active. Viewing confirmation status received via Meta webhooks is retained as part of your event records for the same period. If you request account deletion, we will permanently remove all your data within 30 days.
A local cache of your data is also stored on your device and is retained until you uninstall the app or clear its data. Uninstalling does not affect server-side data — a deletion request is required for that (see Section 10).
Data passed to third-party APIs (Google, Meta) during active requests is subject to their respective retention policies — we do not control or retain copies of this data ourselves.
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect any changes. For material changes, we will provide notice within the application. Continued use of the app after an update constitutes your acceptance of the revised policy.
For any questions, concerns, data requests, or complaints regarding this Privacy Policy or your personal data, please contact our Information Officer (as required under POPIA):
MiAgentDesk — Information Officer
South Africa
Email: info@miagentdesk.com
For data deletion requests, email with the subject line "Data Deletion Request". We will confirm within 30 days.
For WhatsApp opt-out concerns, use the subject line "WhatsApp Opt-Out".