Privacy policy

Who we are

South Africa App is a map-based guide to places to stay, things to do and services for travellers in South Africa, at southafricaapp.com. It is operated by [registered company name, registration number and address], the responsible party (POPIA) and controller (GDPR) for the information described here.

Our Information Officer is [name to be confirmed], reachable at tools@southafricaapp.com.

What we collect

We collect only what we need to run the guide:

• Account details. Your email address, if you create an account to save places or add photos. Business owners also give us a display name, a contact phone number and a password, which our sign-in provider stores only in hashed form.
• Business listings. What owners and our team add to a listing: business name, description, address, map location, phone, WhatsApp, email, website, photos and logo, and private contact details that only our team can see.
• Photos you add. The photo, the credit you choose to show with it, and a record that you confirmed you have the right to share it. Before a photo is uploaded, your browser re-saves it, which strips the location data (GPS) a camera hides in the file.
• Saved places and plans. Places you save, places you have viewed recently, and your day plans, kept with your account so they follow you between devices.
• Messages you send us. Claims on a listing, reports about a listing or a photo, and business applications, with the contact details you include. A report also stores a separate random key kept in your browser (saa_rid), used only to limit how many reports one browser can send. It is never linked to the analytics identifier below.
• Payments. For paid plans: the plan and extras you chose, your confirmation of each change, and payment records. Card details are entered on Peach Payments' secure page; we never see or store your card number.
• Usage analytics. Anonymous records of how the guide is used: which listings are viewed and contacted, search terms, the categories and areas searched, and where on the map a search was made, rounded to about 1 km. They are linked to a random identifier kept in your browser's local storage (saa_sid), not to your name, email or account. We never record your precise GPS position.
• Your location. When you choose “Near me”, your browser shares your location so we can show what is nearby. It is used for that search and is not stored, apart from the search's centre rounded to about 11 km.
• Technical data. Like any website, our hosting provider processes your IP address and browser details to deliver pages and protect the service.

Why we use it

• To run the guide: listings, search, the map, and your saved places and plans.
• To let business owners manage their listings, and to review new listings, claims, photos and reports before anything is published.
• To take payment for paid plans and keep the financial records the law requires.
• To send the emails you need, such as sign-in links, receipts and decisions on a claim or application, and, once you have an account, a short welcome and a few tips. Every welcome and tips email has an unsubscribe link.
• To understand which places, areas and searches people are interested in, so we can improve the guide and show owners how their listings perform. Owners only ever see totals.
• To keep the service secure and to prevent fraud, scams and abuse.

Our lawful basis

• Contract: to provide your account, your listing and any plan you buy.
• Consent: for the launch email you ask for by joining the waitlist, and for photos and credits you choose to share. You can withdraw consent at any time; it does not affect what we did before.
• Legitimate interests: anonymous usage analytics, security, fraud prevention, and reviewing content before it is published. We keep these proportionate, and you can object at any time.
• Welcome and tips emails: once you have an account, we send a short welcome and a few tips about the guide, as POPIA allows for our own customers (section 69(3)). Every one has an unsubscribe link, and you can opt out at any time.
• Legal obligation: keeping payment and tax records.

Who we share it with

We do not sell personal information. We share it only with service providers (operators) that process it on our behalf under contract:

• Supabase - our database, sign-in and photo storage.
• Vercel - website hosting.
• Resend - sending our emails.
• Peach Payments - card payments for paid plans.
• The map is drawn from OpenStreetMap data. Map tiles come from OpenFreeMap: your browser fetches them directly, so OpenFreeMap sees your IP address and the map area you view. Some place searches go to OpenStreetMap's Nominatim service through our own server, so Nominatim sees our server and the text or map point searched, not you.
• Some of these providers process data outside South Africa. Where they do, we rely on their contractual commitments to protect it to a standard comparable to POPIA and the GDPR.
• What a business owner publishes on a listing is public by design.

How long we keep it

• Usage analytics: raw records for 180 days, then deleted. After that we keep only daily totals, which identify no one.
• Account data, saved places and plans: until you delete them or close your account.
• Payment records: for as long as South African tax and company law requires. If you close your account, your personal details are removed from them.
• Claims, reports and applications: as long as we need them to deal with the request and keep a record of the decision.
• Unsubscribes: if you opt out, we keep your email address on a do-not-email list so that your choice sticks.

Your rights

You can ask to see the personal information we hold about you, to correct or delete it, or to receive a copy. You can object to processing based on our legitimate interests, and withdraw consent at any time.

Much of this you can do yourself. On your account page, “Delete my data” removes your saved places, viewing history and day plans straight away, unlinks any photo reports you sent from your account, and removes your name from photos you added (they stay up, credited to “A visitor”). You can remove any photo you have added at any time. Business owners can close their account from the business portal, which does the same. Every welcome and tips email has an unsubscribe link.

For anything else, email tools@southafricaapp.com. We may need to confirm your identity first, and we will reply within 30 days.

If you are unhappy with how we handle your information, you can complain to the Information Regulator (South Africa) or, in the EU or UK, to your local data protection authority.

Children

The guide is meant for adults planning travel. We do not knowingly collect personal information from anyone under 18. If you think a child has given us personal information, contact us and we will delete it.

Security

Access to personal information is limited by role and enforced in our database, passwords are stored only in hashed form, and every connection is encrypted. No system is perfectly secure; if a breach affects your information, we will tell you and the Information Regulator as POPIA requires.

Changes to this policy

When we change this policy we update the date at the top. If a change matters, we will also tell account holders by email.

Contact us

Questions, requests or complaints about this page: tools@southafricaapp.com