Privacy Policy

Handsy ("we", "us", or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and services.

We collect information you provide directly to us and information we obtain automatically:

• Personal Information: Name, email, phone number, ID number, address
• Profile Information: Store profile, product listings, seller verification, photos
• Location Data: Town, suburb, or area for delivery and marketplace matching
• Communication Data: Messages, reviews, ratings, dispute reports. Messages may be processed automatically for platform safety, fraud prevention, abuse detection, and risk detection (for example detecting attempts to divert a recorded Handsy order). Sharing contact details is allowed. We do not keep full message bodies in the safety log — only a short excerpt, the classification, and the action taken, and those records are deleted after 90 days.
• Device Information: Device type, operating system, and browser/device signals used as a fraud-graph input (not as a unique ID on their own)
• Technical information: IP address and related connection data, collected for security, fraud prevention, detecting abuse, protecting users, preventing duplicate or fraudulent accounts, and investigating suspicious activity
• Usage Data: How you interact with our app, features used, time spent

We use the information we collect to:

• Provide and maintain our platform and marketplace services
• Connect buyers with sellers and products; facilitate browsing, orders, and delivery
• Facilitate communication and order fulfilment
• Verify user identities and seller accounts
• Process seller subscription and platform-fee payments (separate from buyer-to-seller product payments, which Handsy never holds)
• Send important updates and respond to your inquiries
• Improve our services and develop new features
• Ensure platform security, prevent fraud and abuse, protect users, detect duplicate or fraudulent accounts, and investigate suspicious activity
• Comply with legal obligations

We may share your information in the following circumstances:

• With other users: Sellers and buyers as necessary for listings, orders, and delivery
• Third-party service providers: Parties who help us operate our platform (hosting, analytics, payment provider)
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• Consent: With your explicit permission

We take reasonable technical and organisational steps to protect personal information we hold:

• Connections to Handsy use HTTPS (encryption in transit). Hosting providers encrypt storage volumes at rest. We do not claim application-level encryption of every database column.
• Access to identity, address, and bank records is limited by database policies. While a check is in progress, verification files are stored privately and shown through short-lived signed links to the seller and to authorised administrators. Once a seller is verified, those uploaded files are destroyed, in line with POPIA. An approved selfie may be kept only as the seller’s profile photo.
• Administrators’ access to verification documents, bank details, seller status, and role changes is recorded in an audit log.
• We have a written incident-response process for suspected unauthorised access. If a breach of personal information occurs, we assess it and notify the Information Regulator and affected people as required by POPIA.
• Production data is hosted on Supabase, which provides backups and point-in-time recovery when that feature is enabled on the project. Backup copies are held by the hosting provider under their access controls.

We retain your information for the following periods:

• Seller verification files: Destroyed as soon as the seller is verified. We keep the verification outcome (for example, that ID, address, and bank were confirmed), not copies of the documents.
• Account Data: As long as your account is active
• Inactive Accounts: 3 years after last activity
• Communication Records: 5 years for dispute resolution
• Network fraud-link identifiers: salted hashes of IP and browser/device signals, retained up to 12 months after last use, then deleted. We do not keep raw IP addresses in the fraud graph.
• Legal Requirements: As required by South African law
• Marketing Data: Until you unsubscribe

Under South African law, you have the following rights:

• Access: Request a copy of your personal information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your data ("right to be forgotten")
• Portability: Request your data in a portable format
• Objection: Object to processing in certain circumstances
• Withdraw Consent: Withdraw consent for data processing
• Complaint: Lodge a complaint with the Information Regulator

We use cookies and similar technologies to keep you signed in, remember preferences, and understand how the platform is used. Handsy does not use third-party advertising cookies. Full details are in our Cookie Policy at /legal/cookies.

• Essential cookies: required for sign-in, security, and core platform functions
• Preference cookies: remember settings such as display choices
• Analytics cookies: help us understand usage so we can improve the product
• You can control or block cookies in your browser or device settings. Blocking essential cookies may prevent sign-in.

Our platform integrates with third-party services:

• Payment Processors: For secure payment handling
• Verification Services: For identity and qualification checks
• Analytics Services: For platform improvement
• Communication Services: For in-app messaging
• These services have their own privacy policies

Your data is primarily stored in South Africa. Any international transfers are conducted in compliance with POPIA and include appropriate safeguards such as standard contractual clauses.

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that we have collected such information, we will delete it immediately.

We may update this Privacy Policy periodically. We will notify you of material changes through:

• In-app notifications
• Email communications
• Updates to our website
• Continued use after changes constitutes acceptance

If you have questions about this Privacy Policy or our data practices:

• Email: privacy@handsy.co.za
• Support: in-app support system or support@handsy.co.za
• Mail: Available on request — contact us via the app support system or privacy@handsy.co.za
• Information Regulator: informationregulator.org.za

If you believe we have not adequately addressed your privacy concerns:

• Contact our Privacy Officer at privacy@handsy.co.za
• Escalate to the Information Regulator of South Africa
• Provide details of your complaint for investigation
• We aim to resolve complaints within 30 days