Privacy Policy
Compliance status — what is in place, and the one open gap
The operator is an independent individual based in the Republic of Korea who processes the personal information of people in South Africa. Under POPIA the operator is the “responsible party” and, as the head of a private body, is also its Information Officer (POPIA section 1). Requests about your personal information go to privacy@naartjie.co.za and are handled by the founder personally.
No South African representative has been appointed. This is a known gap. The operator will take South African legal advice on appointing one.
Privacy Policy
Last updated: 6 October 2026
This Privacy Policy describes how Naartjie collects, uses, stores, and shares your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and other applicable South African law.
1. Responsible party
The responsible party (as defined in POPIA) is:
Full name / trading name: Naartjie (operated by an independent individual)
Physical address: A Cape Town service address is being registered and will be published here. Until then, write to support@naartjie.co.za — we reply within 2 working days.
Telephone: A South African contact number is being registered and will be published here. Until then, email is the only channel: support@naartjie.co.za.
Email: support@naartjie.co.za
SA representative: Not appointed — see the compliance status above
The operator is based in the Republic of Korea and processes personal information of South African residents. The operator is also the Information Officer (section 2).
2. Information Officer
The Information Officer is the operator — the founder who runs Naartjie. POPIA section 1 makes the head of a private body its Information Officer.
Name: Naartjie (operated by an independent individual)
Email: privacy@naartjie.co.za
3. Personal information we collect
We may collect the following categories of personal information:
- Account information: email address you log in with; display name and profile photo you choose to add.
- Location / suburb: the neighbourhood or suburb you select to see relevant local listings. We do not collect precise GPS coordinates unless you explicitly grant permission.
- Listings: item descriptions, photos, pricing, and category information you post.
- Community posts: posts, comments, photos and neighbourhood alerts you share in your area's community feed.
- Chat messages: messages exchanged between buyers and sellers through the in-app messaging feature.
- Information other people give us about you: reports about you or your content — including what the reporter wrote and a copy of the reported content kept with the report — and the ratings other users give you after a trade.
- Device and usage data: IP address, browser/device type, pages visited, and interaction events collected for security, debugging, and product improvement.
- Cookies and advertising identifiers: see our Cookie & Ads Notice for full details.
4. Purposes of processing
We process your personal information to:
- Create and manage your Naartjie account.
- Display localised listings and connect you with other users.
- Facilitate in-app messaging between buyers and sellers.
- Send transactional emails (login links, notifications).
- Detect fraud, abuse, prohibited content, and security incidents.
- When a chat is reported to us, read the messages in that conversation so a moderator can decide whether our rules were broken. We do not otherwise monitor private chats. A copy of the reported messages is kept with the report for five years.
- Improve and debug the platform (error logging, analytics).
- Display advertising — including Google AdSense personalised or non-personalised ads — to fund the free service.
- Comply with our legal obligations.
5. Lawful basis
We rely on the following grounds for processing:
- Consent — for non-essential cookies and personalised advertising (you may withdraw consent at any time in Settings → Privacy & safety → Cookie settings).
- Performance of a contract — processing necessary to provide the marketplace service you signed up for.
- Legitimate interests — security monitoring, fraud prevention, and product analytics, where these interests are not overridden by your rights.
- Legal obligation — where we are required to retain or disclose data by law.
- Reports that allege a crime — a report of fraud, impersonation, harassment, a prohibited item or a safety threat is an allegation of criminal behaviour, which POPIA treats as special personal information. We process it to establish, exercise or defend legal rights and obligations (section 27(1)(b)).
6. Sharing with third parties
We share personal information only where necessary with the following service providers acting as operators on our behalf:
- Supabase — database, authentication, and file storage — servers in the EU (Frankfurt); see the cross-border notice below.
- Cloudflare R2 — image storage and CDN delivery.
- Sentry (EU servers) — error diagnostics only. It receives the page address without its query string, your account id, and the technical stack trace. It does not receive your email address, display name, IP address, cookies, request headers, or the contents of your messages and listings. Error reports are kept for 90 days.
- Resend — transactional email delivery (receives your email address).
- Vercel — application hosting and, where you have accepted analytics cookies, aggregate page-view analytics. Vercel processes request metadata (IP address, user agent) to serve the site.
- Upstash — Redis used for rate limiting. Receives a short-lived key derived from your account id and IP address so we can stop abuse; it holds no listing or message content.
- OpenStreetMap Foundation — map tiles for the map, safe meetup spots and meetup planning. Your browser loads the tiles straight from OpenStreetMap's tile servers, so the OpenStreetMap Foundation receives your IP address and the part of the map you are viewing. Tiles load only when a map is on screen.
- Carto — map tiles instead of OpenStreetMap's, when we serve the map from Carto. Carto then receives the same things: your IP address and the part of the map you are viewing.
- EskomSePush — load-shedding times on the map. Our server asks for a suburb's schedule; nothing about you is sent.
- Google sign-in — if you choose to sign in with Google, Google confirms who you are and shares your name and email address with us.
- Google Analytics — only if you accept analytics cookies: the pages you open and the features you use, with your IP address anonymised. It stops the moment you withdraw.
- Google AdSense / Google LLC — advertising platform; may receive cookie identifiers and usage signals. Google acts as an independent controller for its advertising products. See Google's Privacy Policy.
We do not sell your personal information to third parties for their own marketing purposes.
7. Cross-border transfers (POPIA s72)
Your data is stored outside South Africa — mainly in the European Union — and Naartjie is operated from the Republic of Korea. The operators that hold or receive it are Supabase, Cloudflare, Vercel, Upstash, Resend, Sentry, Google, and for map tiles the OpenStreetMap Foundation or Carto. Here is where each of them keeps it:
| Provider | What | Region |
|---|---|---|
| Supabase | Database, sign-in, file metadata | EU — Frankfurt |
| Cloudflare R2 | Photos | EU (Eastern Europe hint) |
| Vercel | Hosting and server functions | EU — Frankfurt (fra1) |
| Upstash | Rate limiting, short-lived caches | EU — eu-central-1 |
| Resend | Email delivery | United States |
| Sentry | Error reports | EU |
| Sign-in with Google, if you choose it; ads and analytics only with your consent | Global (Google's own network) | |
| OpenStreetMap Foundation | Map tiles — your IP address and the map area you view | Global content delivery network |
| Carto | Map tiles instead of OpenStreetMap, when we use Carto — the same information | Global content delivery network |
POPIA section 72 does not forbid sending information abroad; it sets conditions. The providers that store or process your information for us — Supabase, Cloudflare, Vercel, Upstash, Resend and Sentry — do so under data processing agreements that bind them, and anyone they pass it on to, to protect it to a standard substantially similar to POPIA (section 72(1)(a)). For account holders, the transfer is also necessary to perform the contract we have with you (s72(1)(c)).
Naartjie is operated from the Republic of Korea. Administrative access to personal information — including the moderation of reports — takes place from Korea. This transfer relies on section 72(1)(c): it is necessary for the performance of the contract between you and Naartjie.
Apart from that access, three things leave the EU: the emails we send you (their address and body pass through the United States), map tiles (served from OpenStreetMap's global network, or Carto's when we use Carto), and Google's services, which run on Google's own network.
8. Who can access your data
Inside Naartjie, two people can: the founder and one backup administrator. Both are bound by a written mandate and confidentiality agreement, both use two-factor authentication, and every time either of them opens a reported chat or reveals an email address it is written to an audit log. The backup administrator exists so that an urgent safety report is never waiting on one person being awake.
Neither of them handles requests about your own data — those go to privacy@naartjie.co.za and are answered by the founder alone.
9. Security safeguards (POPIA s19)
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, and destruction. These include encrypted connections (HTTPS/TLS), access controls, and regular security reviews. No method of transmission over the internet is completely secure; we cannot guarantee absolute security.
10. Data retention
We keep personal information only for as long as the table below says. When a period ends we delete the record — or, where the table says so, remove what identifies you and keep the rest. Photos are deleted together with the record they belong to.
Access logs (including IP address) are kept for 30 days for security.
| Information | How long we keep it | Why |
|---|---|---|
| Your account and profile | While your account is open, then 30 days after you ask us to delete it | The 30 days let you change your mind — sign back in to cancel |
| Dormant accounts — updated terms not accepted within 90 days | Erased 12 months after the account becomes dormant. We email you 30 days before | We don't keep an account forever once its owner no longer accepts our terms |
| Listings you delete | 90 days, then permanently deleted | In case of a dispute or a police investigation |
| Expired listings | 12 months, then deleted like a listing you delete. We email you 30 days before | So you can relist within the year |
| Listings a moderator removed | 5 years, then permanently deleted | Kept as long as the report behind it, so an appeal can still be reviewed |
| Sold listings | 3 years, then permanently deleted | The same as chats — a payment dispute needs both |
| Your email address on the waitlist for an area that isn't open yet | 30 days after we tell you the area has opened, or 12 months if it doesn't open | It is used only to tell you once, when your area opens |
| The list of erased account IDs | Permanent | Keeps an erased person's ID hidden in our audit log, which can't be edited |
| Voicemail left on our contact number, and the copy emailed to us | 7 days | We reply by email, so the recording isn't needed after that |
| Reservation history | 3 years | To settle disputes about a trade |
| Your recent searches and recently viewed listings | 90 days, or until you clear them | Only to show them back to you |
| Community posts you delete | 90 days, then permanently deleted | So reports about them can still be checked |
| Chat messages | 3 years from the last message in the conversation | Disputes and police investigations |
| Ratings | Permanent — kept without your name after your account is erased | Other people's reputation rests on them |
| Reports | 5 years | To spot repeat behaviour and answer lawful requests |
| Administrator audit log — who opened or changed what, and when | Permanent | Accountability. The log is sealed: no entry can be edited or removed |
| Records of what you agreed to (terms, privacy, cookies) | While your account is open, and 3 years after it is erased | To prove what was agreed, and when |
| Analytics events | 13 months | Measuring how the app is used, only with your consent. Your identifier is removed if you withdraw consent or delete your account |
| Photos | Deleted together with the listing, post, chat or report they belong to | A photo is never kept longer than its record |
| The copy of reported messages kept with a report | 5 years, the same as the report | So a report can still be judged if the chat is deleted |
| Identity documents | We don't collect them | We never ask for ID |
| In-app notifications | 90 days | They are only reminders |
| Notices about content (copyright, defamation, illegal content) and what we did about them | Permanent | A complete record of every notice and every action |
| Error reports (Sentry) | 90 days | Finding and fixing bugs |
| Anything under a preservation hold in a criminal case | Every period in this table stops until the police confirm they have what they need | So evidence isn't destroyed during an investigation |
| Child sexual abuse material | Not kept as a record: isolated, handed to the police, then destroyed once they confirm receipt | Holding it is itself a crime; it is kept only as evidence for the police |
| A one-way coded (hashed) copy of the email address of an account suspended for safety reasons | 5 years | To stop the same person signing up again |
| Accounts closed because the holder is under 18 | Not kept — erased within 7 days, email hash included | A child's information isn't kept longer than it has to be |
| Access logs, including your IP address (kept by our hosting and database providers) | 30 days | Security |
| Network groups — a hashed, shortened form of IP addresses — used to spot coordinated reports | 90 days | Preventing abuse. Your full IP address is never stored in our database |
| The link between your analytics identifier and your account | 13 months, or until you withdraw consent | The same as analytics events |
| Moderation decisions about you or your content, and your appeals | 5 years. A suspension that is still in force is kept until it ends | So an appeal or a repeat problem can still be checked |
| Meetup times and places proposed in a chat | 3 years from the last message, deleted with the chat | They are part of the trade's record, like the chat itself |
| A daily record that a listing was opened, used only to count its views | 7 days | So a view is counted once a day, not every time the page reloads |
| Our queue of photo deletions and image updates still to run | 90 days. A photo deletion that keeps failing stays queued until it succeeds | So no photo is forgotten when deleting it fails |
| Links we email to confirm a privacy request | Until the link expires after 24 hours, then deleted in our daily clean-up | To check the request came from you. The request itself stays in our admin audit log |
Deleting your account doesn't shorten the periods for reports or the audit log, but they no longer show who you are. Analytics events are kept without your identifier.
11. Your rights as a data subject
Under POPIA you have the right to:
- Access — request a copy of the personal information we hold about you.
- Correction — request that inaccurate or incomplete information be corrected.
- Deletion — request that your personal information be deleted (subject to legal retention obligations).
- Objection — object to the processing of your personal information on grounds of legitimate interests.
- Withdraw consent — withdraw any consent you have given at any time, without affecting the lawfulness of processing before withdrawal.
To exercise any of these rights, contact our Information Officer at privacy@naartjie.co.za. We respond to access requests within 7 calendar days. We complete deletion requests within 30 calendar days.
Send your request from the email address registered to your account. We confirm it is you with a one-time link sent to that address, the time limit starts when you click it, and we only ever reply to that address. We never ask for ID documents.
You can also use the POPIA forms published by the Information Regulator — Form 1 to object to processing (section 11(3)) and Form 2 to ask for a correction or deletion (section 24). Send them to us at privacy@naartjie.co.za, not to the Regulator.
12. Direct marketing (POPIA s69)
We will only send you direct marketing communications if you have opted in. You may opt out of marketing emails at any time by clicking the unsubscribe link in any marketing email or by contacting us directly. Transactional messages (login links, important service notices) are not marketing and cannot be opted out of while your account is active.
13. Automated decisions
Naartjie does not make decisions about you based solely on automated processing that have a legal or similarly significant effect on you (POPIA section 71). Suspending an account is always a person's decision.
One automatic step comes close, so we explain it here. A single report of a safety threat, of a child under 18, or of an intimate image shared without consent — or several separate reports about the same thing — automatically and temporarily hides that listing, post, comment or profile. Your account is not suspended: you can still sign in, chat and trade. A person then reviews what was reported. We review reports within 2 working days. You can appeal from Appeals.
Because it is temporary, can be reversed, and doesn't restrict your account, we don't treat it as a decision under section 71.
14. Children
Naartjie is intended for adults and is not directed at anyone under 18. We do not knowingly collect the personal information of under-18s. If you believe a minor has provided us with personal information, please contact us and we will delete it promptly and restrict the account.
Photos that show a child's face are not allowed in listings or posts, whoever posts them. If you see one, report it and we will review it and take it down.
15. Complaints to the Information Regulator
You have the right to lodge a complaint with the Information Regulator of South Africa if you believe we have processed your personal information unlawfully:
Information Regulator (South Africa)
Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Complaints: POPIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za
Website: inforegulator.org.za
16. Cookies
For information about cookies and advertising identifiers, see our Cookie & Ads Notice.
17. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated to registered users by email and/or an in-app notice at least 14 days before they take effect. We encourage you to review this page periodically.
18. Contact
For privacy-related queries, contact our Information Officer at privacy@naartjie.co.za.
Related: PAIA Manual · Terms of Use · Cookie & Ads Notice