Privacy Policy

1. What we collect

Account details: name, email, phone and password (stored as a salted hash — we can never read it). Delivery details: your address, used to generate courier waybills and quotes. Bank details: if you add them, used solely to pay your withdrawals by EFT. Marketplace activity: listings, photos you upload, offers, purchases, valuations and notifications. Technical data: standard server logs (IP address, timestamps) used for security and rate limiting.

2. How we use it

To operate the marketplace: showing your listings, processing payments and deliveries, sending notifications you'd expect (offers, acceptances, payouts), verifying your email, preventing fraud, and meeting legal obligations. We do not sell your personal information, and we don't use it for third-party advertising.

3. Who we share it with

Only the operators needed to serve you: PayFast (payments — we never see or store your card number), Bob Go and its couriers (your name, address and phone, to deliver parcels), Anthropic (the card photos you submit for AI scanning/valuation), and our email provider (your address, to send transactional email). Buyers and sellers in a transaction see each other's display name only — addresses go onto waybills, not to the other party's screen.

4. Storage and security

Data is stored in our database and protected with industry-standard measures: hashed passwords, signed payment notifications, HTTPS in production, security headers and rate limiting. Listing photos are stored on our servers and are publicly visible by design (they're your shop window). We keep transaction records as required by South African tax and financial law.

5. Your rights (POPIA)

You may request access to, correction of, or deletion of your personal information — most details you can edit yourself on the account page. Account deletion removes your profile and personal details; transaction and ledger records we must retain by law are kept but de-linked where possible. To exercise any right, email us and we'll respond within a reasonable time. You may also lodge a complaint with the Information Regulator (South Africa).

6. Cookies and local storage

We don't use tracking cookies. Your browser's local storage holds your sign-in token and display name so you stay logged in — signing out clears them.

7. Contact

Information Officer: SportsCard ZA — email us.

This is a starter template prepared without legal review — have an attorney check it before significant scale.