POPIA & data protection information

• Identity and contact details: first name, surname, email address.
• Banking details: bank name, account holder name, account number, branch code.
• Verification documents: the bank statement you upload.
• Payment details: your PayPal email or username and the PayPal transaction ID, plus payment proof you upload.
• Transaction records: amounts, rate, fee, status, timestamps and internal review notes.
• Support correspondence: your messages and any attachments.

We do not collect ID numbers, biometric data, health information or any special-category information, and we do not knowingly collect information about children.

• To carry out the exchange you requested (performance of our agreement with you).
• To verify that the PayPal sender and the bank account holder are the same person, which protects you and us against fraud and reversals.
• To keep accurate business and accounting records.
• To communicate transaction status and respond to support requests.

We collect the minimum needed for these purposes and we do not use your information for unrelated purposes, marketing lists or resale.

• Encrypted connections (HTTPS) for all traffic between you and the platform.
• Database-level access rules so records are visible only to your signed-in account and authorised administrators.
• Private storage for bank statements, payment proofs and support attachments — no public links.
• Passwords handled by our managed authentication provider and never stored in readable form.
• Administrative permissions split into tiers, with account deletion and role changes limited to the super-administrator.
• Old pending or declined bank statements deleted when you submit new banking details.

These are the measures we actually have in place. We do not hold an external security certification, penetration-test attestation or compliance audit, and we do not claim one.

Our hosting, database, email and messaging providers may store or process data on servers outside South Africa. We use established providers and only share what is necessary for them to operate the service on our behalf.

You may ask us at any time:

• What personal information we hold about you.
• Why we hold it and who has had access to it.
• For a copy of the records associated with your account.

Send the request from the email address registered on your account so we can confirm it is really you, and include your full name. We will confirm receipt within 24 hours and aim to respond within 5 business days. If we need more time or more information to identify you, we will say so.

• You can correct your own name, contact details and banking details directly in your profile. Approved banking details require a resubmission so we can re-verify them.
• If information we hold is inaccurate and you cannot change it yourself, ask us and we will correct it where we are able to.
• You can ask us to delete your account and associated personal information. We may keep limited transaction records where we need them for accounting or legal reasons, and we will tell you what is retained.
• You can opt out of non-essential email notifications using the unsubscribe link in any notification email.

Note for administrators: the responsible legal entity and business address for POPIA purposes, and a named information officer, have not been configured yet and are therefore not shown publicly. Add them in the admin settings.

Related pages: Privacy Policy · Complaints · Terms