Privacy Policy

Note for administrators: the registered legal entity, registration number and business address for this policy have not been configured yet and are therefore not displayed. Add them in the admin settings.

We collect only what we need to run an exchange and to verify that it is safe:

• Account information — your first name, surname and email address, plus a password stored in hashed form by our authentication provider. If you sign in with Google, we receive your name and email from Google.
• Banking information — bank name, account holder name, account number and branch code for the account you want to be paid into.
• Bank statements — the statement document you upload so we can confirm you are the account holder.
• Transaction information — the USD amount, Rand payout, rate and fee applied, timestamps, status changes and internal notes for each exchange.
• Payment information — the PayPal email or username you send from and the PayPal transaction ID, plus any payment proof or receipt you upload. We never receive or store your PayPal password or card details.
• Support communications — messages, ticket history and any files you attach when you contact support, including your name and email attached to the ticket.
• Technical information — basic operational logs and error reports generated by our hosting and database providers, and browser notification permission state if you enable notifications.

• To perform the exchange you asked us for and pay the correct Rand amount to the correct account.
• To verify that the PayPal sender, the registered name and the bank account holder are the same person — this is our main protection against fraud and payment reversals for both sides.
• To keep records of transactions we have processed, including for accounting purposes and for resolving disputes.
• To communicate with you about your exchanges — status updates by email, in-app notifications and support replies.
• To investigate suspected fraud, abuse or misuse of the service.

We do not sell your information, and we do not use it for advertising or profiling.

• Account, bank and transaction records are stored in a managed PostgreSQL database with row-level access rules, so your records are only readable by your own signed-in account and by authorised administrators.
• Bank statements, payment proofs and support attachments are stored in private storage buckets that are not publicly accessible and require an authorised, time-limited link to view.
• Data is transmitted over encrypted HTTPS connections and passwords are never stored in plain text.
• Access to administrative tools is restricted to a small number of admin accounts, with the highest-risk actions limited to a single super-administrator account.

We describe our security measures honestly and we do not hold any security certification, external audit or compliance accreditation.

• You, through your account.
• Authorised SwapXchange administrators, for verification, payouts and support.
• Our service providers, strictly to host and operate the platform: our cloud database, storage and authentication provider, our website hosting provider, our transactional email provider, and a messaging service used to alert our team to new submissions. These providers process data on our behalf and may store it outside South Africa.
• Third parties where we are legally required to disclose information, for example under a valid legal or regulatory request.

We never publish your banking details, statements or support attachments, and we do not share them with other customers.

• Transaction records are kept for as long as we may need them for accounting and dispute-resolution purposes.
• Bank statements and payment proofs are kept while your verification remains active. When you resubmit banking details, the previous pending or declined statement file is deleted.
• Support tickets and attachments are kept while the matter is open and for a reasonable period afterwards for reference.
• If you delete your account, your profile, banking details, statements and support history are removed. We may retain limited transaction records where we need them for accounting or legal reasons.

Administrators: specific retention periods should be inserted here once agreed with your legal adviser.

You can ask us to:

• Tell you what personal information we hold about you.
• Correct information that is inaccurate or out of date — you can also edit your own profile and banking details in the app.
• Delete your account and associated personal information, subject to records we must keep.
• Stop sending you non-essential emails — every notification email includes an unsubscribe link. Essential transaction and security messages continue while your account is active.
• Explain how a decision on your verification or exchange was reached.

See our POPIA information page for how these requests work in South Africa.

We use only what the app needs to function: a session token so you stay signed in, and local settings such as whether you dismissed a banner. We do not run advertising or cross-site tracking cookies. Independent review content embedded from Trustpilot is loaded from Trustpilot and is subject to their own privacy practices.

If we change this policy we will update this page. For any privacy question or request, contact our support team, or use the contact page. We are not able to give you legal advice — this policy is an explanation of our practices, not a legal opinion — and SwapXchange recommends you seek independent advice if you need it.