Privacy Policy

This policy is issued under the Protection of Personal Information Act 4 of 2013 (POPIA). It explains what personal information ThabangVision collects, why, who else processes it, how long we keep it, and what you can require of us.

The responsible party is:

THABANGVISION STUDIO (Pty) Ltd
9873 Extension 5, Soshanguve South, Gauteng, 0152, South Africa
Registration number 2025/742948/07
privacy@thabangvision.com

Our designated Information Officer is Thabang Mashinini-Sekgoto, reachable at privacy@thabangvision.com.

Account and profile. Name, email address, phone number, display name, bio, skills, and avatar photo. If you sign in with Google, Google shares your name, email address and profile photo with us.

Address and location. Street address, city, province, postal code, and the geographic coordinates of the address you give us. Coordinates are used to estimate the delivery distance and fee for your address.

Identity verification. Photographs of your identity document and a selfie holding it. We also record technical detail extracted from those images, including the date they were taken, device make and model, and any GPS coordinates embedded in them, together with your IP address and browser at the time of submission. If you allow it, we also record your location (from your browser) at the moment you submit. We read the ID number from the document to check it is valid; we store it only partly hidden (most digits masked) and as a keyed one-way fingerprint, never in full as a separate field.

Banking details, if you receive payouts as a creator: bank name, branch code, account type, account holder name, and the last four digits of your account number. Your full account number is passed straight to our payment provider to set up your payouts and is not kept on our systems.

Bookings and transactions. What you booked, when, for how long, project descriptions, deliverables, amounts paid, and equipment condition records and photographs at collection and return.

Communications. Messages you send through the platform, support requests, contact form submissions, and bug reports, including the device and browser details attached to a bug report.

Conversations with Ubunye, our AI assistant. These are stored on our systems, not only in your browser. See section 6.

Technical and usage data. IP address, browser and device information, pages viewed, and actions taken on the platform. We keep our own record of platform events for product analytics. Where you use Ubunye without signing in, we identify the session by a hashed version of your IP address rather than the address itself.

To perform our contract with you: creating and managing your account, taking payment, fulfilling bookings, arranging collection and return, settling deposits, and paying creators.

To meet legal obligations: keeping tax and transaction records, and complying with lawful requests.

For our legitimate interests: preventing fraud and identity theft, securing the platform, resolving disputes, and improving the product.

With your consent: identity verification processing, and marketing. Consent for verification is captured explicitly before you upload anything, and recorded with a version and timestamp. You can withdraw consent at any time, though we cannot verify your identity, and therefore cannot let you hire equipment, publish gear, or receive a first payout, without it.

This is the most sensitive information we hold, so we set it out separately.

Where it is stored. Your identity document and selfie are stored in a private, access-controlled storage bucket on our Supabase infrastructure. They are not public, and staff view them through signed links that expire after one hour or less.

Automated checks. To check that the face in your selfie matches the face on your ID, both images are sent to an AI service provider we use (currently Google) for an automated comparison. Our AI service provider may process them outside South Africa. We do this only for verification, and we keep the match result, a confidence score and a one-sentence reason. A person then reviews every submission, usually within one working day, and we email you the outcome. The automated check never approves or rejects you on its own. When you collect equipment, our staff may look at your selfie to check that it is you.

Your consent. We ask for a separate consent for this check before you upload anything, and record it with the version of the notice you saw and the time. You can withdraw it at any time by emailing privacy@thabangvision.com; we then stop processing your ID and selfie and delete the images, but we cannot complete your verification without them.

Duplicate detection. We store a one-way cryptographic fingerprint of the document file so that the same document cannot be used to verify several accounts. The fingerprint cannot be reversed to recreate the document.

How long we keep it. The document and selfie images are deleted automatically 30 days after your verification has been reviewed. If you submit again after a rejection, your earlier images are deleted straight away. The technical detail described in section 2, the document fingerprint, and the outcome of the review are kept for longer, for fraud prevention and to show that we verified you properly. Your verification status and consent record are kept for the life of your account plus five years for tax and legal audit purposes.

We use the following operators. Each processes only what it needs to, under our instruction.

• Supabase: database, authentication, and file storage. Holds effectively everything described above.
• Paystack: our current payment provider, for online payments, refunds and creator payouts. Receives your email address and transaction detail, and for payouts, the account holder name, bank account number, and branch code.
• Yoco and PayFast: alternative payment providers our system supports. Not currently used for new payments. We will update this list before switching.
• Cloudinary: image hosting for avatars, portfolios, and listing photographs. Verification documents are not stored here.
• Google: the automated face comparison in section 4, image tagging for gear and portfolio photos, and sign-in with Google.
• AI providers: Ubunye’s answers and our drafting tools (listing descriptions, bios, rate suggestions) are generated by third-party AI providers, which may include Google (Gemini and Gemma), Anthropic (Claude), OpenAI and Groq, depending on our configuration and their availability. Your messages, and when you are signed in, relevant context from your profile and bookings, go to whichever provider is answering at the time. They may process them outside South Africa. We list any AI provider here before we use it.
• Vercel: hosting, and cookie-free page-view analytics (Web Analytics), which count visits without identifying you.
• Google Workspace (Gmail): outbound email. Receives recipient addresses and message contents.
• Twilio: WhatsApp messaging. Not currently active.
• OpenStreetMap (Nominatim): address suggestions. When you type an address into our address field, that text is sent from your browser to OpenStreetMap’s servers to suggest matches.

We do not sell your personal information, and we do not share it for anyone else’s marketing.

Your conversations with Ubunye are stored in our database against your account, or against a hashed session identifier if you are not signed in. Authorised administrators can review them for support, safety, and quality purposes.

Message content is sent to our AI providers to generate a response. Please do not paste identity numbers, banking details, passwords, or other sensitive information into the assistant.

Several of the operators above process personal information outside South Africa. Where that happens we rely on section 72 of POPIA: the recipient is bound by an agreement or by laws that provide a comparable level of protection to POPIA, or the transfer is necessary to perform our contract with you.

The transfer that matters most to you is the one described in section 4: your identity document and selfie are sent to our AI service provider for the automated comparison, and may be processed outside South Africa.

• Identity document and selfie images: deleted 30 days after review.
• Verification outcome, technical detail, and document fingerprint: retained for fraud prevention.
• Consent records and verification status: account life plus 5 years.
• Transaction and booking records: 5 years, as tax law requires.
• Banking details (bank, account holder, last four digits, payout reference): until you remove them or your account is closed.
• Profile and account data: deleted within 30 days of account closure, except where we must keep a record.
• Ubunye conversations and platform event logs: retained while they remain useful for support, safety, and product analytics.

Access to the database is controlled by row-level security rules so that, as a rule, you can read only your own records. Verification documents sit in a private bucket reached only through expiring signed links. Transport is encrypted. Sessions log out automatically after 30 minutes of inactivity. We keep an audit trail of administrative actions.

We do not store full bank account numbers. When you add banking details, the number goes directly to our payment provider, which returns a reference we use to pay you. We keep only the last four digits, so you can recognise the account. Even so, access to that record is restricted at the database level to the account that owns it.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the Information Regulator as POPIA requires.

We use essential cookies for sign-in and session management. Without them the platform cannot keep you logged in.

Our page-view analytics (Vercel Web Analytics) do not use cookies. We also keep our own record of actions taken on the platform, as described in section 2. We do not use advertising or cross-site tracking cookies, which is why there is no cookie banner. You can block or remove cookies in your browser settings, though sign-in will stop working if you block the essential ones.

We send transactional messages (booking confirmations, verification outcomes, deposit and dispute notices) because they are necessary to perform our contract with you. These are not marketing and you cannot opt out of them while you hold an active booking.

Marketing emails are sent only if you have opted in, and opting in is always a separate, unticked choice. To stop receiving them, email privacy@thabangvision.com and we will remove you.

Under POPIA you may:

• ask what personal information we hold about you, and get a copy;
• ask us to correct or complete anything inaccurate;
• ask us to delete information we no longer have a lawful reason to keep;
• object to processing based on our legitimate interests;
• withdraw a consent you previously gave;
• complain to the Information Regulator.

To exercise any of these, email privacy@thabangvision.com from the address on your account. There is currently no self-service delete button in the dashboard, so account deletion is handled by us on request. We respond within 30 days, and we may need to confirm your identity first.

Some information we must keep even after you ask us to delete it, in particular transaction records required by tax law. We will tell you what we are keeping and why.

How to make an access, correction or deletion request is set out on our access requests page.

The platform is for people aged 18 and over, and you confirm your age during verification. We do not knowingly collect information about children. If you believe a child has given us personal information, contact us and we will delete it.

Raise a privacy concern with us first at privacy@thabangvision.com. We acknowledge within 2 business days and aim to resolve within 10 business days.

If you are not satisfied, you may complain to the Information Regulator (South Africa):

JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Complaints POPIAComplaints@inforegulator.org.za
General inforeg@inforegulator.org.za
https://inforegulator.org.za

We update this policy when our practices change. The current version is always on this page, with the date at the top. Where a change materially affects your rights, we will tell you directly.

See also our Terms of Service and Refunds, Returns and Cancellations Policy.