Privacy Policy

Last updated: 15 October 2026

This policy explains what personal information Gatvol My Bru collects, why, who it's shared with, and your rights under South Africa's Protection of Personal Information Act (POPIA).

1. Who is responsible for your information

Gatvol My Bru, a South African business based in the Western Cape.
Email: support@gatvolmybru.co.za

Our Information Officer is the person responsible for how we handle personal information. You can reach them about anything in this policy at support@gatvolmybru.co.za.

2. What we collect

Information	When	Why	Who can see it
Email address and password	When you sign up	To create your account and let you log in	Only us. Your password is stored scrambled (hashed) by our login provider, and even we can't read it.
Display name	When you sign up	To show who wrote a review	Everyone, next to your reviews
Reviews: score, comment and date	When you post a review	That's what the site is for	Everyone
Businesses you add	When you add a business	To list the business, and so we know who suggested it	The business is public. Who added it is only visible to us.
Your name, phone number and role at a business	When you claim a business	To check that you really represent the business	Only you and us
Email settings for claimed businesses	When your claim is approved	To email you when your business gets a new review. You can switch this off any time in your business dashboard.	Only you and us
Responses to reviews	When a business owner responds	To let businesses give their side	Everyone
Payment records (amount, date, period paid for)	When you pay for the paid plan	To run your plan and keep records the law requires	Only you and us

We don't sell your information, show adverts, or use advertising trackers. We don't collect special personal information (like health, religion or biometrics), and the site isn't meant for anyone under 18.

3. Services we use

The site relies on a few service providers. They handle information for us so the site can work, and some of them may store or process it on servers outside South Africa:

Supabase stores our database (accounts, reviews, businesses, claims) and handles logging in.
Resend sends our emails, such as new-review notifications to business owners. It receives the recipient's email address and the content of the email.
Cloudflare hosts the website and protects it from attacks. Like any web host, it receives your IP address and basic browser details when you visit.
Google provides the "Find it on Google" search on the Add-a-business page (Google Maps Platform), and the font used for our logo (Google Fonts). Your browser connects to Google when those load.
GIPHY provides the reaction GIFs on business pages. Your browser connects to GIPHY to show them.
Unsplash provides the background photo. Your browser connects to Unsplash to load it.
jsDelivr delivers a piece of code the site needs for the database connection.

These companies have their own privacy policies. Where your information goes outside South Africa, we use well-known providers who protect it with security measures and legal agreements, as POPIA requires.

4. Cookies and browser storage

When you log in, your browser stores a small login token so you stay logged in from page to page. That's necessary for the site to work. We don't use advertising or tracking cookies.

5. How long we keep it

Account and reviews: while your account exists. If you delete your account, we remove your email and login details. We'll ask whether you want your reviews deleted or kept with your name removed.
Claim details: while your claim is active, and for up to 12 months after a claim ends or is rejected, in case of disputes.
Payment records: for as long as tax and other laws require (usually 5 years).

6. Keeping it safe

All connections to the site are encrypted (https). Database rules make sure people can only see and change what they're allowed to, so, for example, nobody else can see your phone number if you claim a business. If we ever discover a breach affecting your information, we'll tell you and the Information Regulator, as POPIA requires.

7. Your rights

Under POPIA, you have the right to:

ask what personal information we have about you, and get a copy,
ask us to correct information that's wrong or out of date,
ask us to delete your information, including closing your account,
object to how we use your information,
complain to the Information Regulator (see below).

Email support@gatvolmybru.co.za to do any of these. We'll reply within 30 days. We may ask you to confirm your identity first.

8. Complaints

Please contact us first so we can try to sort it out. If you're not happy with our answer, you can complain to the Information Regulator of South Africa: inforegulator.org.za/complaints · enquiries@inforegulator.org.za

9. Changes to this policy

If we change how we use your information, we'll update this page and its date, and email account holders about important changes.