Privacy Policy

Section 1

Introduction

SwapMate (Pty) Ltd ("SwapMate", "we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application.

We comply with the Protection of Personal Information Act (POPIA) of South Africa and other applicable data protection laws. SwapMate acts as the responsible party for the processing of your personal information.

Section 2

Information We Collect

Personal Information

Name and contact details (email, phone number). Your email address and phone number are never shown to other members. To other members, your name is shown only as your first name plus the initial of your surname (for example, “Isaac W.”) — never your full surname.
Profile information, including biography (up to 280 characters, publicly visible) and photos
Location data: suburb (collected at signup) and approximate GPS coordinates (required to provide the service)
Age attestation — confirmation that you are 18 years of age or older, recorded with a timestamp at signup
Payment information (processed securely by the Apple App Store and Google Play via RevenueCat — we do not receive or store your card details)
Notification preferences (push, email, and marketing — managed individually)
Swap preferences, including your preferred swap radius
Communication preferences and consent records

Usage Information

App usage patterns, feature interactions, and preferences
Device information and identifiers
Log data and analytics
Interaction with other users (messages, swaps, favourites)
Gamification data (badges, leaderboard rankings, swap counts)

Company Information (B2B Accounts)

Company name, description, and contact details
CIPC registration number
VAT number (optional, where applicable)
Business type (Retail, Wholesaler, Pawnshop, Repair Shop, Charity / NPO, Trader / Reseller, Other)
Province and physical address (street, suburb, postal code)
Team member roles and permissions
Company audit trail and activity logs
Company items and analytics data

Section 3

How We Use Your Information

To provide and maintain our services
To process transactions, swaps, and boost purchases
To communicate with you about your account
To improve our app and develop new features
To personalise your experience
To calculate and display gamification metrics (badges, leaderboards)
To generate and validate exchange codes during physical swap handovers
To facilitate location-based item discovery
To provide optional AI-assisted listing features (generating suggested item descriptions from the text you enter and, for premium users, from item photos you submit)
To ensure safety and prevent fraud
To comply with legal obligations under POPIA and other laws

Section 4

Location Services

SwapMate is a location-based marketplace, so location data is necessary to provide the service — it powers nearby item discovery, distance calculations, and location-based search, and lets your listings be matched to people near you. Because it is integral to how SwapMate works, location access is required to register and to list items; we process it as necessary to provide the service, not as optional consent. We only ever use an approximate, fuzzed location (about city/suburb level) and never your exact GPS coordinates.

Location data is used solely for platform functionality
We do not track your location in the background
Your suburb is displayed alongside your listings to support local discovery
GPS-level location is used only for distance and proximity calculations and is never publicly displayed
Because location is required to use SwapMate, disabling it in your device settings will prevent you from registering or creating listings

Section 5

Exchange Code Data

When a swap meeting is confirmed, SwapMate generates unique exchange codes for both parties to verify the physical handover. The following applies to this data:

Exchange codes are stored on the swap record and are only visible to the two parties involved
Codes are generated at meeting confirmation and are invalidated once the swap is completed
Code verification timestamps are retained as part of the swap audit trail
We do not share exchange code data with any third parties

Section 7

International Data Transfers

SwapMate uses Supabase (our database, authentication and storage provider) to store and process your personal information. Supabase hosts our data on infrastructure located in the European Union (Ireland). This means your personal information is transferred to and stored outside of South Africa.

In accordance with Section 72 of POPIA, by registering for and using SwapMate you consent to this cross-border transfer of your personal information.

We ensure appropriate safeguards are in place through data processing agreements and standard contractual clauses with our processors. The European Union maintains data-protection laws that provide protections substantially similar to those required under POPIA.

Your account, listing and swap data is stored via Supabase, hosted in the European Union (Ireland)
Supabase and its infrastructure sub-processors are bound by data processing agreements and standard contractual clauses for international transfers
Where you use our AI-assisted listing features, the text you submit (and, for premium photo analysis, the image) is processed by our AI providers, Anthropic and/or Google (Gemini), whose servers are located in the United States
Subscription and purchase processing is handled by the Apple App Store and Google Play (via RevenueCat, our subscription-management provider, whose servers are located in the United States); we do not receive or store your card details
Where you choose to verify your identity, your ID document, selfie and facial biometric data are processed by Didit, our identity-verification provider, on infrastructure located outside South Africa; by consenting to verification you consent to this cross-border transfer under Section 72 of POPIA (see Section 14)
You may withdraw consent at any time by deleting your account via Settings

Section 8

Your Rights Under POPIA

As a data subject under POPIA, you have the right to:

Access your personal information
Correct inaccurate information
Request deletion of your data
Object to processing of your data
Withdraw consent at any time
Data portability (export your data)
Lodge a complaint with the Information Regulator

You can exercise these rights at any time through the Settings screen in the app, or by contacting our Information Officer at privacy@swapmate.co.za.

Section 10

Data Security

We implement appropriate technical and organisational measures to protect your personal information, including:

Encryption of data in transit and at rest
Secure authentication via Supabase Auth
Row-Level Security (RLS) policies restricting data access at the database level
Rate limiting to prevent abuse
Regular security assessments
Access controls and monitoring

Section 11

Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law.

Active accounts: data retained while account is active
Deleted accounts: data removed within 30 days (grace period for cancellation)
Transaction records: retained in anonymised form for up to 7 years as required by South African tax and company law
Audit logs: retained for 2 years for security purposes

Full instructions for deleting your account and personal data are available at swapmate.co.za/data-deletion.html.

Section 12

Children's Privacy

Our services are not intended for children under 18. All individual users must affirmatively confirm at registration that they are 18 years of age or older. We do not knowingly collect personal information from anyone under 18, and we will take immediate steps to delete any such information if we become aware of it. If you believe we have collected information from a child, please contact us immediately.

Section 13

Third-Party Services

Our app integrates with the following third-party services:

Supabase (authentication, database and storage — servers in the European Union / Ireland)
RevenueCat (subscription and in-app purchase management, with billing handled by the Apple App Store and Google Play)
Didit (identity verification — capture and analysis of your ID document, selfie and facial biometric data; see Section 14)
Anthropic and Google (Gemini) (AI-assisted listing descriptions and, for premium users, photo analysis)
Google Places (location search and address autocomplete)
OpenStreetMap / Nominatim (address search and geocoding)
A third-party IP-geolocation service (currently ipinfo.io or ipwho.is) that estimates your approximate location from your IP address
Google and Facebook (optional social sign-in, if you choose to log in with those accounts)
Sentry (crash and error monitoring)
WhatsApp (optional contact feature for premium users)
Expo (push notifications and app delivery)

Each of these services has its own privacy policy. We encourage you to review their policies.

Section 14

Identity Verification & Biometric Information

SwapMate offers optional identity verification so that members can earn a “verified” badge and so that groups can be recognised as official. Because this process involves biometric information, we describe it separately and in detail here.

What we collect

If you choose to verify your identity, our verification provider collects:

An image of your government-issued identity document (Smart ID card, ID book, or passport)
A live selfie captured with your device camera
Facial biometric information derived from the above — including a “liveness” check (confirming a real, present person) and a facial comparison between your selfie and the photo on your ID

We refer to this collectively as your “verification information”.

Under POPIA, biometric information is “special personal information”. We process it only with your explicit consent, which you give in the app immediately before verification begins. You do not have to verify your identity to use SwapMate’s core features.

Why we collect it

To confirm that you are who you say you are and issue a verified badge
To reduce impersonation, fraud and fake accounts
To support trust and safety, including for in-person swap meets

Who processes it

Identity verification is performed by Didit, our third-party identity-verification provider. Your ID document, selfie and facial biometric data are captured and analysed by Didit on your device and on Didit’s own infrastructure.

SwapMate does not store your ID document image or your selfie. We receive and store only the outcome of the check (for example: verified, declined, or referred for review) together with an audit record of the decision.

Cross-border processing

Didit processes your verification information on infrastructure located outside South Africa. In accordance with Section 72 of POPIA, by consenting to identity verification you consent to this cross-border transfer. Didit is bound by its own privacy and data-protection obligations; we encourage you to review Didit’s privacy policy.

Retention

Didit retains the captured media in accordance with its own retention policy. SwapMate retains only the verification outcome and audit record for as long as your account is active and for any period required by law (for example, for fraud-prevention and record-keeping obligations). You may withdraw your consent at any time by choosing not to verify, or by deleting your account.

Official group verification

If you request “Official” status for a group you own or manage, you submit supporting information — such as a short statement and links — which our team reviews. This information is not biometric. Your own identity must be verified before you can request Official status for a group.

Your rights

You may request access to, correction of, or deletion of your verification information, subject to any retention we are legally required to maintain for fraud-prevention purposes. You may also lodge a complaint with the Information Regulator (see Section 16). For any request relating to your biometric or verification information, contact our Information Officer at privacy@swapmate.co.za.

Section 15

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via in-app notification and update the "Last updated" date. Continued use of the app after changes constitutes acceptance.

Section 16

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

General enquiries info@swapmate.co.za

Privacy / Information Officer privacy@swapmate.co.za

Address 241 Le Roux Avenue, Midrand, Gauteng, 1686

Information Regulator inforegulator.org.za