Privacy Policy

Protection of Personal Information Act, 2013 (POPIA) notice · Last updated 14 October 2026

This policy explains how Avuno Technologies (Pty) Ltd (“we”, “us”, “myquack”), the operator of myquack (https://myquack.co.za), collects, uses, shares and protects your personal information, and the rights you have under POPIA. We are the “responsible party” for the personal information we process.

1. The personal information we collect

• Account details — your name, verified email address, optional phone number and a securely hashed password if you use one. We create an account after email verification and your confirmation when one is needed; the same account can book services and manage a business.
• Access and saved progress — expiring, hashed email-link challenges and private drafts containing the business or booking details you enter. We use these to verify access and let you return to your selection.
• Journey milestones — whether a saved draft or checkout reached email verification, review, payment or publication, and whether you returned after inactivity. These first-party records help us improve the service and report aggregate conversion statistics to administrators. Milestone events do not contain contact details, notes, link secrets or payment credentials.
• Provider listing (providers only) — business name, industry and specialisation, description, town/area, and public contact details you choose to publish.
• Payment setup (providers only) — the authorised representative’s legal name, ID/passport and country, mobile number, entity registration and bank account details, used for TradeSafe checks and released escrow payouts.
• Verification documents (providers who request a review) — an image or PDF of official evidence (e.g. registration, a trade/qualification certificate or an ID). See “Verification documents” below.
• Booking & transaction data — the bookings you make or receive, amounts, escrow status, payouts, and related records.
• Communications — messages you send us and emails we send you.
• Private calendar — your personal event titles, dates, locations, notes, busy/free choices, recurrence exceptions and requested reminder times. Only your account can view these in MyQuack. Customers see the available booking slots, not your private event details. Reminders contain the event title and time; they do not include notes or other customers’ contact details.
• Technical data — limited log data such as IP address and browser type, used for security and to keep the service running.

We do not collect or store your card or banking login details — card payments are handled entirely by our escrow partner, TradeSafe (see below).

2. How and why we use it, and our lawful basis

Under POPIA we process your personal information only where we have a lawful basis to do so:

Purpose	Lawful basis (POPIA)
Create and manage your account; provide the marketplace	Performance of our contract with you
Take bookings, have funds held in escrow by TradeSafe and pay providers out	Performance of contract; our legitimate interests
Review a provider’s applicable business documents	Your request/consent to upload; performance of the provider agreement where evidence is required
Send you transactional emails (access, booking, payment, invoice)	Performance of contract
Save drafts and measure onboarding and checkout completion	Provide and improve the service; our legitimate interests
Store your private calendar, protect busy time and deliver reminders you select	Provide the calendar service you request; your selected reminder preferences
Keep the platform secure and prevent fraud	Our legitimate interests; legal obligation
Keep tax and financial records	Compliance with a legal obligation

Providing your information is voluntary, but some of it is necessary to use myquack — for example, we cannot create an account without a name and email, or pay a provider out without their bank details.

3. Who we share it with (operators & other users)

We share personal information only as needed to run the service, with third parties acting as our “operators” under written agreement, and with the other party to a booking:

• Payments & escrow — TradeSafe, our independent licensed escrow provider, which holds booking funds in escrow, pays providers out, and carries out its own identity, KYC and FICA checks. We share the information needed for payments, payouts and those checks, and cooperate with TradeSafe’s lawful data requests.
• Email delivery — Brevo sends our access, booking, payment and invoice emails. Messages sent to our business addresses are forwarded by Forward Email to our shared Microsoft Outlook inbox.
• Document review — local server checks and authorised MyQuack staff; no AI operator receives verification documents. Optional AI business tools use their separately requested inputs and do not replace document review.
• Hosting — our cloud hosting provider, where the service and database run.
• Other users — once a booking is paid, the customer and provider are shown the details needed to fulfil it (such as name and contact details).

Our email service records sending, delivery, bounce and related operational status. Brevo may also record when a message image loads or an email link is opened through its delivery links. These signals can be affected by mail-client privacy features and security scanners. We use them for service delivery and diagnosis, not third-party advertising. Email link access still requires confirmation on MyQuack.

We do not sell your personal information, and we do not share it for third-party advertising.

Provider no-shows. If a provider confirms a booking, fails to attend, and does not make reasonable contact with the client within a reasonable time, we may — at the affected client’s request — disclose that provider’s identifying and contact details to the client so the client can seek a remedy or take legal action, as set out in clause 7 of our Terms. Providers give this consent in the Terms, and we disclose only what is reasonably necessary for that purpose.

4. Verification documents — private local checking and human review

Our checklist depends on your business type and services. Individuals and sole traders do not need a company certificate; registered companies and organisations do. Relevant qualification or registration evidence is requested for professional services and selected trades. It is optional for other services. Professional-service evidence must be accepted before new providers in those categories can take bookings.

When you choose “Upload for review”, we encrypt the file in private server storage, outside public uploads. Local PDF text extraction or OCR reads it and checks readability, expected headings and basic formats, including an ID checksum where applicable. Verification documents are not sent to an AI API. Authorised MyQuack administrators inspect the evidence, confirm the relevant identifying details and record an acceptance, correction request or refusal. You can retry a saved copy, explain a difference or upload a replacement; accepted evidence remains while a replacement is pending.

Neither local checks nor a MyQuack review guarantee that a document is authentic, a person owns it or a licence or registration is currently valid. We do not routinely confirm documents with issuing bodies. A reviewer may require further evidence or issuer confirmation. TradeSafe’s identity, bank and applicable payment checks are separate; saved bank details do not mean those checks passed.

Originals and previews are removed after 30 days unless a recorded legal hold requires retention. Restricted encrypted backup copies expire separately within 30 days of backup. Review details are kept while needed to maintain your account, prevent impersonation or deal with a dispute or lawful claim. These may include the name, ID/passport number, company reference, bank details, address, qualification, file fingerprint, outcome and review explanation. Access is restricted to the account owner’s status view and authorised staff; public listings show only the review badge or progress.

Reviewer access and decisions are recorded. Sensitive fields are encrypted, excluded from conversion analytics and never included in document-update email messages. You can contact us to access or correct the record or request erasure. A legal hold may prevent deletion of evidence needed to establish, exercise or defend a claim; other personal data is removed under our erasure process.

5. Cross-border transfers

Some of our operators (for example our email and payment providers, and optional AI business tools) process data on servers outside South Africa. Where personal information is transferred across borders, we take reasonable steps — including contractual safeguards — to ensure it receives a level of protection comparable to POPIA, as required by section 72. By using those features you consent to these transfers where consent is the applicable basis.

6. How we protect it

We take appropriate, reasonable technical and organisational measures to safeguard personal information against loss, damage and unauthorised access, as required by section 19 of POPIA. These include:

• All traffic is encrypted in transit (HTTPS/TLS, with HSTS enforced).
• Passwords are stored only as salted one-way hashes — never in plain text — and we never see or store your card or banking-login details.
• Email access links expire, work once and are stored as hashes. Existing-user upgrades require password proof and email confirmation; administrator email links also require a password. Login codes have expiry, attempt limits and rate limits.
• Access to personal information is restricted to what is needed to operate the service (least privilege).
• We apply industry-standard security headers, protect forms against cross-site request forgery, and rate-limit sensitive actions such as sign-in.
• We keep our platform, dependencies and servers maintained and patched, and review our safeguards against new risks.
• Where a third party processes personal information for us (an “operator”), we require it, under our agreement, to keep that information secure and confidential and to use it only on our instructions, as contemplated by sections 20–21 of POPIA.

No online service can be guaranteed perfectly secure. If a security compromise affecting your personal information occurs, we will notify you and the Information Regulator as soon as reasonably possible, as required by section 22 of POPIA, and tell you what happened and what you can do to protect yourself.

7. How long we keep it

Personal calendar events and recurrence exceptions remain until you permanently delete the archived event or erase your account; archiving preserves them so you can restore them. Reminder delivery receipts are removed after 90 days. Your calendar download excludes personal notes and other users’ contact details; store or share the downloaded file only where you intend to disclose its event titles and times.

Private drafts expire after 30 days. Scheduled maintenance removes their content and account links after expiry, deletes expired email-link challenges after a 24-hour grace period, and removes de-identified journey and milestone records after one year. A completed booking or published listing is stored separately under the retention rules below. Erasing an account also removes its access challenges and personal draft content.

We keep your personal information for as long as your account is active and as needed to provide the service. When you request erasure we delete or de-identify your personal information, except records we are entitled or required to keep — including financial and tax records (such as invoices and transaction records), which we keep for the period required by the South African Revenue Service and applicable legislation, and a limited set of verification, booking and dispute records, which we may keep for a reasonable period to prevent fraud, resolve disputes, and establish, exercise or defend legal claims (for example, a client’s claim against a provider for a missed booking). We keep no more than we reasonably need for these purposes.

8. Your rights under POPIA

As a data subject you have the right to:

• Be told what personal information we hold about you and request access to it;
• Ask us to correct or update information that is inaccurate or out of date;
• Ask us to delete or destroy your information (subject to records we must keep by law);
• Object to processing, and withdraw consent where processing is based on consent;
• Not be subject to a decision based solely on automated processing that significantly affects you; and
• Complain to the Information Regulator.

You can update your details, change preferences, deactivate your account or request erasure from your Account page, or contact our Information Officer at privacy@myquack.co.za.

9. Direct marketing

We currently send only transactional and service messages relating to your account and bookings, and calendar reminders you request. We will not send you electronic marketing without your consent, and every marketing message we ever send will include an easy way to opt out.

10. Cookies

We use session and security cookies to keep you signed in and protect forms against cross-site request forgery. If you dismiss the email-link login reminder, a signed preference cookie remembers that choice for seven days in this browser, for the account you are using. It does not enable email links or change your login credentials. We do not use third-party advertising or cross-site tracking cookies.

11. Children

myquack is intended for people aged 18 and over. We do not knowingly collect personal information from children.

12. Changes to this policy

We may update this policy from time to time. We will change the “Last updated” date above and, for material changes, take reasonable steps to let you know.

13. Contact & complaints

Questions or requests: privacy@myquack.co.za. If you believe we have not handled your personal information lawfully, you may lodge a complaint with:

See also our Terms & Conditions.