Privacy & Your Data
iKofi respects your privacy. This guide explains what data we collect, how we use it, and your rights under South Africa's Protection of Personal Information Act (POPIA).
What We Collect
Account Information
When you create an account (creator, supporter, or advertiser):
- Name
- Email address
- Password (stored securely — we never see it)
- Role (creator, supporter, or advertiser)
Profile Information
When you set up your profile:
- Creators: Handle, bio, intro, category, location, avatar, social links, gallery images
- Supporters: Display name, avatar, bio, social links, gallery images
- Advertisers: Handle, business name, category, location, contact details, opening hours, social links, gallery images
Payment Information
- Paystack subaccount code (for creators)
- Bank account details (stored by Paystack — we don't see them)
- Transaction records (amounts, dates, supporter names)
Usage Data
- Page views
- IP address
- Browser type
- Pages visited
- Time spent on pages
How We Use Your Data
To Provide the Service
- Create and display your public profile
- Process payments through Paystack
- Send you notifications about tips received
- Display your page in search results and directories
To Improve the Service
- Understand how people use iKofi
- Identify and fix bugs
- Improve page performance
- Develop new features
To Communicate With You
- Send account-related emails (tip notifications, password resets)
- Respond to support requests
- Send optional marketing emails (you can unsubscribe)
To Ensure Security
- Detect and prevent fraud
- Enforce our Terms of Service
- Protect against abuse
Who We Share With
Paystack
We share payment information with Paystack to process transactions. Paystack has their own privacy policy governing how they handle your data.
Search Engines
Public profiles are indexed by search engines (Google, Bing, etc.). This means your public profile may appear in search results.
We Don't Sell Your Data
iKofi never sells, rents, or trades your personal information to third parties.
Your Rights Under POPIA
South Africa's Protection of Personal Information Act (POPIA) gives you these rights:
Right to Access
You can request a copy of all personal information we hold about you.
Right to Correction
You can ask us to correct any inaccurate information.
Right to Deletion
You can ask us to delete your personal information. We'll comply unless we're legally required to retain it.
Right to Object
You can object to how we use your information.
Right to Complain
If you believe we've violated your privacy rights, you can complain to the Information Regulator.
How to Exercise Your Rights
To access, correct, or delete your data:
- Self-service — Update your profile from your dashboard
- Email us — Contact issues@ikofi.co.za with your request
- Response time — We'll respond within 30 days
Data Security
We protect your data with:
- Encrypted passwords (bcrypt)
- HTTPS encryption (in production)
- CSRF protection on all forms
- SQL injection prevention (prepared statements)
- XSS prevention (output escaping)
- Rate limiting on sensitive endpoints
- Regular security audits
Data Retention
| Data | Retention |
|---|---|
| Account information | Until you delete your account |
| Profile information | Until you delete your account |
| Transaction records | 5 years (legal requirement) |
| Page view logs | 90 days |
| Support tickets | 2 years |
Cookies
iKofi uses minimal cookies:
- Session cookie — Keeps you logged in
- CSRF token — Protects against cross-site request forgery
We don't use tracking cookies or third-party analytics.
Children's Privacy
iKofi is not intended for users under 18. We don't knowingly collect information from children.
Changes to This Policy
We may update this policy from time to time. The latest version will always be available at ikofi.co.za/legal/privacy.
Contact Us
For privacy-related questions:
- Email: issues@ikofi.co.za
- Information Officer: The Managing Director, beachy Creative (Pty) Ltd
- Physical: East London, Eastern Cape, South Africa
Information Regulator
If you believe we've violated your privacy rights:
- Website: inforegulator.org.za
- Email: complaints.IR@justice.gov.za
- Phone: 010 023 5207
Full Privacy Policy
For the complete legal document, see Privacy Policy.