Privacy Notice
Development build: this text is a draft and is not for publication.
1. Who we are and what this notice covers
1.1 This notice explains how [PLACEHOLDER: LEGAL ENTITY NAME] ("we") handles personal information when you use the Link2Supply app and website, or when you are named in a supplier's listing. We are the "responsible party" under South Africa's Protection of Personal Information Act 4 of 2013 ("POPIA") and, where it applies to you, the "controller" under the EU General Data Protection Regulation ("GDPR") and the UK GDPR.
1.2 Our details. Registration number [PLACEHOLDER: REGISTRATION NUMBER]. Address [PLACEHOLDER: REGISTERED ADDRESS]. Privacy email [PLACEHOLDER: PRIVACY EMAIL]. Support email [PLACEHOLDER: SUPPORT EMAIL].
1.3 Information Officer. [PLACEHOLDER: INFORMATION OFFICER NAME], [PLACEHOLDER: INFORMATION OFFICER EMAIL]. [PLACEHOLDER: Deputy Information Officer, if any.]
1.4 EU and UK. [PLACEHOLDER: EU representative name and address, and UK representative name and address, if the attorney decides they are needed. Delete this paragraph if the service is not offered in the EU or UK.] We have not appointed a data protection officer. [PLACEHOLDER: confirm.]
1.5 Business information counts. POPIA protects information about companies as well as people. In this notice, "personal information" includes information about a supplier business that can be identified.
1.6 You are told here what we collect, why, who gets it, where it goes, how long we keep it, and what your rights are. Please read it together with the Terms of Use and, for suppliers, the Supplier Agreement.
2. Who we collect information about
- Buyers and other app users who sign up.
- Suppliers (businesses and sole traders) who list on Link2Supply.
- Supplier contact people whose names, email addresses or numbers appear in a listing. You may never have used Link2Supply. See section 9 if you are in this position.
- People who use our website, including the payment, account-deletion and request pages.
- People mentioned in messages, chats, uploaded images or proof-of-payment documents.
3. What we collect, why, and on what basis
"Basis" means our lawful ground under POPIA and, where it applies, GDPR.
3.1 Account and sign-in
| What | Why | Basis | Required? |
|---|---|---|---|
| Email address (may be a private-relay address from Apple); phone number if you sign up by phone | Create and secure your account, send verification codes and service emails | Contract (to provide the service you asked for) | Yes. Without it you cannot create an account |
| Password (stored only as a one-way hash) | Sign you in | Contract | If you use a password |
| Google or Apple sign-in identifier | Link your account to that sign-in. We ask only for your email, and clear any name or picture claims | Contract | Only if you choose that method |
| Display name, company name, country, language | Run your account, show on your enquiries, set language, filter suppliers by country | Contract | Display name and country: yes. Company name: optional |
| Role (buyer, supplier, admin) and account status | Control what you can do | Contract; legitimate interest (security) | Yes |
| Your acceptances (terms, privacy notice, 18+ and business-use declaration, supplier terms, discount undertaking, Edna disclosure), with version and time | Prove what you accepted | Legitimate interest (evidence); legal obligation where it applies | Yes |
| Session records (including IP address and device type kept by our hosting provider), second-factor secret for admins | Keep you signed in and protect your account | Legitimate interest (security) | Yes |
3.2 Using the app
| What | Why | Basis | Required? |
|---|---|---|---|
| Contact reveals. Which buyer revealed which supplier's contact details, when, and the order reference | Limit scraping; show you a reference you can use for the 10% supplier discount; let the supplier check a reference you quote | Legitimate interest (anti-abuse; evidence for the discount) | Yes, to see contacts |
| Order requests and enquiries. Your message, the items, prices, the discount calculated, the order reference, status and replies | Pass your request to the supplier, record the discount | Contract | Yes, to send one |
| What the supplier sees about you. Your display name, company name, country, and (only if you choose on that enquiry) one contact channel: email, phone or WhatsApp. Nothing else from your profile | Let the supplier reply | Contract; your choice | Contact channel optional |
| Sourcing requests. What you ask us to find: the need, quantity, budget, delivery country and town, a date, the status, and our messages to you [DRAFT, pending attorney] | Let our sourcing team look for a supplier and write back | Contract | Yes, to make a request. Passing your contact details to suppliers we match is off unless you turn it on, and then we do it by hand |
| Uploads (logos, catalogue images) | Show on listings | Contract | Optional |
| Rate-limit records (a scrambled version of your IP address, or your account for signed-in limits such as directory reads and Edna, deleted after 48 hours) | Stop abuse | Legitimate interest | Yes |
3.3 Supplier listings
| What | Why | Basis | Required? |
|---|---|---|---|
| Business name, country, city, website, languages, logo, summary, description, categories, catalogue (names, descriptions, prices, images) | Show your listing to everyone, including people without an account | Contract with the supplier | Yes |
| Contact details: contact name (optional), email, phone, WhatsApp, address, postal code | Release to signed-in, verified buyers one at a time, and to let you receive enquiries | Contract with the supplier. For a named contact person: legitimate interest, and the supplier's confirmation | Yes |
| Payment status and dates (when your listing year starts and ends) | Run the listing | Contract | Yes |
3.4 Listing fee payments
| What | Why | Basis | Required? |
|---|---|---|---|
| Payer email, amount, currency, payment reference, status, period | Collect the fee, issue receipts, keep accounts | Contract; legal obligation (tax and accounting) | Yes |
| Proof of payment (PDF or image) for bank transfers. These often show account numbers and names | Confirm the transfer | Contract; legal obligation | Only if you pay by bank transfer |
| Name of the paying business, kept on payment records | Accounting | Legal obligation [PLACEHOLDER: confirm with accountant that it must be kept after deletion] | Yes |
| Card details | We never receive or store them. You type them on our payment provider's page | n/a | n/a |
3.5 Edna, our AI assistant
| What | Why | Basis | Required? |
|---|---|---|---|
| What you type to Edna, Edna's replies, the suppliers it suggested, which model answered, usage counts | Give you answers; control cost; review reported answers | Your consent (you agree before your first message) and contract | Optional |
| Country and language (sent with your message) | Give relevant answers | Same | Same |
3.6 Our website
| What | Why | Basis |
|---|---|---|
| IP address, browser type and the page requested, in our host's server logs | Run and protect the site | Legitimate interest |
| Email address and the details you type in a deletion or data-request form, and a code we send to confirm it is you | Handle your request | Legal obligation; legitimate interest |
| Bot-check signals (IP address and browser signals) | Stop automated abuse | Legitimate interest |
3.7 What we do not collect
We do not collect ID numbers, dates of birth, health data, your location, your contacts, your photo library (except the files you choose to upload), card numbers, or advertising identifiers. We do not use advertising or analytics trackers. We do not sell personal information. We do not send marketing messages in this version. If we add marketing, we will ask for your separate consent first.
3.8 Information you put in free text
Enquiries, replies, Edna chats and uploads can contain anything you type. Please do not put in sensitive details (health, ID numbers, bank details, passwords). We do not need them.
4. Where we get information
Mostly from you. Other sources: the supplier (for contact people and for your enquiry replies); our staff (when we add a supplier for you); your sign-in provider (Google or Apple); our payment provider (confirmation of payment).
5. Who we share information with
5.1 Other users
- Buyers see a supplier's public listing and, after a reveal, its contact details.
- Suppliers see only the buyer details listed in section 3.2, and only what you send. Suppliers are separate responsible parties for what they receive. They may be in any country.
- We do not tell a supplier that you looked at its contact details. If you quote your order reference to a supplier, the supplier can check that the reference is valid and see its date and type. The supplier does not see who you are from that check.
5.2 Service providers who process information for us ("operators" or "processors")
We have or will have a written agreement with each, requiring them to keep information secure and use it only for us. [PLACEHOLDER: confirm each agreement is signed and each provider and location below is correct before publication.]
| Provider | What for | What they get | Where [PLACEHOLDER: confirm each] |
|---|---|---|---|
| Supabase | Database, sign-in, file storage, server functions | Everything in the app, including account data, listings, enquiries, Edna chats and uploads | [PLACEHOLDER: hosting region chosen at set-up] |
| Anthropic | The AI model behind Edna | Your Edna message, up to the last 12 messages of that chat, your country and language, and public supplier listing text. No name, email, phone or account ID | United States [PLACEHOLDER: confirm from Anthropic's current terms] |
| Twilio (Verify) | Text-message codes (only if you sign up by phone) | Your phone number and the code status | United States, plus mobile carriers |
| [PLACEHOLDER: email provider, e.g. Resend or Postmark] | Verification codes, receipts, reminders, notices | Email address and message content | [PLACEHOLDER] |
| Cloudflare (Turnstile bot check and, if used, site hosting) or hCaptcha | Stop bots; host the website | IP address and browser signals | [PLACEHOLDER: confirm product chosen] |
| Google and Apple | Sign-in, if you choose it | Sign-in details | United States and elsewhere |
5.3 Payment provider
For card payments, [PLACEHOLDER: Paystack, confirm legal entity] collects your card details on its own page. It is responsible for its own handling of those details and gives us the result, amount and a payer email. Read its privacy notice at [PLACEHOLDER: link].
5.4 Others
Our professional advisers, auditors and insurers, under confidentiality; and public authorities, courts or regulators where the law requires or allows. If our business is sold or merged, information may pass to the new owner, who must follow this notice.
6. Sending information to other countries
6.1 We are in South Africa. Our providers process information in other countries, including the United States and [PLACEHOLDER: hosting region]. Buyers and suppliers can be in any country.
6.2 POPIA allows this where the recipient is bound by law, a binding agreement or binding corporate rules that give protection similar to POPIA, where it is necessary for a contract with you or at your request, or where you consent. We rely on:
- Operators: agreements with each provider that require POPIA-level protection [PLACEHOLDER: confirm].
- Buyers and suppliers abroad: the transfer is necessary because you asked to contact or order from that supplier or because you listed to be contacted. We tell you at the point of action.
6.3 EU and UK users. Where GDPR or UK GDPR applies, we use [PLACEHOLDER: attorney to select: the EU Standard Contractual Clauses and the UK addendum or International Data Transfer Agreement, or another mechanism] for transfers of your information to us in South Africa and onward to our providers. Ask us at [PLACEHOLDER: PRIVACY EMAIL] for a copy of the safeguards.
7. Edna and your information
7.1 Edna is an AI assistant run through a third-party AI provider (Anthropic). Before your first message we show you a disclosure and ask for your agreement.
7.2 What is sent: your message, the recent messages in the chat, your country and language, and public supplier listing text that Edna looks up. Not sent: your name, email, phone, account ID or supplier contact details.
7.3 How long we keep chats: 90 days, then deleted. A chat you report is kept for 90 days from the report, then deleted. You can delete a chat at any time, and withdrawing your agreement in Settings deletes all your chats.
7.4 What Anthropic keeps. [PLACEHOLDER: Do not publish until the privacy specialist has read Anthropic's current commercial terms and data processing terms and fills in: how long Anthropic keeps inputs and outputs, whether it uses them to train models, and where it processes them.] Deleting your chat at Link2Supply does not delete any copy Anthropic holds under its own retention rules.
7.5 Not decisions about you. Edna suggests suppliers. It does not make decisions about you with legal or similar effect.
8. How long we keep information
These are the periods we use. [PLACEHOLDER: owner and attorney to confirm each; they are proposals in our design.] After the period the information is deleted, or the identifying part removed.
| Information | How long we keep it |
|---|---|
| Accounts never verified | 30 days after sign-up |
| Account, profile and sign-in details | While your account exists; deleted when you delete it (see section 11) |
| Your acceptances (terms, privacy, declarations, Edna) | While your account exists, then a minimum record (type, version, date) for 3 years |
| Account-deletion requests and the record that we deleted | 3 years after completion |
| Data requests (correction, objection, removal, access) | 3 years after closing |
| Supplier drafts never paid for | We warn you at 11 months and delete at 12 months |
| Lapsed listings | We warn you 11 months after the listing lapsed and delete at 12 months |
| Supplier profile, contacts, catalogue and public images | While the supplier exists |
| Uploads waiting to be processed | Until processed; leftovers deleted after 24 hours |
| Order requests and enquiries | 3 years from the last status change |
| Sourcing requests [DRAFT, pending attorney] | 2 years after the request is closed; then the text, town, messages and notes are removed and only the reference, category, country and dates stay |
| Contact-reveal records | 12 months |
| Payment records, payment events and receipts | [PLACEHOLDER: 5 to 7 years, to be fixed with the accountant] |
| Proof-of-payment files | Same as the payment. Proofs of rejected payments: 90 days after rejection |
| Payment links | 30 days after use or expiry |
| Renewal-reminder records | 24 months |
| Notification queue records | 30 days |
| Edna chats | 90 days (a reported answer: 90 days from the report) |
| Edna usage counts per person | 13 months, then added into daily totals with no user ID |
| Audit log of staff and money actions (no personal fields, scrambled IP keys destroyed monthly) | 12 months; entries about payments for the same period as payment records |
| Rate-limit records | 48 hours |
| Hosting and server logs | As long as the provider keeps them [PLACEHOLDER: confirm, plan-dependent] |
| Backups | Until they age out of the provider's backup window [PLACEHOLDER: state the window once confirmed]. We cannot remove one person from a backup. If a backup is restored, we delete again anyone who had already been deleted. |
9. If you are named in a supplier's listing, or we added a supplier
9.1 A supplier (or our staff, at a supplier's request) may have put your name, email, phone number or address in a listing. We published it because the supplier asked us to list it. If we added the listing, we emailed the contact address at the time.
9.2 You can ask us to correct it, remove your personal details, or object, without having an account. Use the "Report this listing or remove my details" link on the listing, the form on our website, or email [PLACEHOLDER: PRIVACY EMAIL]. We will replace your details with the business's general contact details where it has them, or hide the listing if there are none.
10. Your rights
10.1 You may ask us:
- to confirm whether we hold information about you and to give you a copy (access);
- to correct or delete information that is wrong, out of date, incomplete or misleading, or that we should no longer hold (correction and deletion);
- to stop using it for a purpose based on our legitimate interest (objection);
- under GDPR or UK GDPR also: to restrict use, to take your data in a portable form, to withdraw consent at any time (this does not affect past use), and not to be subject to certain automated decisions;
- to withdraw your Edna agreement at any time in Settings.
10.2 How to ask.
- In the app: Settings. You can download your data (one request per day), edit your profile, delete your account, and switch off Edna.
- By email: [PLACEHOLDER: PRIVACY EMAIL].
- On our website: the account-deletion and data-request form [PLACEHOLDER: SITE URL]/[PLACEHOLDER: path]. We confirm it is you with a code sent to the email address on your account. The form does not work for an account that has no email address (you signed up by phone only): delete that account in the app (Settings), or email us at [PLACEHOLDER: PRIVACY EMAIL].
- We will answer within [PLACEHOLDER: for example 30 days]. We may need to check your identity. We do not charge for ordinary requests. [PLACEHOLDER: attorney to confirm fee wording under POPIA/PAIA.]
10.3 If you are unhappy. Please tell us first. You may complain to:
- South Africa: the Information Regulator. [PLACEHOLDER: add current contact details from inforegulator.org.za at publication.]
- EU or UK users: the data protection authority where you live or work, or in the UK, the Information Commissioner's Office. [PLACEHOLDER: add links.]
10.4 Access to records. Our manual under the Promotion of Access to Information Act 2 of 2000 is at [PLACEHOLDER: PAIA manual link].
11. Deleting your account
11.1 How. In the app: Settings, Delete account, sign in again. Or on our website using the deletion form.
11.2 What happens straight away. Your sessions are removed. [PLANNED, NOT YET BUILT: for Sign in with Apple users, we will revoke the Apple token. Until that is built, remove the app under your Apple ID settings, Sign in with Apple.] Your supplier listing is hidden. We email you the date deletion will finish.
11.3 7-day waiting period. Deletion finishes after 7 days. To cancel, sign in with your account's own credentials in that time. We cannot cancel for you by phone or email alone, to protect you from someone taking over your account.
11.4 What we delete. Your account (email, phone, password hash, sign-in links, sessions, second factors), profile, supplier listing, contacts, catalogue and public images (we also ask our content network to clear them), Edna chats and usage rows, contact-reveal records you made, rate-limit records, payment links, reminder records, and data requests you made.
11.5 What others keep, scrubbed. On enquiries and orders you sent or received, the other person keeps their record of the reference, status, items, amounts and discount. We remove your name, company name, shared contact details and the free-text messages from their copy, and show "Deleted user" or "Deleted supplier".
11.5A Sourcing requests. [DRAFT, pending attorney] We remove the text, town, our messages and our internal notes from your sourcing requests when you delete your account, and cancel any that are still open. The reference, category, country and dates stay, with no link to you, so we can see what buyers ask for.
11.6 What we must keep, and why.
- Payment records, receipts and proofs of payment for the period in section 8, as tax and accounting records. Your account identifier is replaced by a random reference. After deletion only authorised staff can open a proof, with a recorded reason, and every access is logged. [PLACEHOLDER: add the sentence about the payer's business name staying on retained records only if the accountant confirms.]
- A minimum record of what you accepted and that we deleted your data, with no identifying details, for 3 years.
- Audit-log entries, which hold no personal fields.
11.7 Delay. If one of your payments is under review, we pause deletion and tell you. A staff member must settle the payment within 14 days. After that, deletion continues and the payment is closed as rejected.
11.8 Other companies. We ask our providers to delete the data they hold for us and record the result. Some cannot be deleted, such as records a payment provider must keep, or text already sent to our AI provider (see section 7.4). Backups are covered in section 8.
11.9 Last admin. A staff administrator cannot delete their own account if they are the last administrator.
12. How we protect information
We use reasonable technical and organisational measures. They include encrypted connections (TLS); access controls so that each user sees only what they should; staff access that needs a second factor and is logged; contact details kept apart from public listing data and released one at a time with limits; no card data held by us; and notifications that carry no personal detail. [PLACEHOLDER: add "encrypted at rest" only after the hosting provider's current terms are confirmed.] If personal information is compromised and the law requires it, we will tell the Information Regulator and the people affected, and, for GDPR or UK GDPR cases, the relevant authority.
13. Cookies and similar technologies
The app does not use cookies. Our website does not use advertising or analytics cookies. See the Cookie and Site Notice.
14. Children
Link2Supply is for people aged 18 and over, using it for business. We do not knowingly collect information about children. If you think a child has an account, tell us at [PLACEHOLDER: PRIVACY EMAIL] and we will delete it.
15. Changes to this notice
We will post the new version with its date. For a material change we will tell you in the app or by email at least [PLACEHOLDER: for example 30 days] before it applies, and where the law requires it we will ask you to accept it again.
16. Contact
Privacy: [PLACEHOLDER: PRIVACY EMAIL]. Information Officer: [PLACEHOLDER: INFORMATION OFFICER NAME], [PLACEHOLDER: INFORMATION OFFICER EMAIL]. Post: [PLACEHOLDER: REGISTERED ADDRESS].
_Corrected 13 Nov 2026 against the code (docs/PRIVACY_REVIEW.md N2, N4): removed crash reports and Sentry, Expo push and app updates, Google and Apple push, push tokens, device-attestation records, and the phone-only text-message route for web deletion, because none of them exists in the app. The Apple token revocation is marked as planned. Re-add each one, with its retention row, in the same change that builds it._