Privacy policy

1. Introduction

Buildbuggy is a trading name of Ari Ventures (Pty) Ltd (registration number 2026/560629/07) ("we", "us", or "our"), a marketplace platform that connects clients with tradespeople and service professionals in South Africa. We are the "responsible party" as defined in the Protection of Personal Information Act, 2013 (POPIA), and we are committed to protecting your personal information in accordance with POPIA and other applicable South African privacy laws.

This privacy policy explains what personal information we collect, why we collect it, how we use it, who we share it with, how long we keep it, how we secure it, and the rights you have over your data. It applies to all users of the Buildbuggy platform, including clients, builders, and visitors.

Responsible party details:

• Entity: Ari Ventures (Pty) Ltd, trading as "Buildbuggy"
• Company registration number: 2026/560629/07
• Email: privacy@buildbuggy.co.za
• Information Officer: Contactable at privacy@buildbuggy.co.za

By creating an account or using our platform, you acknowledge that you have read and understood this privacy policy.

2. Information we collect

Information you provide directly (voluntary):

Supplying the information below is voluntary. However, certain information is required to use core platform features — if you do not provide it, you will not be able to create an account, list services, make bookings, or process payments.

• Account information: Name, email address, phone number, a bcrypt password hash and role (client or professional). We also record the Terms and Privacy Policy versions acknowledged and when that acknowledgement occurred.
• Profile information (builders): Headline, bio, location, categories, callout fee, profile photo, and portfolio images. This information is reviewed by our admin team before being published.
• Service listings: Service titles, descriptions, pricing, categories, and images.
• Booking information: Job details, agreed prices, scheduled dates, and notes.
• Messages: Text content and images sent between users through our in-platform messaging system.
• Reviews: Ratings, comments, and responses you leave about other users.
• Payment information: Paystack processes card details and payment authorisations. Buildbuggy records payment references, amounts, statuses and relevant provider responses; it does not store full card numbers. Professional payout bank details are stored separately in encrypted form and used for payout administration.
• Banking and verification details (professionals): Optional identity and qualification evidence is used for requested verification checks. Banking details are optional at onboarding but required before a payout can be processed. We record the checks completed and do not make uncompleted checks appear as verified.
• Dispute information: Reasons, descriptions, and evidence submitted during dispute resolution.
• Quote requests: Title, description, category, budget range, location, and deadline for quote requests submitted by clients.

Information collected automatically:

• Usage data: Pages visited, time spent, clicks, and navigation paths, collected through cookies and analytics tools (only with your consent for non-essential cookies).
• Device information: Browser type, operating system, screen resolution, and approximate location (city/region level, not precise GPS).
• Authentication data: Secure httpOnly cookies used to keep you logged in and verify your identity. These are never accessible to JavaScript and are not stored in local storage.
• IP address: Collected for security, fraud prevention, and rate limiting purposes.

Information from third parties:

• Google OAuth: If you choose to sign in with Google, Google shares your name, email address, and profile photo with us. Google's privacy policy governs data collected by Google.
• Paystack: Provides us with transaction status, payment references, and card type/last four digits for payment reconciliation. Paystack does not share your full card number with us.

3. How we use your information

We process your personal information for the following specific purposes:

• To create and manage your account, authenticate your identity, and verify your email address.
• To display approved Buildbuggy profiles, services, and portfolios to potential clients on the platform.
• To facilitate bookings, callout requests, messaging, payments, protected payment management, and reviews between users.
• To process payments through Paystack and manage held funds securely.
• To send you notifications about bookings, messages, reviews, and account activity.
• To send service emails such as booking confirmations, payment receipts, review invitations, and password reset links.
• To monitor and prevent fraud, abuse, and prohibited conduct on the platform.
• To resolve disputes between users and administer payment releases.
• To analyze usage patterns and improve our services (only with your consent for analytics cookies).
• To comply with legal obligations and respond to lawful requests from South African authorities.
• To process Buildbuggy payouts to verified bank accounts.
• To send review invitations and reminders for completed bookings.
• To retain the original job request and quote terms in participant records and authorised admin records, and to show role-appropriate payment information.
• To show permitted client reputation information to signed-in professionals considering work, subject to the prospective audience rules in section 7.
• To record separately when each booking participant has seen their active-project welcome, so the first-visit animation and sign-in direction do not repeat unnecessarily across devices.

We do not process your personal information for any purpose incompatible with the purposes for which it was originally collected.

4. Legal basis for processing

Under POPIA, we process your personal information on the following grounds:

• Consent and acknowledgement: We record your acknowledgement of this policy and acceptance of the Terms; acknowledgement is not a blanket waiver of privacy rights or the sole basis for all processing. Where consent is the applicable legal basis, it must be specific and can be withdrawn as provided by law. Non-essential analytics has a separate cookie choice.
• Contract: Processing is necessary to provide the marketplace services you requested.
• Legitimate interests: Where lawful and proportionate, processing supports fraud prevention, platform integrity and informed decisions about engagements. We consider the rights and interests of the people affected. You may object where POPIA provides that right.
• Legal obligation: We may process data to comply with South African law, including financial record-keeping and law enforcement requests.

5. Cookies and analytics

We use two categories of cookies:

Essential cookies (no consent required):

• Authentication cookies: Keep you logged in securely. These are httpOnly, secure, and SameSite=Lax, meaning they cannot be accessed by JavaScript and are only sent in first-party or safe cross-site requests.
• Security cookies: Protect against CSRF and other attacks.

Non-essential cookies (require your consent):

• Analytics cookies: We use PostHog to collect anonymous usage data including page views, session duration, click events, and conversion funnels. This helps us understand how users interact with the platform and improve the experience. PostHog is hosted in the EU.

You can accept or decline non-essential cookies using the cookie banner displayed on your first visit. You can change your preference at any time by clearing your browser storage and revisiting the site. If you decline, we will not track your usage for analytics purposes.

POPIA does not have cookie-specific provisions, but where cookies collect personal information, the openness duty applies. We disclose all cookie usage in this policy and obtain consent for non-essential tracking.

6. Third-party services and data sharing

We share limited data with the following third-party service providers ("operators" as defined in POPIA section 21) to operate the platform. We have written agreements in place with each operator ensuring they maintain appropriate security and confidentiality standards:

• Paystack (Nigeria/Global): Processes payments and manages held funds. Receives payment method details and transaction amounts. Paystack is PCI-DSS compliant. Paystack processes data under its own privacy policy and security standards.
• Supabase (USA/EU): Hosts our PostgreSQL database and stores uploaded images (profile photos, portfolios, message images) in secure, access-controlled storage buckets. Storage buckets are configured as private — files are only accessible via signed URLs with expiration, not publicly readable. Database connections are SSL-encrypted.
• Resend (USA/EU): Sends transactional emails (booking confirmations, notifications, password resets, email verification links). Receives your email address, name, and email content.
• PostHog (EU): Product analytics platform. Receives anonymous usage data (page views, events) only if you consent to analytics cookies. PostHog does not receive your password, payment details, or banking information.
• Google OAuth (Global): If you choose to sign in with Google, Google shares your name, email address, and profile photo with us. Google's privacy policy applies to data collected by Google. We do not share your Buildbuggy data back to Google.
• Cloudflare (Global): Provides CDN, DDoS protection, and Web Application Firewall services. Receives IP addresses and request metadata for security purposes.

We do not sell your personal information to any third party. We do not share your personal information with third parties for their own marketing purposes.

We may disclose your personal information to law enforcement or government authorities if required by South African law or court order.

7. Profile and portfolio visibility

Approved Buildbuggy profiles, service details, profile photos, and previous-work portfolios are displayed publicly on the platform. Draft, rejected, and pending-review profiles remain hidden until approved by our admin team.

Search engine visibility:

Approved professional profiles are published on publicly accessible pages. These pages may be found, crawled, and indexed by search engines such as Google and Bing, and may appear in search results, including in search engines' AI-generated summaries. Information that may appear includes your name, trade, city, headline, profile photo, portfolio images, ratings, and reviews.

We only publish a professional profile to search engines where the professional has given consent during onboarding. You may withdraw that consent at any time by contacting us. When you opt out, your profile is marked "no index", removed from our sitemaps, and search engines are instructed to remove it. Your profile remains visible to clients browsing the platform. Removal from search results is not instant — it depends on how quickly each search engine re-crawls the page.

Artificial intelligence systems:

We instruct AI crawlers — including those operated by OpenAI, Anthropic, Perplexity, Google, and Apple — not to access professional profile pages, and we ask search engines not to quote profile content in AI-generated summaries. These instructions rely on voluntary industry standards (robots.txt and snippet directives). Well-behaved operators honour them, but we cannot guarantee compliance by every operator, and search engines may still summarise pages that appear in their normal search index. If you do not want your profile accessible to search engines or AI systems at all, opt out of search visibility as described above.

Reviews:

Reviews are tied to completed bookings and initially remain blind. They become eligible for publication when both parties have submitted or the displayed review window closes, subject to moderation and dispute rules. Hidden, removed and unpublished counterpart review content is not part of reputation browsing.

Published reviews about professionals can appear on publicly accessible professional profiles and may be indexed by search engines. Published reviews about clients are not offered on an anonymous public client profile: access is restricted to signed-in professionals and authorised administrators.

Wider professional access follows the review-audience rules introduced on 23 October 2026 and retained in this release. It applies only where the client acknowledged a policy containing those rules before the review was submitted. A review recorded under the earlier audience rules retains those rules, including where it is published later. Later policy acknowledgement does not widen the audience of an earlier review. Under the earlier rules, access depends on an eligible live engagement or job opportunity with that client.

The professional-facing reputation view can show a limited display name, membership information, ratings, review text, permitted replies, criterion scores and basic job context. It does not disclose private addresses, contact details, payment instruments or private job descriptions. Where a viewer can see only new-audience reviews, ratings and counts relate to that visible set rather than an undisclosed full history.

Clients cannot selectively hide an unfavourable published review. This does not remove reporting and reply mechanisms or POPIA rights to request access, correction, deletion or to object to processing. We assess such requests and moderation reports on their merits. Reviews are user-authored opinions; publication is not a guarantee of accuracy or future conduct. Do not include private contact details or sensitive personal information in reviews, descriptions, photos or messages.

Job ads:

Job ads posted by clients are shown to registered professionals on our job board. We instruct search engines not to index individual job ads, so the details of your job — including its description and location — are not intended to appear in public search results.

Booking and payment records:

The original request, quote terms, scope and booking details remain available to the relevant participants and authorised administrators for managing work, support, disputes and records. Exact street addresses are restricted and are shared with the selected professional after payment-confirmed booking, rather than with competing quote authors. Free-text descriptions or photos may reveal information you include yourself.

Professionals see the agreed job price and their applicable fee and estimated payout, not the client's added platform fee or gross payment total. Clients can see their own charges, and authorised administrators can access financial records needed for platform administration. These presentation rules do not hide required financial records from regulators or override lawful disclosure obligations.

Disputes and resolution notices:

The original reason and description submitted through the dispute form are restricted in the platform to the submitter and authorised administrators handling the case. The counterparty is notified that a dispute was raised and that fund release is paused, without receiving that original reason or description. This restriction also applies when older counterparty dispute notifications are displayed; the underlying records may be retained for the purposes in section 9.

A resolution explanation may be shared with both parties. Clients receive their own refund amounts and statuses; professionals receive their own awards, fees, net payouts and release statuses, not the client's refund amount or gross charge. Administrators can access the financial and case records necessary to administer and reconcile the resolution. Internal administrator notes are not included in participant resolution notices.

This is not a promise of absolute confidentiality. Messages, photos or other information you send directly to another user remain available to that recipient. Authorised service providers may process information needed for storage, transactional email or payments as described in section 6, and lawful disclosure or access requirements may apply. Original dispute reasons and descriptions are not included in the dispute-raised analytics event. Contact privacy@buildbuggy.co.za with questions about access, correction or disclosure of dispute information.

8. Data storage and security

Your data is stored in the following locations:

• Database: Managed PostgreSQL database hosted on Supabase with SSL-encrypted connections. Database access is restricted to authenticated application connections only.
• File storage: Supabase-managed storage with private, access-controlled buckets. Files are not publicly listable or readable. Access is granted only via time-limited signed URLs that expire automatically.
• Email delivery: Resend's infrastructure (EU/US servers).
• Analytics: PostHog's infrastructure (EU servers, if consent given).
• CDN and security: Cloudflare's global edge network.

Security measures we implement (section 19 of POPIA):

• Passwords are hashed using bcrypt with 12 rounds (never stored in plain text or reversible encryption).
• All API traffic is encrypted via HTTPS/TLS.
• Authentication tokens are stored exclusively in httpOnly, secure, SameSite=Lax cookies — never in local storage or accessible to JavaScript.
• Input sanitization and server-side validation on all form submissions.
• Rate limiting on API endpoints to prevent automated attacks.
• Security headers including Content Security Policy, HSTS, and XSS protection.
• Web Application Firewall and DDoS protection via Cloudflare.
• Role-based access control (RBAC) for admin panel and sensitive operations.
• Email verification required before performing sensitive actions (booking, payments, listing creation).
• Webhook signature verification for Paystack payment webhooks.
• Environment variables and API keys stored server-side only, never exposed to the frontend.
• CORS configured to allow only authorized origins.
• Production error messages do not expose stack traces or internal system details.

9. Data retention

We retain information for the purposes described in this policy, including operating accounts, preserving job and payment evidence, addressing disputes, preventing abuse and meeting applicable record-keeping obligations. The necessary period depends on the record and legal context; a pending dispute, legal claim or financial obligation may require longer retention.

The account-removal option in Settings currently deactivates the account. It does not automatically erase all profile, contact, booking, payment, message, review or audit information, anonymise reviews immediately, or guarantee deletion of messages after 90 days. Records can remain in our systems after deactivation. Account deactivation must not be mistaken for a completed POPIA erasure request.

Contact privacy@buildbuggy.co.za to request erasure, correction, restriction where applicable, or to object to processing. We will assess the request, explain any lawful retention or refusal and take the action required by law. We do not retain information merely to prevent a person exercising their rights or to punish an unfavourable review.

Authentication and recovery tokens have expiry times appropriate to the account role and security operation. Token expiry is not a promise that unrelated account or transactional records have been erased.

10. Your rights under POPIA

You have the following rights regarding your personal information, as set out in sections 23 to 25 of POPIA:

• Access: Request confirmation of whether we hold personal information about you and request access to it, subject to applicable law.
• Correction: Request that we correct inaccurate, incomplete, or outdated information (section 24).
• Deletion and correction: Request correction or deletion of information as provided by POPIA. The Settings account-removal option deactivates the account and is not by itself an erasure request; contact privacy@buildbuggy.co.za for assessment of retained information.
• Objection: Object to the processing of your information for specific purposes (section 11).
• Withdrawal of consent: Withdraw consent for analytics tracking at any time, without detriment (section 11).
• Complaint: Lodge a complaint with the Information Regulator if you believe your rights have been violated (section 74).
• Automated decision-making: The right not to be subject to a decision based solely on automated processing that produces legal or significant effects on you (section 71).

To exercise your rights, use the available Settings export/update options or contact the Information Officer using section 16. We may need proportionate identity verification to protect your information and will respond within the time required by applicable law. A policy acknowledgement does not waive these rights.

11. Use of artificial intelligence

Buildbuggy may use artificial intelligence (AI) and automated processing technologies in the following limited ways:

• Profile review assistance: AI tools may assist our admin team in reviewing Buildbuggy profile submissions, flagging potentially incomplete or non-compliant content. A human reviewer always makes the final decision.
• Fraud detection: Automated systems may analyse patterns in booking, payment, and messaging data to flag potentially fraudulent activity for human review.
• Analytics and insights: PostHog may use automated processing to generate aggregate usage insights. This data is anonymized and does not identify individual users.

In accordance with section 71 of POPIA, we do not make decisions that produce legal or significant effects on you based solely on automated processing. All decisions that materially affect you — such as profile approval, dispute resolution, or account suspension — involve human review and oversight.

We do not use your personal information to train AI models. We do not share your personal information with third-party AI services for model training purposes.

If you have questions about our use of AI, contact us at privacy@buildbuggy.co.za.

12. Cross-border data transfers

Some of our third-party service providers process data outside South Africa. In accordance with section 72 of POPIA, we ensure that cross-border transfers of your personal information are subject to adequate protection:

• Supabase (USA/EU): Hosts our database and file storage. Data is protected by Supabase's security certifications and our operator agreement.
• Resend (USA/EU): Processes email delivery. Receives only email addresses, names, and email content.
• PostHog (EU): Processes analytics data (only with consent). Receives anonymous usage data only.
• Paystack (Nigeria/Global): Processes payment data under PCI-DSS compliance.
• Google (Global): Processes OAuth authentication data under Google's privacy framework.
• Cloudflare (Global): Processes IP addresses and request metadata for security.

We rely on the following lawful bases for cross-border transfers under section 72: (a) the third party is subject to laws, binding corporate rules, or binding agreements that provide an adequate level of protection; (b) the transfer is necessary for the performance of a contract between you and us; and/or (c) you have consented to the transfer.

13. Data breach notification

In the event of a security compromise or data breach as defined in section 22 of POPIA, we will:

• Take immediate steps to contain the breach and secure affected systems.
• Conduct an assessment of the breach's scope and impact.
• Notify the Information Regulator as required, within a reasonable period.
• Notify affected data subjects in writing if the breach is likely to adversely affect their personal information, unless we are exempt under section 22(3).
• Provide affected users with guidance on steps they can take to protect themselves.

If you believe your data has been compromised, please contact us immediately at privacy@buildbuggy.co.za.

14. Children's privacy

You must be 18 years or older to use Buildbuggy. We do not knowingly collect personal information from anyone under 18. If you believe we have collected information from a minor, please contact us and we will delete it immediately.

15. Changes to this privacy policy

We may update this policy to reflect changes in processing, law or operations. We identify the current version and date and provide notice of material changes through the platform and, where appropriate, other available channels. New marketplace actions may require acknowledgement of the current policy. We retain the version and timestamp acknowledged.

This release does not retrospectively make legacy client reviews available to unrelated professionals. The audience marker recorded when a new review is submitted governs wider access after publication. We will not treat a later acknowledgement as permission to widen an earlier review's audience.

16. Contact and complaints

For privacy questions, data requests, to exercise your rights under POPIA, or to contact our Information Officer:

• Email: privacy@buildbuggy.co.za
• Information Officer: Contactable at privacy@buildbuggy.co.za
• General support: support@buildbuggy.co.za

If you are not satisfied with our response, you may lodge a complaint with the South African Information Regulator:

• Website: www.informationregulator.org.za
• Email: complaints@informationregulator.org.za

You also have the right to institute civil proceedings regarding an alleged interference with your personal information in terms of section 99 of POPIA.