Kostra — Privacy Policy

[Company (Pty) Ltd] ("Kostra", "we", "us") is the responsible party for the personal information processed through kostra.co.za and our mobile web application (the "Service"). We process personal information lawfully in accordance with the Protection of Personal Information Act, 2013 ("POPIA").

By using the Service, you consent to the collection, use, and disclosure of your personal information as described here. This Policy forms part of our Terms of Use.

1. Who we are

Responsible party: [Company (Pty) Ltd], registration number [reg no], of [registered address]. Information Officer: [name], support@kostra.co.za.

2. Personal information we collect

• Identity: your legal name (and, for security officers, SA ID number).
• PSIRA registration: your PSIRA security-officer number and grade (officers); company name and PSIRA business / in-house registration number (businesses).
• Contact details: email address and mobile number.
• Location: for officers, a base location you provide (entered as an address or suburb and stored as approximate coordinates) and the travel radius you are willing to work within; for businesses, the areas you operate in and the post location you search from. Exact addresses are never shown to other users — only suburb and approximate distance are surfaced.
• Availability data you enter: the areas, dates/days, and times you publish as available, and your live/paused/"available now" status.
• Account and status: verification status, tier (Free or Pro) and subscription status.
• Payment information (Pro only): card payments are processed by PayFast (Payfast (Pty) Ltd) on their secure pages — we never see or store your card number. We hold only a PayFast subscription reference and your subscription status.
• Verification records: the outcome of checking your PSIRA details against PSIRA's records — whether a match/registered status was found and the date of the check.
• Contact / audit records: a record that a contact occurred (which business contacted which officer, when, and the officer's verified status at the time), for safety and abuse-prevention. We do not record WhatsApp message content.
• Technical and usage data: device and session information, login activity, and basic analytics events (for example that a search or a contact occurred).

3. How and why we use your information

To create and manage your account; verify your PSIRA registration (with manual review); operate location- and availability-based search; enable a business to contact an officer to arrange relief cover; manage Free/Pro tiers and process Pro subscription payments; send service and transactional emails; provide support; and protect the Service and its users against misuse, fraud, and abuse.

Lawful basis (POPIA): your consent, the performance of our contract with you (the Terms), our legitimate interests in operating and securing a verified network of registered security providers, and compliance with our legal obligations.

4. What other users can — and cannot — see

4.1 Never shown to other users: your exact home/base address, your phone number, your email, your SA ID number.

4.2 In search, a verified business sees only an available officer's display name, grade, verified status, suburb and approximate distance, and availability freshness.

4.3 Phone numbers and WhatsApp. Your number is never displayed on the Service or sent to another user's browser. When a business chooses to contact an officer, the Service opens a WhatsApp conversation directly between the two parties. At that point, as is inherent to WhatsApp, the two parties will have each other's mobile numbers. This happens only when a business actively makes contact, and you consent to it when you use or are contacted through the contact feature.

5. Who we share information with (operators)

We use trusted operators under POPIA, under contract, only as needed:

• Supabase — database, authentication, hosting, and edge functions.
• PayFast (South Africa) — card payment processing and recurring billing for Pro.
• Twilio — sending the one-time PIN (OTP) to verify your mobile number.
• Google Maps Platform — converting the address/suburb you enter into approximate coordinates for distance matching.
• Resend — sending account and service emails.
• (If enabled) OneSignal — push notifications.

We do not sell or rent your personal information. We may disclose information where required by law, to a competent authority (including PSIRA) acting on a lawful request, or to detect or prevent fraud, abuse, or security issues. If ownership of Kostra transfers, personal information may transfer to the new owner under this Policy.

6. Cross-border processing

Some operators may process information outside South Africa (for example Supabase, Twilio, Google, Resend in the EU/US), while PayFast processes payments within South Africa. Where information is transferred outside South Africa we take reasonable steps to ensure the transfer complies with POPIA (adequate protection, contractual safeguards, or your consent).

7. Retention

We keep personal information only as long as necessary for the purposes here or as required by law. Account information is kept while your account is active; contact/audit records are retained as a compliance record for [retention period — confirm with attorney]. On account deletion we permanently remove your account, profile, availability, and contact history, retaining only anonymised/aggregate data or records we are legally required to keep.

8. Security

We apply appropriate technical and organisational measures, including database-level access controls (information is only ever returned to those entitled to see it), encryption in transit, and a design in which phone numbers and exact addresses are never exposed to the browser. No system is completely secure; we will notify the Information Regulator and affected users of a reportable breach as required by POPIA.

9. Your rights

Under POPIA you may: access the personal information we hold about you; request correction or deletion; object to processing; and lodge a complaint. You can update most details in your profile and delete your account immediately from Profile → Delete account. To exercise any other right, contact our Information Officer at support@kostra.co.za.

You may also complain to the Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg · enquiries@inforegulator.org.za · inforegulator.org.za.

10. Cookies and analytics

We use only the cookies and similar technologies necessary to keep you logged in, operate the Service, and understand basic usage. We do not use advertising cookies.

11. Children

The Service is intended only for PSIRA-registered adults and is not directed at, and may not be used by, anyone under 18.

12. Changes to this Policy

We may update this Policy from time to time. Material changes will be posted here and, where appropriate, notified by email or in-app.

13. Contact

[Company (Pty) Ltd] · Registration number [reg no] · [registered address] · Information Officer: [name] · support@kostra.co.za