Privacy policy

Who is responsible

TellKasi is run by the TellKasi team. Under the Protection of Personal Information Act (POPIA) we are the "responsible party" for your information.

Our contact details are being added. Until then, use the Flag button on a post, or reply to any email we sent you.

What we collect, and why

• Your account. Your email address, and a display name if you add one. Your password is handled by our sign-in provider; we never see it.
• What you post. The words of your report, the category, any photos, and where it is happening. Photos are shrunk and their GPS and camera details are removed before they are saved.
• Where it is happening. The spot you pin or your phone’s location when you choose to share it. We keep the exact point so reports can be grouped and sent to the right place, but other people only ever see the street or area, never your exact location.
• Contact details on a post (optional). If you tick “Moderators may contact me”, the number or email you type. Only moderators can see it. It is never shown on the post.
• Voice reports (members only). Your recording is sent to an AI service to write it out as text. We keep the text, not the recording.
• Till slips and shelf photos. The photo is read by an AI service to find the prices, and then deleted, normally within 48 hours. The prices you confirm are kept, and only you can see which slips were yours.
• Shops you list. Your shop’s name, type, address, map pin, phone and WhatsApp numbers, opening hours, photos and prices. These are shown publicly once an administrator has checked the shop.
• Your choices. Your saved area for alerts, which alerts you want, and the shops you follow. If you allow notifications, a code from your phone or browser so we can send them.
• Technical details. A scrambled (hashed) version of your connection or account, used to stop spam and abuse. We do not use advertising trackers or sell your information.

We use this only to run TellKasi: to show reports and prices, group them by area, send the alerts you chose, keep the site safe from spam and abuse, and pass a problem on to people who can fix it. We do not sell your information and we do not show adverts.

What other people can see

Posts, photos and prices are public, shown with the street or area but never your exact location, email or contact number. A display name is shown only if you choose one. Your till slips, saved area and alert choices are private to you.

Who else handles your information

We use these service providers. They may only use your information to do this work for us. Some of them store or process information outside South Africa; we only use providers that protect it to a standard similar to POPIA (section 72).

• Sign-in and storage: Supabase, which runs our sign-in and can store photos.
• AI services: An AI provider (for example OpenAI) that writes out voice reports and reads till slips. Only the recording or photo and the words needed are sent.
• Email: Our email provider (for example SendGrid or our own mail server), to send sign-in links and the alerts you asked for.
• Maps and place search: Google Maps or OpenStreetMap, to find places you search for.
• Bot checks: Cloudflare Turnstile or hCaptcha, to check that a person, not a script, is using a form.
• Hosting: The servers that run TellKasi.

We may also have to share information when the law requires it, for example a court order.

How long we keep it

• Your account, until you delete it.
• Posts and prices stay as community records. If you delete your account they stay up without your name or contact details.
• Till slip and shelf photos: deleted after their prices are read, normally within 48 hours.
• Voice recordings: not kept. Only the text is.
• Photos that were uploaded but never posted: deleted within a day.

Your rights

Under POPIA you can:

• See what we hold: on your Profile tap Download my data.
• Correct it: change your name and settings on your Profile, or ask us.
• Delete it: on your Profile tap Delete my account. Your posts stay up without your name or contact details.
• Object to how we use your information, or ask questions, using the contact details above.
• Complain to the Information Regulator: inforegulator.org.za, complaints.IR@inforegulator.org.za.

Children

If you are under 18, ask a parent or guardian before you create an account. Never post photos of children.

Keeping it safe

Connections are encrypted, passwords are handled by our sign-in provider, stored keys are encrypted, and only a few administrators can see private details such as contact numbers. If something goes wrong that puts your information at risk, we will tell you and the Information Regulator.

Changes

If we change this policy we will update the date at the top and, for big changes, tell you by email or in the app.