Privacy Notice
Updated: 31 October 2026 | Version 2.0
1. Who is responsible and how to contact us
SitEasy is operated by Refone (Pty) Ltd, trading as SitEasy, a South African company (registration 2022/408691/07). This notice explains how we handle personal information in connection with our pet-sitting marketplace under the Protection of Personal Information Act, 2013 (POPIA).
For privacy questions, access, correction, objections, restrictions or deletion requests, contact Selez Massozi, our privacy contact and Information Officer, at support@siteasy.co.za. We do not require you to create a new account to contact us about your rights.
See our Data Deletion Policy and request instructions for account closure and deletion limits.
2. Information we handle
- Accounts and profiles: names, contact details, authentication information, location, profile photos, biographies, preferences and verification status.
- Verification: identity documents, selfie-with-ID images, criminal-clearance reports and verification decisions submitted or recorded for sitter verification.
- Bookings and care: booking history, home addresses, pet details, care or medical instructions, check-ins, photos, sitter videos, messages, reviews and relevant safety or dispute records.
- Payments: booking amounts, transaction and payout references, required billing information and sitter bank/payout details. Paystack handles payment processing.
- Support and rights requests: correspondence, necessary identity-verification outcomes, request dates, decisions and information needed to resolve the issue.
- Technical information: browser/device information, request and security metadata, potentially including IP addresses, pages or URLs visited, usage analytics, errors and performance diagnostics. Fields vary by service and configuration.
Information may come from you, your interactions with other users, booking/payment activity and the services that operate the platform. Please avoid including unnecessary information about other people in messages, care notes or uploads. If required information is missing, we may be unable to verify an account or provide the relevant service.
3. Purposes and processing justifications
We use personal information to administer accounts, arrange and deliver bookings, verify sitters, communicate about services, process payments/payouts, provide support, investigate safety or security matters, maintain required records and understand service performance.
The applicable POPIA justification depends on the purpose: taking requested steps or performing a contract; complying with a legal obligation; protecting legitimate interests subject to POPIA and your rights; or consent where applicable. Using the website is not blanket consent to every form of processing. Where processing depends on consent, you may withdraw it; this does not itself make earlier lawful processing unlawful or remove another applicable record-keeping obligation.
4. Identity images and sensitive verification information
Criminal-conduct information and any actual biometric processing require the applicable additional POPIA grounds. A photo or ID image is not automatically biometric information simply because we hold it; the processing performed matters.
The exceptions for processing special personal information are distinct from any prior-authorisation requirement under section 57. The actual screening arrangement, report source and whether processing is performed on behalf of third parties matter. Submission of a report is not, by itself, a substitute for those requirements. Contact us for information about the verification processing relevant to your account or to challenge a verification decision.
5. Sharing and service providers
Other users receive profile, booking, communication and care information needed for the service. Some profiles and reviews are visible to other users or visitors. Consider what you share: another person may retain their own copy or have an independent reason to keep a record.
Services involved in operating SitEasy include:
- Supabase for authentication, database services and uploaded-file storage.
- Paystack for payments and payouts.
- Vercel for hosting and website analytics, and Sentry for error/performance diagnostics.
- Resend for transactional email and RegisterDomain/cPanel for our business and support email.
- Upstash for rate limiting where configured; rate-limit identifiers can relate to users or IP addresses.
- A sign-in provider, such as Google, when you choose that sign-in method.
Providers have different functions and may have their own legal responsibilities, retention rules and processing locations. We may also disclose necessary information where lawfully required or justified for a specific dispute, safety matter or protection of rights. We do not describe every provider as holding no personal information or promise that closing a SitEasy account deletes their independent records.
6. Processing outside South Africa
Cloud, email, payment and technical services may process information outside South Africa. Applicable POPIA cross-border requirements depend on the recipient, purpose, location and safeguards. This notice does not claim that every provider copy is in one country or that the same agreement covers every transfer. You can ask us about the providers, locations and safeguards relevant to your information.
7. Retention: periods and criteria
Retention is determined by the particular record and its purpose, legal obligations, decisions made about you, unresolved services, disputes and applicable processing restrictions. Account closure is not a universal retention clock. The following criteria do not promise that every dataset has an automatic expiry timer.
| Category | Period or retention criteria |
|---|---|
| Account, profile and care information | While needed for the account/service and relevant follow-up; eligible information is considered for removal or de-identification on verified deletion. Necessary financial/shared records are assessed separately. |
| Identity documents and verification outcomes | For necessary verification, eligibility, review and required decision evidence. Original documents and minimal outcomes are assessed separately. There is no blanket five-year requirement for every ID or clearance report merely because an account closes. |
| Messages, photos, videos and reviews | According to service purpose, ownership, shared-record interests and necessary complaint/dispute evidence. Deleting one account does not automatically require erasing another person's independently necessary records. |
| Financial and company records | Category-specific statutory periods apply. Relevant tax-supporting records generally have a five-year period from return submission; company-record requirements can differ and be longer. Audits, proceedings and other obligations may extend the applicable period. This is not five or seven years for an entire customer account. |
| Incident and decision records | As justified by the particular matter and applicable obligations. Records used to decide something about you must also meet POPIA section 14(3), including a reasonable opportunity to request access where no period is prescribed. |
| Support and deletion correspondence | According to case resolution, necessary request/decision evidence and legal or dispute requirements. We do not promise a universal automatic mailbox expiry period. |
| Diagnostics, analytics and recovery copies | According to the dataset, provider controls and ongoing purpose. Backup, cache and log residual periods vary; we do not promise a universal 30-day expiry. Contact us for the information available about a particular category. |
Where POPIA requires a restriction on processing, that is distinct from an internal legal or safety hold. The permitted processing and any requirement to inform you before lifting the restriction still apply. A routine retention date or internal hold release does not override those duties.
The Data Deletion Policy explains retained history, incomplete cleanup and provider/recovery limitations. Pseudonymised or hashed information may still be personal information; removing a name is not proof of anonymity.
8. Cookies, browser storage and analytics
Cookies and browser storage support authentication, preferences and the cookie-banner choice on your device. Website analytics and diagnostic services can also process technical information. Browser cookie settings do not necessarily prevent all analytics or diagnostic processing.
You can manage cookies/storage through your browser, although blocking authentication storage may prevent sign-in. For questions about optional processing, consent withdrawal or an objection, contact our privacy address. We do not treat a banner preference as proof that every third-party request is blocked.
9. Your rights and complaints
Subject to POPIA's requirements and exceptions, you may request confirmation/access, correction or deletion; object to processing; withdraw consent where applicable; or ask about a processing restriction or decision made using your information. We may need proportionate verification of your identity and authority before disclosing or changing records. Do not send passwords or one-time codes in your initial email.
Email support@siteasy.co.za. To close an account, follow the deletion instructions. A request or acknowledgement is not evidence that every deletion step or provider action has completed.
You may also complain to the Information Regulator of South Africa; its website provides current complaint procedures and contact details.
10. Security, children and changes
Our service uses authentication and access controls. No online service or storage method is completely secure; this notice is not a security certification or guarantee of irreversible erasure.
SitEasy is intended for adults aged 18 and over. If you believe a child's information has been provided, contact us so that the circumstances and appropriate removal or restriction can be assessed.
We may update this notice as practices or legal requirements change. The date and version above identify the current notice. Material changes may require additional notice or consent where applicable; continuing to use the site does not replace a required processing justification.