Privacy
Privacy policy.
How we collect, use and protect your personal information — and the rights you have over it.
SPOTR — PRIVACY POLICY
Version 2.0 · Effective date: 01 September 2026
1. Introduction
SPOTR is a mobile-first active lifestyle social platform registered in the Republic of South Africa. This Privacy Policy governs the collection, use, storage, sharing and protection of personal information when you access or use the SPOTR platform (the website, mobile application, communities, events and marketplace, collectively the “Platform”). SPOTR acts as the Responsible Party under the Protection of Personal Information Act 4 of 2013 (POPIA) and processes personal information in accordance with the eight conditions for lawful processing.
2. Scope
This Policy applies to all users, visitors and third parties who interact with SPOTR through the website, mobile application, communities, events and marketplace. By creating an account or using the Platform, you acknowledge that you have read and understood this, Policy.
3. Responsible Party
Spotr Technologies (Pty) Ltd (registration number 2026/618421/07) is a company incorporated in the Republic of South Africa. Registered address: 5 Gowrie Avenue, Gowrie Village, Nottingham Road, KwaZulu-Natal, 3280. Information Officer: Kyle Crawford, registered with the Information Regulator under reference 2026-064109. Contact: support@spotr.co.za | +27 64 967 1289.
4. Information We Collect
SPOTR collects the following categories of personal information:
Identity information: full name, date of birth, gender, profile photographs and biography.
Contact information: email address and mobile number.
Profile information: fitness interests, primary activities, training frequency, skill level, goals, prompt answers, the city you select, and what you are looking for (a date, a friend, a training partner, or a professional service).
Health and fitness data (Special Personal Information): fitness level, activity types, training frequency and physical goals — collected only with your explicit consent under POPIA s.27(1)(a).
Dating and connection preferences (potentially including sexual orientation where voluntarily disclosed — Special Personal Information): collected only with your explicit consent under POPIA s.27(1)(a).
Location: the city you choose. SPOTR does not collect precise GPS coordinates and does not track your location in the background.
Communications: messages between members. Messages are encrypted in transit (TLS 1.2 or higher) and at rest. SPOTR does not operate end-to-end encryption: where a message is reported, a moderator may review the relevant conversation to investigate, and content may be disclosed to law enforcement where lawfully required.
Reports and safety information report you submit about other members, and reports submitted about you.
Basic device information required to run the app and keep you signed in.
Identity verification data: only where identity verification is enabled. See section 16.
What we do not collect. SPOTR does not use analytics, crash reporting, advertising technology or tracking cookies. We do not build advertising profiles, and we do not track you across other companies’ apps or websites. Premium subscriptions are not yet available; when they launch, payments will be processed by the Apple App Store and Google Play, and SPOTR will not receive or store your card details.
5. Information You Provide
You provide personal information directly when you register, complete your profile, upload photographs, answer prompts, set preferences, send messages and post to communities and events. You are responsible for ensuring that what you provide is accurate and lawfully shared.
In accordance with POPIA s.18(1), the following are mandatory and the Platform cannot be provided without them: your email address, your mobile number and your date of birth. Everything else — including your photographs, biography, prompt answers, fitness interests, health and fitness data and dating preferences — is voluntary. If you decline to provide voluntary information you may continue to use the Platform but features that depend on it will be unavailable or degraded. No law obliges SPOTR to collect this information, other than the obligation under POPIA s.34 to prevent the processing of the personal information of children.
6. Information Collected Automatically
SPOTR collects only the basic device and session information needed to operate the Platform and keep you signed in securely. We do not currently operate analytics, crash reporting or usage tracking of any kind, and the SPOTR website does not set cookies or use tracking pixels. If this changes, this Policy will be updated and the provider named before any such technology is introduced.
7. Special Personal Information
SPOTR processes the following categories of Special Personal Information as defined in POPIA s.26:
(a) Health and fitness data — voluntarily provided to facilitate fitness matching and training partner discovery. Legal basis: explicit consent (POPIA s.27(1)(a)).
(b) Sexual orientation or dating preferences — voluntarily disclosed through profile preferences. Legal basis: explicit consent (POPIA s.27(1)(a)) or, where you have deliberately made the information public, s.27(1)(d).
SPOTR will not process special personal information for purposes beyond those explicitly consented to. You may withdraw consent at any time in the app’s privacy settings, and SPOTR will cease the relevant processing without affecting the lawfulness of processing carried out before withdrawal.
8. Purpose of Processing
To create and manage your account.
To provide the matching, community and event services you request.
To enable discovery of training partners, friends, dates and professional services.
To facilitate marketplace interactions between members and service providers.
To operate, secure and improve the Platform.
To communicate service updates and safety notices, and — with your consent — marketing communications.
To comply with legal obligations and cooperate with lawful authority requests.
To investigate and resolve disputes, reports and safety concerns.
To verify that members are 18 years or older.
9. Lawful Basis and Data Categories
The table maps each purpose in section 8 to the lawful basis relied on and the categories of personal information used. Where more than one basis is listed, SPOTR relies on each in respect of the aspect of processing to which it applies.
| Purpose | Lawful basis | Categories used |
|---|---|---|
| Creating and managing your account | Contractual necessity — s.11(1)(b) | Identity, contact, device information |
| Providing matching, community and event services | Contractual necessity — s.11(1)(b); explicit consent for special personal information — s.27(1)(a) | Identity, profile, health and fitness data, connection preferences, city |
| Enabling discovery of training partners, friends, dates and professional services | Contractual necessity 11(1)(b); explicit consent — s.27(1)(a) | Profile, health and fitness data, connection preferences, city |
| Facilitating marketplace interactions | Contractual necessity — s.11(1)(b) | Identity, contact, profile |
| Operating, securing and improving the Platform | Legitimate interests — s.11(1)(f), subject to your right to object under s.11(3)(b) | Device and session information, profile |
| Communicating service updates and safety notices | Contractual necessity — s.11(1)(b); legitimate interests — s.11(1)(f) | Identity, contact |
| Sending direct marketing communications | Consent — s.69 read with s.11(1)(a) | Identity, contact, profile |
| Complying with legal obligations and lawful authority requests | Legal obligation — s.11(1)(c) | Any category, depending on the obligation |
| Investigating and resolving disputes, reports and safety concerns | Legitimate interests — s.11(1)(f); legal obligation — s.11(1)(c); protection of a legitimate interest of the data subject — s.11(1)(d) | Identity, profile, communications, reports |
| Verifying that members are 18 or older | Legal obligation — s.11(1)(c) read with s.34; explicit consent for identity documents — s.27(1)(a) | Date of birth; identity verification data where enabled |
Where SPOTR relies on legitimate interests it has assessed those interests against your rights and concluded the processing is proportionate. You may object at any time under POPIA s.11(3)(b), and to direct marketing under s.11(3)(b) and s.69(3)(c).
9.1 Automated processing and profiling
Match suggestions are generated algorithmically from your stated preferences, your profile, the city you select and your activity on the Platform. In accordance with POPIA s.71, SPOTR does not take any decision that has legal consequences for you, or affects you to a substantial degree, solely on the basis of automated processing. Moderation and enforcement decisions are made by a person. You may request an explanation of any such decision, make representations about it, and appeal it by writing to support@spotr.co.za.
10. Sharing Information
SPOTR shares personal information only with the following categories of recipient:
Supabase — hosting, database and file storage.
Brevo — email delivery.
Identity verification providers — where identity verification is enabled (see section 16).
Apple and Google — for app distribution and, once premium features launch, payment processing.
Emergency services or law enforcement — where required by law or to prevent harm.
Professional service providers (coaches, physiotherapists, nutritionists) where you initiate contact through the marketplace.
Competent regulatory authorities — as required by law.
When you submit a report about another member, or another member submits one about you, SPOTR may inform the reporter of the outcome and any action taken, without disclosing the personal information of the person reported beyond what is necessary to convey that outcome. SPOTR may transfer personal information to a successor entity in connection with a merger, acquisition, sale of assets, restructuring, business rescue or liquidation, in which case you will be notified before your information becomes subject to a materially different privacy policy. SPOTR does not sell personal information.
11. International Transfers
Your personal information is stored outside South Africa, and we are specific about where:
Your profile, photographs and messages are held by Supabase on servers in Ireland (European Union).
Email we send you is processed by Brevo, also within the European Union.
The European Union is governed by the General Data Protection Regulation, which affords a level of protection for personal information comparable to POPIA. This is the basis on which POPIA s.72 permits the transfer. Your rights over that information — access, correction, export and deletion — are the same wherever it is stored and are exercised in the same way. Where SPOTR engages a further processor outside South Africa it will either satisfy itself of adequate protection in law, enter into a binding agreement imposing POPIA-equivalent obligations, or obtain the prior authorisation of the Information Regulator.
12. Data Retention
Personal information is retained only for as long as necessary, in accordance with POPIA s.14:
| Category | Retention period | Basis |
|---|---|---|
| Active account data | Duration of the account plus one year after deletion | Dispute resolution and legal compliance |
| Date of birth | Duration of the account | Required to evidence the 18+ check under s.34 and to allow you to correct it |
| Age verification outcome (the record that a check was completed, its date and method) | Three years | Evidence of compliance with POPIA s.34 |
| Safety investigation records | Three years after closure, or as required by law | Legal compliance and defence of claims |
| Customer support and enquiry records | Three years from the communication | Enforcement decisions and defence of claims |
| Marketing consent records | Until consent is withdrawn, plus one year | Evidence of consent under s.69 |
| Server logs | Twelve months rolling | Security and operational necessity |
| Records of underage account closures and supporting evidence | Three years, or longer where required for a law enforcement investigation | Child protection; law enforcement cooperation |
| Transaction records (once premium features launch) | Five years | South African tax and financial record-keeping |
Inactive accounts. If you do not access your account for twenty-four consecutive months, SPOTR will notify you at your registered email address and, if you do not access the account within thirty days of that notice, the account will be closed and your personal information deleted or anonymised in accordance with the periods above. After the applicable period, personal information is securely deleted or anonymised.
13. Security
SPOTR applies with the following technical and organisational safeguards:
Encryption in transit (TLS 1.2 or higher) and at rest.
Row-level access controls in our database, so that members can only access their own data and what is properly shared with them.
Role-based administrative access, with administrative actions recorded in an audit log.
Photographs stored in access-controlled storage, with upload and deletion restricted to the account owner.
Data processing agreements with our operators.
Incident response procedures (see section 18).
No system is perfectly secure. SPOTR reviews these measures as the Platform grows and will update this section as further controls are introduced.
14. Direct Marketing
SPOTR will only send direct marketing by electronic means with your prior express consent, in accordance with POPIA s.69. Every marketing communication will carry a clear, functional opt-out. You may withdraw consent at any time in the app’s notification settings or by emailing support@spotr.co.za. Opting out of marketing does not affect service communications such as safety notices or account alerts.
15. Your POPIA Rights
Under POPIA you have the right to:
(a) Request confirmation of whether SPOTR holds your personal information (s.23);
(b) Request access to your personal information (s.23);
(c) Request correction of inaccurate, incomplete or outdated information (s.24);
(d) Request deletion or destruction of your personal information (s.24);
(e) Object to processing based on legitimate interests (s.11(3));
(f) Withdraw consent at any time (s.11(2)), without affecting prior lawful processing;
(g) Lodge a complaint with the Information Regulator.
The quickest route is Settings → Privacy & Data Rights in the app, where you can export your data or delete your account. You may also email support@spotr.co.za or use the account deletion page at spotr.co.za/delete. SPOTR will acknowledge your request and respond within 30 days as required by POPIA. We may need to verify your identity first.
SPOTR may decline a request, in whole or in part, where it cannot verify your identity or your authority to act for another person; where the request is manifestly unfounded, excessive or unlawful; or where complying would infringe the rights of another person or disclose confidential information. In particular, a request for access to your personal information does not entitle you to another member’s. Messages you have received contain that person’s personal information as well as your own, and SPOTR will not disclose their identity, profile information or account status in response to your request. Where SPOTR declines a request it will tell you why, and you may ask for the decision to be reconsidered by writing to support@spotr.co.za referring to a privacy request appeal. If you remain dissatisfied you may complain to the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. Tel: 010 023 5200. Email: enquiries@inforegulator.org.za
16. Children’s Privacy and Age Verification
The Platform is strictly for people aged 18 and older. SPOTR does not knowingly collect personal information from anyone under 18.
Age is verified at registration by date of birth, which is checked before an account can be created and is enforced at database level. SPOTR has integrated document and liveness verification through Smile ID, which will be enabled at public launch; it does not operate during closed testing. Where document verification is used, the identity document and selfie are processed by the verification provider under a data processing agreement and are not retained by SPOTR — only the outcome of the check is stored. Fuller details are set out in our Age Verification Policy.
If SPOTR becomes aware that a member is under 18, the account will be suspended immediately and the personal information deleted in accordance with POPIA s.34. Parental or guardian consent does not permit a person under 18 to use the Platform in any circumstances. If you believe a member is under 18, report the account in the app or to support@spotr.co.za.
17. Third-Party Services
The Platform relies on Supabase for authentication, database and file storage, and on Brevo for email delivery. Identity verification, and payment processing through the Apple App Store and Google Play, apply once those features are enabled. Each third party operates under its own privacy policy, and SPOTR enters into binding data processing agreements where required by POPIA. SPOTR does not integrate advertising networks or analytics platforms.
18. Security Compromise and Breach Notification
In the event of a security compromise involving personal information, SPOTR will, in accordance with POPIA s.22:
(a) Investigate and take immediate steps to contain the compromise;
(b) Notify the Information Regulator as soon as reasonably possible after discovery;
(c) Notify affected data subjects in writing, by email to the last known address or by prominent notice on the Platform, unless notification would impede a criminal investigation;
(d) Provide guidance on protective steps data subjects can take.
Notification will describe the nature of the compromise, the personal information affected, recommended steps and SPOTR’s contact details. Information Regulator: enquiries@inforegulator.org.za | 010 023 5200.
19. Policy Changes
This Policy may be updated to reflect changes in the Platform, legal requirements or business practices. Material changes will be communicated by email or in-app notification at least 14 days before taking effect. Where a change introduces a new processing activity requiring consent, fresh consent will be sought before it is implemented. Continued use of the Platform after notice constitutes acceptance of the updated Policy.
20. Contact Details
Spotr Technologies (Pty) Ltd | Registration number 2026/618421/07 | Registered address: 5 Gowrie Avenue, Gowrie Village, Nottingham Road, KwaZulu-Natal, 3280 | Information Officer: Kyle Crawford (Information Regulator reference 2026-064109) | support@spotr.co.za | +27 64 967 1289 | spotr.co.za
Prepared 31 August 2026. Every factual statement in this document was verified against the SPOTR application source code, the Supabase schema and the spotr.co.za website. Sections describing capabilities not yet built have been removed rather than deferred and will be re-introduced as each is delivered.