Privacy Policy

1. Who we are

Grafta is operated by Khulisa Group (Pty) Ltd (registration number 2026/118730/07), the responsible party under the Protection of Personal Information Act, 2013 (POPIA). Our Information Officer is Anita de Lange. Our postal address is PO Box 82, Napier, Western Cape, South Africa, 7270. You can reach us through our Contact Us page or by email at hello@grafta.co.za.

2. What information we collect

• Account details such as your email address and sign-in information.
• If you sign in with Google or Facebook, we receive your name, email address and profile picture from that provider. We do not receive your password, posts, friends list or any other information from your Google or Facebook account.
• Listing details you provide, including name, town or area, skills, experience, availability, description and optional profile photograph.
• Your telephone or WhatsApp number, stored privately unless you approve a contact request.
• Contact request details, including requester name, contact number, message, status and decision date.
• Reports about listings or people: the reason, any note, which account made the report and who it is about.
• If we remove an account for safety or misuse: a scrambled (hashed) copy of the email address and phone number, the reason and the date, so that the person cannot simply sign up again.
• Kudos you give or receive: who gave kudos to whom, when, which contact request it followed, and any tags chosen (Reliable, Quality work, Friendly, On time).
• Notifications about your contact requests and kudos, and a record of the emails we send you (your email address, the type of email and whether it was sent).
• Messages you send through our Contact Us form, including your name, email address, topic and message.
• Technical records needed to run and secure the platform, such as timestamps and system logs.

Some future sections of the app refer to identity checks, parent consent, references, police clearance certificates, work permits, youth programmes or safeguarding records. Those sections are not live for this launch. If they are enabled later, this policy must be updated before that information is collected.

3. Why and how we use it

We use personal information to operate the skills noticeboard, publish listings, receive and manage contact requests, show in-app notifications, handle reports, prevent misuse, keep records of user choices, and respond to support, correction or deletion requests.

We process this information because it is needed to provide the platform, because users consent to specific sharing actions, because we have a legitimate interest in safety and abuse prevention, and because South African law may require us to keep or disclose certain records.

4. Contact details and WhatsApp

Your telephone number is never displayed publicly. It is only shared with another user when you explicitly approve their contact request. You can decline any request.

This launch uses manual WhatsApp links. When a contact request is approved or declined, the app may open WhatsApp with a prepared message for the user to review and send. WhatsApp messages are handled by WhatsApp/Meta under their own terms and privacy policies.

On public listings, members are shown by first name and surname initial. Full contact details are only shared when you approve a contact request.

When someone sends you a contact request, or a worker accepts your request, we email you to let you know. These emails show only the other person's public name (first name and surname initial) and a link to sign in. They never contain a phone number, an email address or the request message.

When you have news about a contact request, a banner appears at the top of the site while you are signed in. It shows the other person's public name and links to the request. Only you can see it, and it goes away once you open or dismiss it.

If a worker accepted your contact request at least 7 days ago, you can give them kudos once for that request, with optional tags. The worker sees your public name. The public sees only how many different people have given a worker kudos and the two most-chosen tags, never who gave them. To prevent misuse, we check whether accounts appear to be linked, for example by comparing phone numbers. If you would rather not show kudos on your listing, contact us.

5. Sharing with service providers

We do not sell personal information. We may share limited information with service providers who help us operate the platform, such as hosting, authentication, database, email, analytics, security or communication services. We may also disclose information where required by law, court order, regulator request, or to protect users from harm, fraud or abuse.

If you choose to sign in with Google or Facebook, that provider processes your sign-in under its own privacy policy. We only receive the information described in section 2.

6. Requests from authorities

Khulisa Group (Pty) Ltd may receive requests from police, courts, government departments or other public authorities for information about Grafta users. We handle any such request as follows:

• We check that it is lawful. We only respond to requests that are made in writing, come from an authority with the legal power to make them, and comply with South African law, including the Protection of Personal Information Act (POPIA). Where needed, we take legal advice before responding.
• We challenge requests that are unlawful or too broad. If a request is not legally valid, is unclear, or asks for more than the authority is entitled to, we will decline it, ask for it to be narrowed, or challenge it through the proper legal channels.
• We share only the minimum. If we must comply, we disclose only the specific information the request legally requires, and nothing more.
• We keep a record. We document every request we receive, how we responded, and the legal reasons for our decision.
• We tell the user where we can. Unless the law prevents it or doing so would put someone at risk, we will let the affected user know about the request before or after we respond.

Questions about this section can be sent to hello@grafta.co.za.

7. Security and retention

We use access controls, private database rules, secure hosting and administrative restrictions to protect personal information. No online system is perfectly secure, so users should avoid posting sensitive details in public descriptions.

We keep active listing and account records while they are needed to provide the platform. Contact request records are reviewed and may be removed after they are no longer needed for the contact flow, dispute handling or legal record-keeping. Reviewed reports may be retained longer where needed for safety, abuse prevention or compliance.

Contact form messages are kept for up to 12 months after we have dealt with them, unless we need them longer for a dispute or legal reason.

Kudos is kept while both accounts exist and is deleted when either account is deleted. Notifications are deleted when you delete your account.

Records of emails we send you are kept for up to 90 days for troubleshooting, then deleted.

If we remove an account for safety or misuse, we may keep limited information (such as name, phone number, email address and the reason for removal) for as long as needed to prevent the person re-registering, to protect other users, and to deal with any legal claim or police request.

8. Where your information is stored and processed

Our database is hosted by Supabase in London, United Kingdom. Some of our service providers process information outside South Africa:

• Supabase (United Kingdom) stores our database.
• Resend (United States) sends our emails, including contact form notifications, and keeps copies of sent emails for up to 30 days.
• Cloudflare (global network) hosts our website and routes our email.

We use these providers because they are needed to run Grafta. Each is bound by a data processing agreement that requires it to protect your information and use it only to provide its services to us. The United Kingdom has data protection law substantially similar to POPIA.

9. Editing or removing your information

You can edit, pause or delete your listing, and delete your account, from My Profile when you are signed in. To request access to your information, correct it, or ask us to delete it, send us a message through our Contact Us page.

Our Deleting your Grafta data page explains how to delete your account and what is removed.

10. Your rights

Under POPIA you may request access to your personal information, ask us to correct or delete it, object to certain processing, withdraw consent where processing depends on consent, and complain to the Information Regulator. Contact us first so we can assist.

11. Children and special personal information

The public noticeboard is intended for adults. Users must not submit another person's identity documents, medical details, criminal history, child information, or other sensitive information unless a live feature specifically asks for it and the required consent and safeguards are in place.

12. Security incidents

If we reasonably believe that personal information has been accessed or acquired by an unauthorised person, we will assess the incident and take the notification steps required by POPIA.

13. Contact

For privacy questions, please use our Contact Us page, or email us at hello@grafta.co.za.

You may also contact the Information Regulator South Africa if you believe your POPIA rights have not been respected.