Privacy Policy

1. Who is responsible

Silver Lakes Marketplace is operated by a volunteer (contact: support@silverlakesmarketplace.co.za), who acts as the "responsible party" for personal information processed on the Platform under POPIA.

2. What we collect

Account information: your email address and password (stored only as a secure hash — nobody, including the Operator, can read your password).

Profile information you choose to add: display name, profile photo, street address, and an "about" blurb. Your display name, photo and "about" text appear on your listings and public profile, so they are visible to anyone browsing the Platform. Your street address is only ever shown to signed-in users and is never included in the public view of a page. Share only what you're comfortable with neighbours seeing.

Marketplace activity: listings and photos you post, offers you make or receive, purchases, ratings you give and receive, wishlist items, and messages you send.

About private messages. Messages are private between the participants. Anyone running the Platform has technical access to the database, so we are telling you plainly what we do with that access rather than implying it doesn't exist. We do not read private messages routinely. A message may be read only where: someone reports that message or conversation; it is necessary to investigate a specific technical fault that has been reported to us; or the law requires it. In each case we look only at what is needed for that purpose. Anyone with administrative access is held to the same limit.

Payout details (sellers who enable card payments): your bank name and account number are sent directly to Paystack to create a payout account. The Platform stores only the bank name, the last 4 digits of the account number, and a Paystack reference code — never the full account number.

Payments (buyers): card details are entered on Paystack's secure interface and are never seen or stored by the Platform. We keep a record of the transaction (item, amount, reference, status).

Technical data: our hosting providers keep standard server logs (IP address, browser type, timestamps) for security and reliability. When something goes wrong on a page, an error report is sent to our monitoring provider containing the page address, your browser type and a timestamp, so the fault can be found and fixed.

3. Why we process it

To run the marketplace: operating your account, showing your listings to other users, delivering messages and notifications, processing payments and payouts, preventing fraud and abuse, and complying with legal obligations. We do not sell personal information, use it for advertising, or share it with anyone except the service providers below.

4. Who processes it on our behalf

Supabase hosts the database, authentication and file storage. Cloudflare hosts the website and provides its DNS. Paystack processes card payments and seller payouts (card payment is not currently enabled, so no payment or bank information is being sent to them at present). Resend delivers notification emails, and receives your email address and the contents of that notification. Sentry collects technical error reports when something breaks on the site, which include the page address, your browser type and a timestamp.

Where the data sits. Supabase, which holds the database itself, stores it in Paris, France. Sentry stores its error reports in the European Union. Cloudflare, Paystack and Resend each hold what is described above on their own infrastructure.

Each processes data under their own security and privacy commitments, and some of this processing happens on servers outside South Africa — by using the Platform you consent to that transfer as needed to provide the service. We do not use any advertising, analytics or tracking service.

5. How long we keep it

POPIA says personal information must not be kept for longer than it is needed, unless the law requires it. In practice:

Account and profile information is kept while your account exists. There is no delete button yet: email support@silverlakesmarketplace.co.za and we will delete it by hand within 30 days.

Your own material goes with your account. Your listings and photos, your messages, offers, wishlist and saved searches, and the ratings other people left about you, are all deleted when the account is. Not after a delay: at the moment of deletion.

A review you wrote about someone else is kept, with your name removed. It stops being attributed to you and shows as written by a neighbour. That is so the person you reviewed keeps an honest rating history, which would otherwise change every time someone else closed an account.

Records of money are kept for at least 5 years, without your name on them. The item, the amount, the date and the payment reference stay, because tax and accounting law requires a record of a transaction. Your identity is removed from them.

Reports are kept with the reporter’s name removed, so that a pattern of behaviour can still be recognised rather than resetting whenever one person leaves. We clear old ones by hand when we review them.

We do not run an automatic purge on a schedule. Nothing is quietly deleted behind your back, and nothing is quietly kept either.

Technical error reports are kept by Sentry for as long as its own retention setting allows, and server logs for as long as our hosting providers keep them. Those are their schedules, not ours.

6. Your rights (POPIA)

You may ask to access the personal information we hold about you, correct it, or delete your account and data. You can edit most profile information yourself on the Profile page. For access, correction or deletion requests, email support@silverlakesmarketplace.co.za — requests are handled within 30 days and at no charge. If you believe your information has been mishandled, you may lodge a complaint with the Information Regulator (South Africa) at inforeg.org.za.

7. Security

Access to data is controlled with row-level security (each user can only read what they're entitled to), passwords are hashed, payment amounts are computed server-side, and card and bank details are handled by Paystack rather than the Platform. No system is perfectly secure; if a breach affecting your personal information occurs, affected residents and the Information Regulator will be notified as required by POPIA.

8. Cookies and local storage

The Platform uses browser storage only to keep you signed in, remember your theme preference, and remember your place when browsing. There are no advertising or tracking cookies.

9. Children

Accounts are restricted to people aged 18 or older by our Terms of Service. We do not knowingly collect personal information from children, and if we become aware that an account belongs to someone under 18 we will remove the account and delete the personal information associated with it. If you believe a child has created an account, email support@silverlakesmarketplace.co.za.

10. Changes

If this policy changes materially, it will be announced on the Platform and the date above updated.