1. Introduction
TradeFeed (“we”, “us”, “our”) operates the TradeFeed platform (tradefeed.co.za), a digital catalog service for South African wholesalers and retailers. We are committed to protecting your personal information in compliance with the Protection of Personal Information Act, 2013 (POPIA) and other applicable South African legislation.
2. Information We Collect
We collect the following categories of personal information:
- Account Information: Name, email address, and profile image when you sign up via our authentication provider (Clerk).
- Shop Information: Business name, WhatsApp number, address, city, province, GPS coordinates, business hours, and social media handles.
- Product Data: Product names, descriptions, images, prices, and variant information uploaded by sellers.
- Usage Analytics: Anonymised page views, product views, and WhatsApp click counts when you accept analytics. These may be associated with a random first-party visitor identifier. We do not derive that identifier from your IP address or store a buyer's real-world identity in analytics events.
- Payment Information: Billing is processed by PayFast (a South African payment gateway). We do not store credit card details — PayFast handles all payment data securely.
- Voluntary Research and Support Responses: If you choose to use a TradeFeed research or setup-help form, we collect the answers you submit and your contact details only when you ask us to follow up. Do not submit passwords, one-time codes, payment details, customer information, or private WhatsApp messages.
- Email product-news preferences: We record whether you explicitly opted in or out, when and where that choice was made, and suppression records needed to honour unsubscribe, complaint, bounce, and national opt-out requests. Creating a TradeFeed account does not opt you in.
- TradeFeed HUNT requests: If you start a HUNT, we collect the product reference image you choose, your request, requested variant, budget, general city, WhatsApp number, optional first name, and your HUNT-specific consents. The moderated image and product request are public only after you explicitly agree. Your WhatsApp number, name, and original note remain private.
3. How We Use Your Information
We process your personal information for the following purposes:
- To create and manage your seller account and shop profile.
- To display your public catalog to potential buyers.
- To facilitate WhatsApp communication between buyers and sellers.
- To provide analytics about your catalog performance.
- To process subscription payments via PayFast.
- To send service-related communications needed to operate your account.
- To send optional product news and feature announcements only after your explicit opt-in, with an unsubscribe option in every marketing email.
- To respond to voluntary setup-help or catalogue-import requests and understand why sellers stop using TradeFeed.
- To moderate and structure a HUNT request, match it with relevant sellers, publish seller-approved anonymized offer details, notify the requester, and prepare a buyer-chosen WhatsApp handoff. During Beta, the public HUNT room withholds seller names, logos, WhatsApp numbers, shop links, and proof media.
- To improve our platform and fix technical issues.
4. Legal Basis for Processing (POPIA)
Under POPIA, we process your personal information based on:
- Consent: We ask separately before enabling non-essential analytics or sending email product news. Creating an account does not grant either consent.
- Contract: Processing is necessary to provide our catalog services to you.
- Legitimate Interest: Security, fraud prevention, and privacy-filtered error reporting needed to keep the service reliable.
5. Data Sharing
We do not sell your personal information. We share data only with:
- Clerk: Authentication provider (stores account credentials securely).
- PayFast: Payment processor for subscription billing.
- Resend: Email delivery provider for account notifications and, only where you opt in, TradeFeed product-news email. Resend receives the delivery address and email content needed to send the message and process delivery events.
- Uploadthing: Image hosting service for product photos.
- OpenAI: Product-image and request analysis used to moderate and structure HUNT submissions. TradeFeed sends the submitted reference image and request text for this purpose; requester contact details are not included in that analysis request.
- Neon: Database hosting provider (PostgreSQL).
- Vercel: Application hosting, delivery, and operational logs required to run and secure TradeFeed. Vercel's optional product analytics remain disabled until you accept analytics.
- Abuse prevention: Before a network or buyer-feature identifier is used for HUNT rate limiting, TradeFeed converts it with a server-keyed, pseudonymous HMAC. Short-lived counters are stored in TradeFeed's database and may also be processed by Upstash when that service is configured. Raw identifiers are not stored in those counters, vendor analytics are disabled, and expired counters are deleted by the retention job.
- Google Analytics: Aggregate traffic analytics, enabled only after you accept analytics.
- Sentry: Privacy-filtered error reporting required to diagnose failures. Browser performance tracing is enabled only after you accept analytics; Session Replay is disabled.
- Tally: Form processor for voluntary seller research, setup-help, catalogue-import, and stopped-using responses. These forms do not use advertising pixels or request file uploads at launch.
- Geoapify: Optional address-autocomplete provider. We send the address text a seller deliberately types after editing the location field; simply opening settings does not send an already-saved address.
- OpenStreetMap: Optional shop-location map preview. It loads only after a seller chooses to load it and receives the exact map pin plus normal connection data such as an IP address.
- Google Maps: Optional external directions and map links. Google receives the destination and normal connection data only when a person chooses one of those links.
All service providers are bound by data protection agreements. Your shop's public catalog information (shop name, products, WhatsApp number) is intentionally made public as this is the core service — connecting buyers with sellers. If a seller confirms a business, collection, or showroom location, its street address and exact map pin are also public in the catalogue, directions links, and search metadata. Sellers should not enter a home address unless they are comfortable publishing it.
6. Data Retention
We retain your personal information for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law (e.g., financial records for SARS compliance).
Raw voluntary research-form responses are deleted within 90 days. Contact details in those responses are deleted when the requested follow-up is complete or within 90 days, whichever comes first. We may retain de-identified themes and aggregate counts for product planning.
HUNT requester details, the original request, participant identifiers, seller-routing records, offers, and the public reference image are scheduled for deletion 180 days after the HUNT begins. The scheduled cleanup may complete during the next retention cycle. We may retain de-identified funnel totals that cannot be used to contact or identify a requester.
Pseudonymous HUNT abuse-prevention counters expire after their short enforcement window and are removed during a subsequent retention cycle.
Email campaign delivery records are retained only as needed for delivery auditing, complaint handling, and legal compliance. Keyed suppression hashes may be retained after account deletion so that TradeFeed does not accidentally contact an address that unsubscribed; the suppression record does not store the raw email address.
7. Your Rights Under POPIA
You have the right to:
- Access: Request a copy of your personal information.
- Correction: Request correction of inaccurate information.
- Deletion: Request deletion of your personal information.
- Objection: Object to the processing of your information.
- Direct marketing: Withdraw email product-news consent at any time from notification settings or the unsubscribe link in the message. This does not disable essential account and order communications.
- Portability: Request your data in a machine-readable format.
To exercise any of these rights, contact us at privacy@tradefeed.co.za. We will respond within 30 days.
8. Cookies & Analytics
TradeFeed uses essential cookies for authentication and security. These remain available when you reject analytics. If you save a product or request a restock alert, start or join a HUNT while signed out, we also create a separate random buyer-feature cookie for up to 90 days. It lets TradeFeed recognise the HUNT creator, prevent duplicate joins, and find only that browser's saved items or requests. It is created on demand, is never used for advertising analytics, and is not shared with advertisers. Error reports may still be sent to Sentry so we can diagnose failures, but identifying request data, cookies, request bodies, query strings, and arbitrary form values are removed from those reports.
Non-essential measurement is denied by default. If you accept analytics, we enable our first-party catalogue analytics, Google Analytics 4 (GA4), Vercel Analytics, Vercel Speed Insights, and Sentry browser performance tracing. Sentry Session Replay remains disabled. Google advertising storage and personalisation remain disabled. Analytics URLs exclude query strings.
With consent, our httpOnly random visitor cookie can persist for up to 12 months so repeat anonymous visits can be counted consistently. It is not derived from your IP address and is not shared with advertisers. Rejecting or later withdrawing analytics consent removes this identifier and analytics cookies without clearing authentication data. You can change or withdraw your choice at any time below.
9. Security
We implement appropriate technical and organisational measures to protect your personal information, including: encrypted database connections (TLS), secure authentication via Clerk, HTTPS-only access, and role-based access controls.
10. Information Officer
Our Information Officer can be contacted at: privacy@tradefeed.co.za
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.
11. Changes to This Policy
We may update this privacy policy from time to time. We will notify registered users of material changes via email. The “Last updated” date at the top of this page indicates when the policy was last revised.