Privacy Policy

We collect and process:

• Your phone number, used to link you to groups you're invited to and to identify you to other members.
• Your display name, what co-members in your groups see you as. You can change it at any time from your profile settings.
• Payment status, whether you've paid, and when, for each group you're part of.
• Account details, your email address (used to sign in) and, if you organise a group, your bank account details for payouts.

We don't currently collect anything beyond this. If that changes, for example if we start capturing additional evidence around a payment to help resolve disputes, we'll update this policy first.

Other members of your group. Your display name and payment status are visible to co-members within that specific group only, which is necessary for the app to work, since a group needs to see who's paid.

Our payment gateway, Paystack. Card details and payment status pass through Paystack to process your payment. We don't see or store your card details ourselves.

Service providers who run CoPay for us. Supabase (database, sign-in and file storage), Vercel (application hosting), and our transactional email provider. Under POPIA these are operators: they process your information on our instruction only, under written agreements, and may not use it for their own purposes.

We don't sell your information, and we don't share it outside of these three cases.

Our database and application servers are hosted in the European Union (Ireland). This means your personal information leaves South Africa and is stored abroad.

POPIA permits this where the destination country's law provides a level of protection substantially similar to POPIA's own (Section 72). The European Union's General Data Protection Regulation does, and our hosting providers are contractually bound to protect your information on the same terms set out in this policy.

Paystack processes South African card payments on South African infrastructure and is regulated locally.

Access to your information is restricted to what the app needs to work, and your bank account number is encrypted before it is stored, so that reading our database is not by itself enough to recover it.

No system is perfectly secure. If your personal information is ever accessed by someone who shouldn't have it, POPIA requires us to notify both you and the Information Regulator, and we will.

If someone adds you to a group before you've created a CoPay account, we hold your phone number for the sole purpose of sending you the invite. It isn't used for marketing, analytics, or cross-referenced with anything else. If you don't sign up, that number is purged or hashed after 30 days.

Under POPIA, you have the right to:

• Access the personal information we hold about you (Section 23);
• Ask us to correct or delete it, subject to what we need to keep for legal or accounting reasons (Section 24);
• Object to our processing of your information where it relies on legitimate interest, such as peer visibility of your display name and status within a group (Section 11(3)).

To exercise any of these, contact us, see our Contact page.

If you believe we've handled your information incorrectly, you can raise it with us directly, or lodge a complaint with the Information Regulator of South Africa at complaints.IR@inforegulator.org.za.

CoPay is operated by KLOPPER GROUP t/a COPAY. Our Information Officer is Marco Jan Klopper, reachable at support@copay.money. Registered with the Information Regulator of South Africa under Information Officer registration certificate no. 2026-065010.

We may update this policy as the app changes. We'll update the date at the top of this page when we do.