DropSpot
Privacy Policy
This explains what we know about you, why we have it, where it is kept and when we delete it. It is written under the Protection of Personal Information Act, 2013 (POPIA), so you can see how we meet that law — not so you have to survive a wall of jargon.
The short version. Your information lives on our own servers in Cape Town. Your private documents stay secured on our platform and are not shared with anyone outside DropSpot. When you delete your account, those documents are deleted straight away. We do not sell anything about you, we run no advertising trackers, and there is no analytics company watching you use the app.
Who is responsible
Drop Technologies (Pty) Ltd, registration number 2022/385818/07, of Pretoria, Gauteng, is the responsible party for your personal information under the Protection of Personal Information Act, 2013 (POPIA).
Our Information Officer can be reached at hello@dropsa.co.za.
What we collect, and why
| What | Why we have it |
|---|---|
| Name, email address, phone number, profile photograph | To run your account, and so the other side of a job knows who they are dealing with. |
| South African ID number, date of birth, identity document, selfie (Spotters) | To confirm you are who you say you are before you can work through us. Money and someone’s stock are involved, so this is not optional. |
| Company registration number, registration document, director’s ID, proof of address (businesses) | To confirm the business exists and that you may act for it. |
| The area you cover and a home or business location | To show you jobs near you, and to price a job by distance. |
| Location while you are working a job | To confirm you were where the flyers were handed out. Collected during an active job only, not in the background at other times. |
| Photographs of completed work | Proof for the business that the job was done, and evidence if there is a dispute. |
| Bank account details, card details | To pay you, or to charge for a job. Handled by our payment partner — see below. |
| Messages between you and the other party, and with our support desk | To let you arrange the job, and to answer you when something goes wrong. |
| Device model, app version, push notification token, error reports | To deliver notifications and to work out why the app failed when it does. |
We collect this because we need it to provide the service you asked for, to meet our legal obligations, and to keep the platform safe from fraud. Where the law requires your consent — for your location, and for notifications — the app asks, and you can withdraw it in your phone’s settings.
Your identity documents, specifically
These deserve their own section, because they are the most sensitive thing you give us. Under POPIA we must protect them with more care than ordinary account details.
- They are stored on our own servers, not with a third-party verification company.
- They sit in storage that refuses to hand out a public link. Staff can only open them through a logged-in session, and every view is recorded.
- Only DropSpot staff whose role includes reviewing verifications can open them.
- Every uploaded file is scanned for malware and re-encoded before it is stored.
- When you replace a document, the old one is deleted, not left behind.
- They are never used for advertising, never sold, and never shared with another business or with the other side of a job.
- When you delete your account, these documents are deleted immediately with it.
Who else sees your information
Only three kinds of people, and no advertisers.
- The other side of a job. A business sees the name, photograph, rating and work of the Spotter it hired, and a contact number while the job is running. A Spotter sees the business, the collection address and a contact. Neither sees the other’s identity documents. People who are not working together on a job cannot see each other’s contact details at all.
- Paystack, our payment provider, licensed in South Africa. Card details and bank account details go to them, not to us — we never see or store a full card number, and we keep only a reference that lets us pay you.
- Google (Firebase), which handles signing in and delivers push notifications. They receive your email address or phone number for sign-in, and the text of a notification when we send one.
We may also hand over information if the law requires it — a court order, or a police investigation into fraud on the platform.
We do not sell your personal information, and we never will. There is no advertising network, no analytics company and no data broker involved in DropSpot.
Where your information is kept
Our database, our servers and every file you upload are hosted in Cape Town, South Africa (Amazon Web Services, af-south-1 region). Your identity documents, your photographs and your messages do not leave the country.
Two exceptions, which POPIA requires us to be explicit about, because these companies process data outside South Africa:
- Google (Firebase) — sign-in and push notifications. Google is bound by data protection commitments that meet POPIA’s standard for sending information abroad.
- Paystack — payments. Paystack operates in South Africa and is subject to South African financial regulation, with some processing outside the country.
Google Maps also receives location information from your device when you use a map in the app, in the same way it does in any other app.
How we protect it
- Everything travels over an encrypted connection (TLS 1.2 or better). The disks holding the database and your files are encrypted.
- Passwords are stored as a scrypt hash. Nobody at DropSpot can read your password.
- Uploads are scanned for malware and re-encoded, so a file cannot carry something harmful into our systems or yours.
- Staff access is limited by role: a support agent can help you with a ticket without being able to move money or manage other staff. Every action a staff member takes is logged.
- The database is backed up nightly, and backups are kept for 30 days.
No system is perfect. If your personal information is ever compromised, POPIA requires us to notify you and the Information Regulator, and we will.
How long we keep it
| Information | Kept for |
|---|---|
| Your account, name and contact details | Until you close your account, then removed immediately |
| Profile photograph, business logo, support attachments | Deleted when you close your account |
| Bank and card links | Deleted when you close your account |
| Identity documents, selfie, ID number | Deleted immediately when you close your account |
| Job records, payments and invoices | 5 years, as tax law requires. These stop being linked to your name once your account is closed. |
| Photographs of completed work | Kept with the job record, as the business’s proof that it was done |
| Support conversations | 2 years |
| Backups | 30 days, after which deleted information is gone from those too |
Your private verification documents exist only while your account does. Closing the account deletes the files and the ID number we held for verification. Job, payment and tax records that the law requires us to keep stay on file, but they are no longer linked to your name or contact details.
Your rights
Under POPIA you may:
- See what we hold about you — ask us and we will send it.
- Correct anything wrong — most of it you can edit yourself in the app.
- Delete your account — from Settings → Delete account in the app, or on our delete your account page. This is immediate and cannot be undone.
- Object to how we use your information, and to turn off announcements while still receiving messages about your jobs.
- Complain — to us first, and to the Information Regulator if we do not put it right.
We answer requests within 30 days and we do not charge for them.
Children
DropSpot is for people aged 18 and over. We do not knowingly hold information about children, and we delete it if we discover we have.
Changes to this policy
If we change something that materially affects you, we will tell you in the app before it takes effect. The version number and date at the top of this page always show which version is current.
Contact us, or complain
Anything about your information, or this policy: hello@dropsa.co.za, or open Settings → Get Help in the app.
If we have not resolved it, you may complain to the regulator:
The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg 2001
complaints.IR@justice.gov.za ·
inforegulator.org.za
© 2026 Drop Technologies (Pty) Ltd. All rights reserved.