Privacy Notice

Stkvel ("we", "us", or "our") operates the Stkvel platform for running stokvel and savings groups. This Privacy Notice explains what personal data we collect, why we collect it, how we use it, and the choices and rights available to you.

1. Who is the data controller

Stkvel, the legal entity operating the Stkvel platform, is the data controller responsible for personal data processed through the service, except where processing is carried out on your behalf as a member of a group you administer, in which case the group organiser may also act as a controller for their group's records.

2. What we collect and why

• Account information — name, email address, password hash, avatar — to create and secure your account, sign you in, and communicate with you.
• Group and member data — group name, roles, contribution amounts, due dates, payout schedules, and notes you enter — to provide the core service.
• Communications — messages you send us, support requests, feedback — to respond to you and improve the service.
• Usage and device information — IP address, browser type, pages visited, error logs, and similar telemetry — for security, fraud prevention, debugging, and product improvement.
• Cookies — see the Cookies section below.

3. Legal bases

Where applicable data protection law requires a legal basis, we rely on: (a) performance of a contract with you (to provide the service you request); (b) our legitimate interests (to secure the service, prevent fraud, and improve our product); (c) consent (for optional communications or non-essential cookies, where applicable); and (d) legal obligation (for example to comply with tax, accounting, or law-enforcement requirements).

4. How we share personal data

We share personal data with:

• Service providers and subprocessors we use to run the platform, including hosting, database, email delivery, analytics, and customer support tooling. These providers process data on our behalf under written agreements.
• Paddle, our Merchant of Record for paid subscriptions. Paddle processes purchases, subscription management, billing, tax, invoicing, and related customer service inquiries. Paddle's use of personal data is governed by their own privacy policy.
• Professional advisers such as auditors and legal counsel, on a need-to-know basis.
• Authorities where we are required by law, legal process, or to protect the rights, property, or safety of Stkvel, our users, or the public.

We do not sell personal data.

5. International transfers

Some of our service providers may process personal data outside your country. Where such transfers occur from the UK/EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

6. How long we keep data

We retain personal data for as long as your account is active and for a reasonable period thereafter to comply with legal obligations, resolve disputes, and enforce our agreements. When personal data is no longer needed, we delete or anonymise it.

7. Your rights

Depending on where you live, you may have rights to access, correct, delete, or restrict processing of your personal data, to object to certain processing, to portability, and to withdraw consent. UK and EEA users additionally have the right to complain to their local supervisory authority. We will respond to verified requests within the timeframes required by law (typically one month under GDPR).

8. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, restricted access controls, and monitoring. No system is perfectly secure — please help us keep your account safe by choosing a strong password and telling us immediately if you suspect unauthorised access.

9. Cookies

We use a small number of essential cookies and similar technologies to keep you signed in and to make the app work. We do not use advertising cookies. If we introduce analytics or marketing cookies in the future, we will update this notice and, where required, ask for your consent.

10. Children

Stkvel is not directed to children under the age of 16, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to this notice

We may update this Privacy Notice from time to time. If we make material changes we will provide reasonable notice through the service or by email.

12. Contact

For privacy questions or to exercise your rights, please contact us via the support address listed in your account.