Privacy Policy

This Privacy Policy explains how RESOURCERPRO (PTY) LTD, trading as Sociaal ("Sociaal", "we", "us", or "our") collects, uses, stores, shares, and protects your personal information. It applies to all users of our platforms, including sociaal.co.za and sca.al (collectively, "the Platform").

We are committed to processing your personal information lawfully, and in accordance with the Protection of Personal Information Act, No. 4 of 2013 ("POPIA") and, where applicable, the Consumer Protection Act, No. 68 of 2008 ("CPA").

Please read this Policy carefully. By using the Platform, you acknowledge that you have read and understood how we handle your personal information. If you do not agree with this Policy, you should stop using the Platform immediately.

Part A — Who We Are and How to Contact Us

1. About Sociaal

Sociaal is a South African creator monetisation platform. We connect content creators with their fans and brands. Our services include link-in-bio profile pages, fan tipping and subscription management, digital product sales, a campaign marketplace connecting creators with brands, a creator directory, short-link management (via sca.al), and content performance analytics.

2. Our Details

Responsible Party (as defined in POPIA):
RESOURCERPRO (PTY) LTD (registration number 2024/424902/07), trading as Sociaal
4 Eastwood Avenue, Randpark Ridge, Johannesburg
South Africa

Information Officer:
Darko Arnautovic
Email: privacy@sociaal.co.za
Telephone: 072 956 6923

The Information Officer is the person designated in terms of POPIA to ensure that Sociaal complies with its obligations under the Act.

3. The Information Regulator

You have the right to lodge a complaint with South Africa's supervisory authority:

Part B — What Personal Information We Collect

We collect different categories of personal information depending on how you use the Platform and what role you hold (creator, fan, or brand).

4. Account Information

Collected from all registered users: full name, email address, password (stored as a one-way cryptographic hash — we never store your actual password), phone number (where provided), account creation date, and your role on the Platform (creator, fan, or brand).

5. Profile Information

Collected from creators who set up a public profile: display name or username, profile biography, avatar or photo, social media handles, location (if voluntarily provided), website URL, custom link-in-bio content, and theme and display preferences.

6. Financial Information

Collected from creators who receive payouts and from fans or brands who make payments: bank account details (for payout disbursement), transaction history, payout records, payment method tokens (managed by Paystack — we do not store full card numbers), and VAT registration number (for brands, where applicable).

7. Creator Data

Uploaded content (videos, images, digital products), earnings and revenue data, subscriber lists, campaign participation history, creator score, and CSV export records.

8. Brand Data

Company name, company registration number, campaign briefs and creative requirements, campaign spend history, creator relationship history, and contact person details.

9. Fan Data

Subscription history, purchase history, tip history (amounts and recipients), and watchlist and favourite creators.

10. Connected Social Platform Data (via InsightIQ)

Creators can choose to connect their Instagram, TikTok or YouTube account so that Sociaal can show verified audience figures on their dashboard, public media kit and directory listing. This is entirely optional.

How the connection works. Connections are made through InsightIQ (operated by Phyllo Inc., USA), a creator-data service we use as a processor. When a creator taps "Connect", an InsightIQ window opens in which the creator logs in to the social platform and grants permission. The login happens between the creator, InsightIQ and the social platform: Sociaal never sees or stores the creator's social media password or access token. InsightIQ holds the permission and uses it, on the creator's behalf, to read the data below and pass it to us. Sociaal only asks InsightIQ for the "identity" and "engagement" data sets; we do not request income, activity or content-publishing access.

What we receive and store:

• Profile information: username (handle), display name, profile picture, follower count and the platform the account is on.
• Recent content and engagement: links, thumbnails, captions and dates of recent public posts (up to the latest 30), with their like, comment and view counts, from which we work out an engagement rate.
• Audience breakdown: the percentage of the account's audience by country, city, age group, gender and language, as supplied by InsightIQ. These are aggregate percentages only; we never receive information about individual followers.
• Connection records: InsightIQ's reference numbers for the creator and the connected account, and the dates the account was connected and disconnected.

We do not: post, edit or delete anything on a connected account; read private messages; access private, archived or draft content; or pass connected-account data to anyone other than as described in this Policy. Brands using our directory see the verified figures and public post links; they do not receive the creator's InsightIQ records.

How we use it: to display verified metrics on the creator's dashboard and public media kit, to calculate the engagement score used to rank the creator directory, and to give brands verified creator analytics when considering a campaign. InsightIQ may also notify us automatically when a connected account's figures change, so that we can refresh them.

Disconnecting and deletion. A creator can disconnect an account at any time under Dashboard → Social Accounts. We then ask InsightIQ to revoke the connection, and no new data is collected. The figures and post snapshots already stored are kept so that the creator's historical trend remains visible, and are deleted on request by emailing privacy@sociaal.co.za, or automatically when the Sociaal account is deleted. A creator who revokes Sociaal's or InsightIQ's access from inside the social platform itself (for example Instagram → Settings → Apps and Websites) achieves the same result. InsightIQ's own handling of the data it holds is governed by its privacy policy at getphyllo.com/privacy-policy.

11. Technical and Usage Data

Collected automatically: IP address (stored in hashed form only), browser type and version, device type and operating system, referring URL, pages visited and links clicked on sca.al, session duration, and user agent string (stored in hashed form).

12. Cookie and Authentication Data

JWT authentication token stored in an httponly cookie on your browser after login, and session state data.

Part C — Why We Collect Your Personal Information

12. Purposes of Processing and Lawful Basis

We only collect and use your personal information for specific, legitimate purposes:

Part D — How We Share Your Personal Information

13. We Do Not Sell Your Data

We do not sell, rent, or trade your personal information to third parties for their own marketing or commercial purposes.

14. Service Providers (Operators)

14.1 Paystack Payments Africa Ltd
Role: Payment processing and disbursement. Data shared: name, email, payment details, transaction amounts. Paystack is PCI-DSS certified.

14.2 Cloudflare, Inc.
Role: Content delivery network (CDN), media hosting (Cloudflare Stream), and DDoS protection. Data shared: IP addresses (in transit), uploaded media files, web traffic.

14.3 Email Service Provider
Role: Transactional email delivery. Data shared: name, email address, and content of transactional notifications.

14.4 Google LLC
Role: Website usage analytics (Google Analytics 4). Data shared: pages visited, the website or search that referred you, approximate location (city level), device and browser type, and a randomly generated analytics cookie identifier. We use this only in aggregate, to understand which pages are useful and how people find Sociaal. Google Analytics' advertising features are switched off.

14.5 Phyllo Inc. (InsightIQ)
Role: Social account connection and verified creator analytics (see section 10). Data shared: the creator's Sociaal user reference and display name (so InsightIQ can create a matching record), and the creator's own login to the social platform, which is given directly to InsightIQ and never to us. Data received: profile figures, recent public posts with engagement counts, and aggregate audience percentages. Phyllo is SOC 2 Type II certified and states GDPR and CCPA alignment.

15. Legal Disclosure

We may disclose your personal information to law enforcement agencies, courts, or government authorities when required by law or valid legal process, or when we believe disclosure is necessary to protect the rights, property, or safety of Sociaal, our users, or the public.

16. Tax Reporting

Sociaal is not a tax agent and does not submit tax filings on behalf of creators. Creators are solely responsible for declaring their own income to SARS. We provide CSV data exports to assist you. You should consult a tax professional regarding your obligations.

Part E — Cross-Border Transfers

17. Processing Outside South Africa

POPIA Section 72 restricts the transfer of personal information to countries outside South Africa unless adequate protections are in place. Some of our service providers operate data centres outside South Africa:

• Cloudflare, Inc. — Headquartered in San Francisco, USA. Data may be processed in data centres outside South Africa. Cloudflare maintains standard contractual clauses.
• Google LLC — Headquartered in Mountain View, USA. Google Analytics data is processed in data centres outside South Africa under Google's data processing terms.
• Phyllo Inc. (InsightIQ) — A United States company. Connected-account data is processed and stored on its infrastructure, which may be in the United States, and is shared with its own sub-processors (such as cloud hosting) under its privacy policy. Phyllo holds SOC 2 Type II certification.
• Paystack Payments Africa Ltd — Operates primarily in Africa. Transaction data may be processed on infrastructure outside South Africa.

We take reasonable steps to ensure cross-border transfers are subject to enforceable protections substantially equivalent to POPIA's.

Part F — How Long We Keep Your Information

18. Data Retention

Part G — How We Protect Your Information

19. Security Measures

Technical safeguards:

• All data transmitted between your browser and our servers is encrypted using HTTPS (TLS 1.2 or higher)
• Passwords are stored as one-way cryptographic hashes (bcrypt)
• JWT authentication tokens are stored in httponly cookies, preventing access by client-side scripts
• IP addresses used for click analytics are hashed using a daily-rotating salt — the original IP is never stored
• Cloudflare provides DDoS protection and WAF at the network perimeter
• Payment card data is never stored on our servers — all card processing is handled by Paystack (PCI-DSS certified)

Organisational safeguards:

• Access to personal information is restricted on a need-to-know basis
• Staff handling personal information are subject to confidentiality obligations

No system is completely secure. If you believe your account has been compromised, contact us immediately at privacy@sociaal.co.za.

Data breach notification: In the event of a security compromise likely to prejudice you, we will notify you and the Information Regulator as required by POPIA Section 22.

Part H — Cookies and Tracking

20. Cookies and Tracking Technologies

20.1 Cookies Needed to Run the Platform

When you log in, we set an httponly, Secure cookie containing a signed JSON Web Token that keeps you logged in for up to 7 days. A standard session cookie protects forms against cross-site request forgery and carries one-page messages. If you tick "Remember this device" when entering a login code, a further httponly, Secure cookie identifies that browser for 30 days so you are not asked for a code again on it; it is deleted when you change your password or email address. Your answer to the cookie banner is kept in your browser's local storage, not in a cookie. None of these can be used for cross-site tracking. We do not use advertising cookies, third-party tracking pixels, or behavioural retargeting cookies.

20.2 sca.al Click Tracking

When someone clicks a short link on sca.al, we record the time, target link, referring URL, and a hashed version of the user agent and IP address. The hashing uses a daily-rotating salt combined with an application secret — the raw IP address is never stored. This means we can detect duplicate clicks within a single day but cannot re-identify visitors across days.

20.3 Page View Beacons

Public creator profile pages send a lightweight page view beacon to record aggregate page views. No personally identifying information is sent in the beacon payload.

20.4 Website Analytics (Google Analytics)

We use Google Analytics 4 to measure how our website is used in aggregate: which pages are visited, how people arrive (for example from a Google search), and roughly where they are (city level). It sets first-party cookies (named _ga and _ga_*) to tell visits apart. We have switched off Google Analytics' advertising features, including Google Signals and ad personalisation, and we do not use analytics data for advertising. If you press Decline on our cookie banner, Google Analytics is not loaded at all on this browser. You can also block these cookies in your browser settings or install Google's opt-out add-on at tools.google.com/dlpage/gaoptout.

20.5 No Advertising Tracking

We do not embed the Meta (Facebook) Pixel, Google Ads tags, TikTok Pixel, or any other advertising, retargeting or behavioural advertising technology on our Platform.

Part I — Your Rights as a Data Subject

21. Your Rights Under POPIA

You can exercise these rights by contacting our Information Officer at privacy@sociaal.co.za. We will respond within 30 days.

• Right to Access (Section 23): Ask whether we hold personal information about you and request a copy.
• Right to Correction (Section 24): Request correction of inaccurate, incomplete, or misleading information.
• Right to Deletion: Request deletion where the information is no longer necessary, consent is withdrawn, or processing was unlawful.
• Right to Object (Section 11(3)): Object on reasonable grounds to processing based on legitimate interest.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw at any time without affecting prior processing.
• Right to Complain: Lodge a complaint with the Information Regulator (see Section 3 above).

How to exercise your rights: Email privacy@sociaal.co.za with subject line "Data Subject Rights Request — [Your Name]". We may verify your identity before processing.

Part J — Direct Marketing

22. Direct Marketing and Opt-In Consent

We will only send you direct marketing communications where you have given explicit prior consent, as required by POPIA Section 69.

Transactional emails are not marketing: Emails necessary for account operation (subscription confirmations, payout receipts, password resets, campaign updates) are sent as part of our contractual obligations.

Opting out: Unsubscribe via the link in any marketing email, update your notification preferences in account settings, or email privacy@sociaal.co.za. We will process your opt-out within 5 business days.

Part K — Automated Decision-Making

23. Creator Scoring and Algorithmic Matching

What it is: A numerical rating calculated automatically based on your Sociaal account data, used to rank and recommend creators to brands in the campaign marketplace.

Inputs: Social media follower counts, profile completeness, campaign performance history, platform activity consistency, and content category.

How it affects you: The score influences visibility in brand search results and campaign invitations. It does not affect access to other features (tipping, subscriptions, link-in-bio).

Your rights: Request a description of how your score is calculated (privacy@sociaal.co.za), request human review of any decision, or opt out of the marketplace entirely through your account settings.

Part L — Children

24. Children and Minors

The Platform is intended for users who are 18 years of age or older. Users between 16 and 17 may access the Platform only with verifiable consent of a parent or legal guardian (POPIA Section 35). We do not knowingly collect personal information from children under 16. If we become aware of such collection, we will delete it promptly.

Part M — Platform-Specific Disclosures

25. sca.al Short-Link Service

sca.al is a companion service to sociaal.co.za providing short-link redirection and public creator profile pages. Click data is recorded as described in Section 20.2. Public profile pages are visible to anyone on the internet — information you add to your public profile is genuinely public. Tip button links use HMAC cryptographic signatures to prevent tampering.

26. Cloudflare Stream Video Hosting

Videos uploaded to the Platform are hosted on Cloudflare Stream. Cloudflare may log viewer IP addresses at the CDN level for delivery and security purposes. We do not have access to viewer-level playback logs.

Part N — General Provisions

27. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated Policy with a revised "Last Updated" date and send a notification to your registered email at least 14 days before the changes take effect.

28. Complaints and Disputes

If you have a concern about how we have handled your personal information, contact our Information Officer at privacy@sociaal.co.za. We will investigate and respond within 30 days. If unsatisfied, you may escalate to the Information Regulator.

29. Governing Law

This Privacy Policy is governed by the laws of the Republic of South Africa.

30. Definitions

• "Personal information" — as defined in POPIA Section 1
• "Processing" — any operation performed on personal information
• "Responsible party" — RESOURCERPRO (PTY) LTD, trading as Sociaal
• "Operator" — a third party processing data on our behalf (e.g., Paystack, Cloudflare)
• "Data subject" — you, the individual whose information is processed
• "POPIA" — Protection of Personal Information Act, No. 4 of 2013
• "Information Regulator" — the regulatory authority established under POPIA