Intwined privacy policy

Who we are

Intwined (Pty) Ltd operates Intwined, a South African platform with two sides: a public marketplace where anyone can discover local businesses, and a private workspace where those businesses run their operations.

Under the Protection of Personal Information Act, 2013 (POPIA), responsibilities depend on who determines the purpose and means of processing. Intwined is the responsible party for its own platform purposes, such as accounts, service support, security, usage measurements and platform billing. Where a business uses Intwined to store or manage its own customers, staff and business records on its instructions, that business is the responsible party and we act as its operator for that processing.

Information used by a listed business

A business you contact or purchase from is responsible for its own customer relationship, including the information it uses to prepare quotes, fulfil orders, deliver services, keep customer records or conduct permitted marketing. Its own privacy notice must explain those uses; Intwined's notice does not stand in for it.

Direct requests about a seller's customer records or use of your information to that business. Direct requests about your Intwined account, platform activity or information we process for our own purposes to Intwined. If a request concerns records we hold only on a business's behalf, we will assist the responsible business as appropriate rather than treating its instructions as permission to ignore your rights.

Intwined must still apply appropriate safeguards to information it hosts or processes and fulfil its applicable obligations, including when acting as an operator. Neither a business's policy nor this policy transfers away duties that the law places on us.

Information we collect

What we hold depends on how you use the platform.

• Browsing the marketplace: no account is required. We count visits and page activity using first-party visitor and short-lived session identifiers. The database stores hashed identifiers, page paths, daily counts and activity timestamps. When you are signed in, a visit may also be associated with your account ID. These records help us understand site use and improve the service; they are not completely anonymous.
• Messaging a business: you can send an enquiry without signing in by leaving your name and contact details. We share the message and those details with the receiving business so it can respond. For signed-in conversations we use your account identity and also keep the conversation in your customer hub.
• Business accounts: name, email address, and a hashed password. We never store passwords in a readable form.
• Business profile: trading name, category, description, city, storefront copy, brand colours, logo and banner images, and the products and services published to the storefront.
• Operational records a business chooses to enter: customers, quotes, invoices, payments, bookings, orders, jobs, stock, suppliers, staff records and uploaded documents.
• Sensitive information you or a business choose to provide: enquiries or bookings with healthcare and wellness providers, or employment and leave records, may contain health-related information. We use and disclose this information only for the requested service, the responsible business's authorised instructions, support and applicable legal obligations. Intwined does not provide diagnoses or medical advice. Avoid including clinical details or sensitive documents unless the receiving business needs them and has explained how it will handle them.
• Technical records: session cookies to keep you signed in, a CSRF token cookie to protect form submissions, and an audit log of significant actions taken inside a business workspace.
• Support requests: messages and any attachments you send to the Intwined team, together with the account or contact details needed to respond and investigate the issue.
• Platform payments, when enabled: the business and buyer details needed for checkout, the amount, transaction reference, payment status and any provider subscription reference. Card details are entered on the payment provider's hosted checkout, not in an Intwined card-entry form.

The Intwined mobile app

The Android app connects to this same Intwined service through your device's browser. The account, messages, saved businesses and work records you use in the app are shared with the website. The app collects the information described in this policy when you use those features; browser delivery does not make that collection anonymous or exempt from this notice.

We store the businesses you choose to save, the version and date of community guidelines you accept, and any blocking choices or reports you submit. Blocking records are used to prevent further messaging between the customer and business. Reports and the relevant account, business and conversation references are available to authorised Intwined support staff for investigation. Messages are protected in transit by HTTPS, but are not end-to-end encrypted: the service processes them and authorised support may access relevant content to handle abuse or support requests.

Unsent conversation text may be kept in your browser's session storage so you can recover it during that browser session. The app clears its private local drafts when it detects sign-out or an account change. Its offline cache contains a generic connection-help page, not your private messages or business records. A session cookie named intwined_play identifies a Google Play launch and controls which platform-purchase routes are available in that browser session.

The Android package does not request access to your location, contacts, SMS, microphone or broad device storage. If you choose to attach a file, the browser or system picker lets you select the item to upload. Search locations are supplied by you, not read from GPS. Background phone notifications are not enabled in this release.

Deleting your Intwined account

You can request deletion from Account > Request account deletion in the mobile app, or through the public account-deletion page linked below. If you cannot sign in, contact info@intwined.co.za from your account email address. We verify ownership before processing the request. The request applies to the shared website and mobile account and associated personal data; it is not completed by merely disabling access.

Support reviews business ownership and records held on a business's instructions before processing deletion, so that another person's records or an organisation's lawful records are not removed without authority. We delete or de-identify account data that we no longer have grounds to keep. Where specific records must be retained for a legitimate legal, security or fraud-prevention purpose, support explains the category, reason and applicable retention period in its response. Removing the app from your phone alone does not delete the account.

Request account and data deletion

Business registration identity

When you register a new business, Intwined requires your own South African ID number as its owner or authorised representative. This supports our legitimate interests in business accountability and investigating suspected fraud, with safeguards for your rights. It is an Intwined collection requirement, not a claim that every marketplace is legally required to collect IDs. Without it, the current business-registration flow cannot be completed. Customers do not need to provide an ID to browse or message a business.

We validate the number's structure, date and checksum. We do not use it to infer a marketing profile, and no Home Affairs lookup or independent identity matching takes place through this registration check. An ID can be stolen or incorrectly supplied; capture is not proof that the person or business is legitimate.

The full number is encrypted before it is stored in our database. It is not included in public listings, customer messages or ordinary workspace responses. Platform administrators see a masked reference showing only its last four digits. Access to the complete record is restricted to authorised operational handling for an identity request, an investigation or a lawful disclosure; there is no full-ID display in the admin portal. We do not send this ID to Payfast or other businesses as part of registration.

Identity information is kept while needed for the active business and a documented lawful accountability or investigation purpose. When that purpose ends, it must be deleted or de-identified unless a specific legal retention ground applies. You may ask us to explain the retention ground, correct the record, delete information we no longer need, or consider an objection to this use. Contact Intwined using the contact details below; do not email your full ID number or an ID-document copy. No ID-document upload is required by this flow.

Why we use it

• To show the marketplace and let people find and contact local businesses.
• To understand visits, sign-up activity and use of the platform using our own first-party usage measurements.
• To deliver an enquiry to the business it was addressed to.
• To operate business workspaces and keep each business's data separate from every other business's.
• To authenticate users, protect accounts, and investigate abuse or fraud.
• To keep an audit trail of consequential actions, which we need for security and for resolving disputes.
• To communicate about the service itself, such as verification and password reset emails.

What we do not do

• We do not sell personal information.
• We do not build advertising profiles, and we do not run third-party advertising or tracking scripts on the marketplace.
• We do not read the contents of a business's records to market to their customers.
• We do not require a customer account to browse or to contact a business.

Who your information is shared with

• The business you contact. An enquiry reaches only the business it was sent to.
• Service providers who host the platform and its database, and who deliver our email. They act on our instructions and may not use the data for their own purposes.
• Our configured payment provider, such as Payfast, when you choose a paid subscription or featured placement. We send the buyer name and email, amount and transaction references needed to process it. The provider also processes information under its own privacy and legal obligations. Its privacy notice is available on its checkout.
• Authorised Intwined support staff when handling a support request or investigating an issue. Workspace assistance is subject to access controls and auditing; business records are not public merely because support is available.
• Law enforcement or regulators, where we are legally required to disclose.
• A successor, if the business is sold or merged, on the same terms set out here.

How long we keep it

Enquiries sent to a business are kept for as long as that business keeps them, since they form part of that business's customer records. Business account and operational records are kept while the account is active, and for a period afterwards where tax or company law requires it. Audit records are kept for security purposes. You may ask us to delete information sooner and we will do so unless we are legally required to keep it.

Optional Intwined help assistant

The assistant searches published Intwined listings, returns approved how-to guidance, and calculates workspace summaries from sections a signed-in business user is permitted to access. These functions work without sending business records to an AI provider. It does not take actions on your behalf. Intwined does not save assistant questions, results or drafts as a conversation record; visible content stays in this browser tab until cleared, closed or replaced. Copying a draft places it on your device clipboard, which you control.

Paid AI capabilities require administrator activation and a separate user opt-in. How-to matching may send a signed-in user's question, previous help-topic identifier and approved topic summaries to OpenAI. If separately enabled, visitors including guests can opt in to AI interpretation of their search question; the model returns filters, while Intwined supplies the actual published listings. Permitted business users can opt in to send a short brief for a private AI draft. Drafts may contain mistakes and must be reviewed before use. We do not automatically add account details, customer records, staff files, identity documents or financial records to provider requests. Do not put passwords, identity numbers, contact details or payment-card information in a question or brief; automated checks cannot detect every kind of sensitive information.

We request that the API response not be saved as OpenAI application state. This is not a promise of zero provider retention: OpenAI may retain API inputs and outputs in abuse-monitoring logs under its applicable data controls, typically for up to 30 days, with exceptions. Provider processing may take place outside South Africa. You can leave AI off and continue using direct marketplace search, permitted workspace summaries and the approved help guide.

For rate limiting and usage caps, Intwined stores counters keyed to a daily hash of an account identifier or network address, without the raw address or question text. Request counters expire after one hour and AI quota counters after 35 days; expired rows are cleaned up on subsequent assistant requests. Administrator changes to assistant controls and announcements are audited without API keys or question text.

Your rights

Under POPIA you may:

• Ask what personal information we hold about you and request a copy.
• Ask us to correct anything inaccurate or incomplete.
• Ask us to delete information we no longer have grounds to keep.
• Object to a particular use of your information.
• Complain to the Information Regulator of South Africa if you believe we have handled your information unlawfully.

Security

• Passwords are hashed, never stored in a readable form.
• Account sessions use HTTP-only cookies, and form submissions carry a CSRF token. Payment card details are submitted to the hosted payment provider; Intwined does not store full card numbers or card security codes.
• Uploaded files are checked against their actual file signature, not just their filename, so a disguised file is rejected.
• Every workspace request is checked against the tenant it belongs to, so one business cannot read another's records.
• Consequential actions inside a workspace are written to an audit log.
• No system is perfectly secure. If a breach affects your personal information we will notify you and the Information Regulator as POPIA requires.

Cookies

Essential cookies keep you signed in and protect forms against cross-site request forgery. We also use first-party measurement cookies: intwined_visitor lasts up to 365 days, and intwined_session lasts up to five minutes. These measurement cookies are separate from your account sign-in cookie. Hashed versions are used to count visits and activity, and can be linked to your account while signed in.

We do not use third-party advertising cookies. Your browser lets you clear or block cookies; blocking essential cookies can prevent sign-in or form submission. You can contact us about personal information associated with your account and exercise the rights described above.

Children

The platform is intended for people running or buying from businesses. We do not knowingly collect information from children under 18 without the consent of a parent or guardian. If you believe we have, contact us and we will remove it.

Changes to this policy

If we change this policy we will update the date at the top, and where the change is significant we will tell account holders directly before it takes effect.