Legal
Privacy Policy
How Lukilly collects, uses and protects your personal information under the Protection of Personal Information Act 4 of 2013 (POPIA).
1. Who is responsible for your information
The responsible party is [PLACEHOLDER: company name] (registration number [PLACEHOLDER: registration no]), [PLACEHOLDER: address], trading as Lukilly.
Information Officer: [PLACEHOLDER: information officer name], [PLACEHOLDER: information officer email]. Deputy Information Officer: [PLACEHOLDER: deputy name and email, if any]. Our PAIA manual is available at [PLACEHOLDER: PAIA manual link].
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account | Google account ID, name and email address. We never receive your Google password. | Google sign-in |
| Profile | Display name, role (Customer or Provider), suburb, city and province, provider service radius, verification status, and the version and time of the Terms and Privacy Policy you accepted. | You |
| Approximate location | An approximately 1 km grid point, short geohash and the time you consented. See section 3. | You, your browser (with permission) |
| Private address | An optional exact address for a job, stored separately from the public job. | You |
| Jobs and quotes | Job title, category, description, urgency and budget; quote amounts and messages. | Customers and providers |
| Chat | Messages exchanged about a job, with timestamps. | Job participants |
| Identity verification (providers) | SA ID number, identity document images, selfie and liveness check. A face scan is biometric information, which is special personal information under POPIA. Didit processes these; we store the result and status. | You, through Didit |
| Trade documents (providers) | Certificates and registrations you choose to upload (upload is coming soon). | You |
| Payments (coming soon) | Amounts, fees, PayFast transaction references and status; provider payout bank details. Card details are entered on PayFast and never reach Lukilly. | You, PayFast |
| Technical | IP address, browser type, sign-in tokens, server and error logs. | Your device |
| Support and disputes | Emails, evidence and decisions. | You and the other party |
3. Location
- Precise GPS stays in your browser. When you tap "Use my location", your browser asks for permission. Our code rounds the result to about 1 km before anything is sent to our server or our area-lookup service. We never store precise GPS.
- If you decline, you can choose an area by name instead.
- Job areas are visible to providers and job participants. In a sparsely populated place, a coarse area may still identify you, so it is not anonymous.
- Your exact address (optional) is only visible to you and to the provider whose quote you approve. Administrators do not have blanket access to addresses.
- You can revoke browser location permission at any time and change your saved base area in Profile. This does not change locations on jobs you already posted.
4. Why we use your information, and the legal basis
| Purpose | Lawful basis (POPIA section 11) |
|---|---|
| Create and secure your account; sign you in | Necessary to perform our contract with you |
| Match jobs with nearby providers, show quotes, enable job chat | Contract; consent for location |
| Share your exact address with the provider you approve | Contract, at your instruction |
| Verify providers' identity (including biometrics through Didit) | Your consent; legitimate interest in keeping customers safe |
| Process payments, fees and payouts (coming soon) | Contract; legal obligations (tax and financial records) |
| Handle disputes, prevent fraud and abuse, enforce our Terms | Legitimate interest; legal obligations |
| Keep the service working and secure (logs, error reports) | Legitimate interest |
| Send service messages about your jobs and account | Contract |
Where we rely on consent, you can withdraw it at any time. This does not affect processing that already happened, but some features (such as location matching or provider verification) will stop working.
5. Who we share it with
Other users see only what they need: providers see job details and approximate areas; customers see quotes; the approved provider sees the private address; job participants see the chat. Profiles are private to you and authorised administrators.
Operators (service providers who process information for us under contract):
| Operator | What they do | Where |
|---|---|---|
| Google (Firebase Authentication, Cloud Firestore) | Sign-in; database for profiles, jobs, quotes and chat | Database in Johannesburg (africa-south1). Sign-in may be processed outside South Africa. |
| Didit | Provider identity and liveness verification | [PLACEHOLDER: confirm Didit processing location] |
| PayFast (coming soon) | Card and EFT payments, payment references, payouts | South Africa |
| Photon by komoot (OpenStreetMap data) | Searching suburbs and converting a rounded point into an area name. Receives only your search text or the rounded point. | Germany / EU |
| OpenStreetMap tile servers | Map images, only when you choose to show a map. Your browser sends its IP address and the page address. | Outside South Africa |
| [PLACEHOLDER: web hosting provider] | Hosting the Lukilly website and server | [PLACEHOLDER] |
We may also disclose information where the law requires it, to protect someone's safety, or to a buyer of our business under the same protections. We do not sell your personal information.
6. Processing outside South Africa
Some operators above process information outside South Africa. We only transfer personal information across borders as POPIA section 72 allows: where the recipient is bound by law, binding corporate rules or an agreement giving protection substantially similar to POPIA, where you consent, or where the transfer is needed to perform our contract with you.
7. How we protect it
- Every data request is checked on our server against your verified Google sign-in. Browsers cannot write to our database directly.
- Exact addresses are stored separately from public job information, and GPS is rounded before it leaves your device.
- Data travels over encrypted connections (HTTPS).
- If a security compromise affects your information, we will notify you and the Information Regulator as POPIA section 22 requires.
8. How long we keep it
| Information | Kept for |
|---|---|
| Profile and approximate location | While your account is active, then [PLACEHOLDER: period] |
| Jobs, quotes and chat | [PLACEHOLDER: period, e.g. to cover disputes and claims] |
| Payment and fee records | [PLACEHOLDER: period required by tax law] |
| Identity verification results | [PLACEHOLDER: period]. Didit's retention of images and biometrics: [PLACEHOLDER] |
| Area-search cache on our server | Up to 24 hours |
After that we delete or de-identify the information, unless the law requires us to keep it longer or it is needed for an open dispute or legal claim.
9. Your rights
Under POPIA you may:
- ask whether we hold your personal information and request a copy (access requests follow our PAIA manual);
- ask us to correct, update or delete information that is inaccurate, out of date, excessive or unlawfully obtained;
- object to processing based on legitimate interest, and withdraw consent;
- object to direct marketing;
- complain to the Information Regulator (section 12).
Email [PLACEHOLDER: information officer email]. We may need to confirm your identity first, and we will respond within a reasonable time (within 30 days where PAIA applies). In-app account deletion is not available yet; we handle deletion requests by email.
10. Cookies and browser storage
Lukilly uses only what it needs to work. We do not currently use advertising or analytics cookies.
- Sign-in storage: Firebase stores your sign-in session in your browser so you stay signed in.
- Connection data: our server keeps a live connection while the app is open, and may set essential security cookies.
- Location: your browser remembers whether you allowed location access; you control this in your browser settings.
If we add analytics or other non-essential cookies, we will update this policy and ask for consent where required.
11. Children, marketing and automated decisions
- Lukilly is only for people aged 18 and older. We do not knowingly process children's information.
- We will not send you electronic direct marketing unless you have agreed to it, and every marketing message will let you opt out.
- We do not make decisions with legal or similarly significant effects about you based solely on automated processing. Didit's automated checks are [PLACEHOLDER: confirm human review of failed or flagged checks].
12. The Information Regulator
If you are unhappy with how we handle your information, please contact our Information Officer first. You may also complain to the Information Regulator (South Africa):
- POPIA complaints: POPIAComplaints@inforegulator.org.za (using POPIA Form 5), or the Regulator's eServices complaints portal
- General enquiries: enquiries@inforegulator.org.za · 010 023 5200 · toll free 0800 017 160
- Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 · inforegulator.org.za
13. Changes to this policy
We will tell you about material changes before they take effect and ask you to accept the new version. Version 2026-11-09-draft, last updated 9 November 2026.