Privacy Policy

Last updated: 21 October 2026

PetScout ("PetScout", "we", "us", "our") operates petscout.co.za, an online marketplace where people in South Africa can buy and sell pets and post "wanted" ads (the "Service"). Listings are currently for fish and other aquatic animals, aquatic plants and aquarium equipment; dogs and cats are coming soon. This Privacy Policy explains what personal information we collect, why we collect it, who can see it, and the rights you have over it, in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA").

1. Who we are

PetScout is run from South Africa.

You can reach our Information Officer, who is responsible for how we handle personal information, through our contact page.

2. Information we collect

2.1 When you create an account

• Account details: your email address, a password (stored only as a secure hash; we can never see your actual password), a public display name, and your province.
• Contact preference: whether buyers should contact you by email or WhatsApp and, if you choose WhatsApp, your WhatsApp number.
• Optional profile details: your city and a short bio, if you add them in your account settings.

We don't ask for your real name. Your display name can be anything that follows our Terms.

Your email address, password, display name and province are required: without them we can't create your account. Your WhatsApp number is required only if you choose WhatsApp as your contact method. Your city and bio are optional.

2.2 Listings and wanted ads

The titles, descriptions, prices, quantities, sizes, categories, locations and photos you add to listings and wanted ads. Before we store a photo, we remove the hidden information cameras and phones add to it, such as GPS location and camera details.

The listing and wanted ad forms show which fields are required. Without them, the listing or wanted ad can't be posted.

2.3 Contact reveals

When a logged-in user views someone's contact details (see section 3), we record which account viewed whose details, and when. We use this only to spot scraping and misuse; for example, an account viewing far more contact details than a normal buyer would.

2.4 Reports

When you report a listing or a seller, we store the reason, any details you add, and which account made the report, so we can review it. A reason is required to send a report; the details are optional.

2.5 Messages you send us

When you use our contact form, we receive your name, email address, topic and message and, if you're logged in, which account sent it. Messages are emailed to us and are not stored on PetScout. Your name, email address, topic and message are required: without them we can't receive or answer your message.

2.6 Technical information

• Login cookie: see section 7.
• IP address: used briefly, in memory, to limit repeated requests such as login attempts. We don't store IP addresses in our database, but our server logs, kept by our hosting provider, record them, along with the pages requested and the time.

We don't currently use analytics or advertising tools.

2.7 Information from other people

Some information about you comes from other users: reports they make about your listings or profile, and the record created when they view your contact details (see section 2.3). We use it only to review reports and to spot misuse.

3. Who can see your information

• Anyone visiting PetScout can see your listings and wanted ads (including photos, prices, city and province), and your public profile: display name, province, city, bio, when you joined, and your active listings.
• Logged-in users can reveal your contact details: the contact method you chose (your email address or WhatsApp number) from your listings, your public profile and any wanted ad you post. Contact details are never printed on the page itself; they're only shown after a logged-in user clicks to reveal them, and the number of reveals each account can make is limited.
• PetScout administrators can see reports and the listings and accounts they're about, to review them.
• Service providers who process data on our behalf: Supabase (database and photo storage), Render (website hosting), Resend (sending emails) and Google (our email inbox, which receives messages sent through our contact form). They may only use your information to provide their service to PetScout.
• For legal reasons: where required by law, regulation or court order, or to protect the rights, property or safety of PetScout, our users or the public.
• Business transfers: where PetScout is involved in a merger, acquisition or sale of assets, your information may be transferred as part of that transaction, subject to this policy (or one at least as protective).

We don't sell your personal information, and we don't use it for advertising.

4. How we use your information

We use your information to:

• Create your account and log you in;
• Show your listings, wanted ads and public profile to other users;
• Let buyers and sellers contact each other;
• Send you emails you need to use the Service, such as password reset links. We don't send marketing emails;
• Prevent and investigate fraud, scraping, abuse and prohibited listings, including reviewing reports;
• Keep the Service secure and working properly;
• Comply with our legal obligations.

We don't make decisions about you by automated means that have legal or similarly significant effects. Some automatic checks, such as limits on login attempts and contact reveals, and blocking contact details in listing text, only stop an action; reports about users and listings are reviewed by a person.

5. Legal basis for processing

We process your personal information on the following bases, as allowed by POPIA:

• Performance of a contract: to provide the marketplace you sign up for;
• Legitimate interests: to prevent fraud, and for security and keeping the Service working, balanced against your rights;
• Legal obligation: where South African law requires it; and
• Consent: where we ask for it.

6. International data transfers

Our service providers (Supabase, Render, Resend and Google) may store or process data outside South Africa. Where this happens, we take reasonable steps to ensure your information receives a level of protection consistent with POPIA.

7. Cookies

We use one cookie, which keeps you logged in. It lasts up to 30 days, or until you log out. We don't use analytics or advertising cookies. If we add analytics in future, we'll update this policy first. You can block cookies in your browser settings, but you won't be able to log in without this one.

8. How long we keep your information

• Your account, listings and wanted ads: kept as long as your account exists. Wanted ads close automatically after 30 days.
• Listings you delete: hidden from the site straight away, and fully deleted with their photos when you delete your account.
• Server logs: our hosting provider keeps logs of requests to the site, which include IP addresses and, for some errors, email addresses, for a limited time set by the provider.
• Backups: our database provider keeps backups for a limited time, so deleted information may remain in a backup until it's overwritten.
• Contact reveal records: 90 days, or until either account is deleted, whichever comes first.
• Password reset links: expire after one hour and are then deleted.
• Login sessions: expire after 30 days, or when you log out.
• Messages you send us: only as long as we need them to answer you.

When you delete your account, we delete your account details, listings and their photos, wanted ads, the reports you've made and your contact reveal records. Reports other users made about you may be kept where we need them to prevent fraud or abuse.

9. Your rights

Under POPIA, you have the right to:

• Access the personal information we hold about you;
• Ask us to correct inaccurate or outdated information;
• Ask us to delete your personal information, subject to legal exceptions;
• Object to us processing your information;
• Withdraw consent you've given at any time;
• Complain to the Information Regulator of South Africa if you believe your information has been mishandled.

You can change your province, city, bio and contact details, and delete your account, in your account settings. To change your display name or email address, or to exercise any of the rights above, send us a message through our contact page.

Exercising these rights is free. As well as our contact page, you can use the Information Regulator's forms: Form 1 to object to processing, or Form 2 to ask us to correct or delete your information, and send it to us through our contact page. We'll respond within 30 days.

10. Data security

We take reasonable technical and organisational measures to protect your information, including password hashing, encrypted connections (HTTPS), limits on login attempts and contact reveals, and access controls. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

If we believe someone has accessed your personal information without authorisation, we'll tell you by email and notify the Information Regulator as soon as reasonably possible. We'll explain what happened, what we're doing about it, and what you can do to protect yourself.

11. Children's privacy

PetScout is not intended for anyone under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we've collected information from a minor, we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. We'll update the "Last updated" date above and, where changes are material, take reasonable steps to notify registered users.

13. Contact us

Send us a message through our contact page. Messages are emailed to us and are not stored on PetScout; we keep them only as long as we need to answer them.