Legal

Privacy Policy

Last updated: 2 September 2026
Effective for the DroptionSA mobile application and related services at droptionsa.com

This Privacy Policy explains what personal information DroptionSA collects, why we collect it, how we use and share it, and the choices available to you. By creating an account or using DroptionSA, you acknowledge this Policy and our Terms of Use. If you do not agree, do not use the app.

1. Who we are

DroptionSA (“we”, “us”, “our”) operates a South African car-culture platform for Digi-Cert builds, Garage, community Feed, Marketplace, Crews, Battles, Gifts, Coins/Safe, Events, and related features.

Privacy / support contact: support@droptionsa.com
Website: https://droptionsa.com

2. Scope

This Policy covers personal information processed when you use the DroptionSA mobile app, create an account, complete Digi-Cert verification, use Marketplace or Crew chat, buy event tickets (when available), receive transactional emails or SMS, or visit our website legal pages.

3. Information we collect

3.1 Account & profile

Email address and password (if you use email sign-up / sign-in).
South African cellphone number (optional or required for certain flows) and verification status.
Google account details you authorize (typically name, email, profile image) if you use Continue with Google.
Apple account identifiers / email relay details if you use Sign in with Apple (where offered).
Display name, username, province, and profile photo/avatar.
Basic presence signals used in chat (for example whether you appear online / last active).

3.2 Digi-Cert, Garage & vehicle data

Vehicle details you enter (make, model, year, nickname, province, category, plate, VIN, hero image).
Identity and ownership documents you upload for Digi-Cert or ownership transfer, which may include: South African ID or passport images, NaTIS / registration or ownership documents, licence disc images, plate photos, multi-angle vehicle photos, verification video, and VIN evidence.
Verification outcomes, Digi-Cert / Droption Number, Build Level, DNA-related stats, certificates, and transfer history.

Face images may appear on identity documents or verification media you submit. We process that media only to verify ownership / Digi-Cert eligibility and for related safety and fraud prevention.

3.3 Content & communications you create

Feed Drops (photos and captions), comments (including voice comments where available), respects, follows, bookmarks, mentions, and shares.
Marketplace listings (title, description, price, condition, province, photos, part category) and inquiry chat.
Crew membership, crew photos, and crew chat.
Battle challenges, votes, and related activity.
Event hosting / RSVP / ticket records and results announcements.
Chat messages and attachments you choose to send: text, images, voice notes, and location pins.
Reports you submit about content, listings, profiles, or messages.

3.4 Location

Precise location only when you choose to share a location pin in Marketplace or Crew chat, or when you use in-app place search / nearby helpers that require device location permission.
Location labels and coordinates associated with shared pins; map links may open in Google Maps or another maps app on your device.

3.5 Payments, coins, gifts & Safe

In-app ledger information such as coin balances, gift sends, Safe balances / holds, listing prices, ticket purchases, and fee amounts when those features are enabled.
We do not currently collect bank account or live card details inside DroptionSA for marketplace payouts. If card checkout or bank withdrawals go live later, additional payment details will be processed by the payment provider and this Policy will be updated.

3.6 Device, diagnostics & notifications

Device platform information, app diagnostics, and security logs needed to operate and protect the service.
Push notification tokens (for example Firebase Cloud Messaging tokens) if notifications are enabled.
Local preferences stored on your device (for example theme).
Permissions you grant for camera, microphone, photo library, files, SMS autofill (OTP), and location.
Plate Scanner inputs (camera / gallery / typed plate) used to look up Digi-Cert builds according to app rules and rate limits.

4. How we use information

Create, authenticate, and secure accounts (including Google / Apple Sign-In, email auth, and SMS OTP).
Operate Digi-Cert verification, renewals, certificates, Garage, Feed, Marketplace, Crews, Battles, Events, Gifts, Coins, Safe, Search, Plate Scanner, and notifications.
Show public identity information you choose to publish (for example username, avatar, Digi-Cert Build Pages, listings, and event details).
Enable human moderator review of Digi-Cert and ownership-transfer submissions.
Send transactional communications (OTP SMS, auth emails, ticket emails, certificate emails, important service notices).
Prevent fraud, spam, abuse, and unauthorized access; investigate reports; enforce our Terms.
Maintain, debug, and improve reliability and security of the service.
Comply with applicable law and respond to lawful requests.

We do not sell your personal information.

5. Legal bases under South African POPIA

Where the Protection of Personal Information Act 4 of 2013 (POPIA) applies, we process personal information because it is necessary to conclude or perform a contract with you (providing the app), because you consented (for example optional location sharing or certain marketing if introduced later), because we have a legitimate interest in securing and improving the platform that does not override your rights, and/or because processing is required to comply with law. Special personal information (such as identity documents) is processed only for Digi-Cert / ownership verification and related fraud prevention, with appropriate safeguards and access controls.

6. Google Sign-In & Sign in with Apple

If you use Continue with Google, Google provides us with account information you authorize (typically name, email address, and profile photo) so we can create or sign into your DroptionSA account. We do not receive your Google password.

You can review or revoke Google access at myaccount.google.com/permissions. Apple Sign-In, where available, works similarly under Apple’s rules (including optional Hide My Email).

7. Digi-Cert & identity documents

Documents and media uploaded for Digi-Cert or ownership transfer are used to verify that a person is entitled to claim or transfer a Digi-Cert Build.
Authorized moderators may view submissions to approve or reject them.
Rejected verification media may be deleted promptly after rejection according to our operational practice.
Approved verification / completed transfer media is retained only as long as needed for the verification purpose, audit, fraud prevention, and legal obligations, and is then deleted or minimized according to our retention schedule (including short post-completion cleanup windows where applicable).
Misuse of another person’s documents, or submitting forged media, may lead to rejection, account action, and reporting where required by law.

8. Location data

Location is optional. We do not continuously track you in the background for advertising. When you share a pin in chat, the other participant(s) in that thread can see the location you shared. Place search may use mapping / geocoding providers (for example OpenStreetMap-based services and device geocoding APIs) to help you pick a place.

We share personal information only as needed to run DroptionSA:

Other users — profile and content you make public or send (for example Feed posts, Build Pages, Marketplace listings, chat messages, crew membership, event details).
Supabase — authentication, database, file storage, realtime, and backend functions.
Google — Sign-In; Firebase Cloud Messaging for push; Maps links opened on device; fonts/resources as used by the app stack.
Apple — Sign in with Apple where offered.
Twilio — SMS one-time passwords when phone verification is enabled.
Resend (or similar email provider) — transactional email such as auth mail, event tickets, and certificate emails.
Mapping / geocoding providers — to support place search and location sharing features you use.
Legal / safety — if required by law, or to protect DroptionSA, users, or the public against fraud, abuse, or security threats.
Business transfers — if we undergo a merger, acquisition, or asset sale, information may transfer under continued confidentiality protections.

10. International transfers

Some processors (for example cloud hosting, Google, Apple, Twilio, or email providers) may process data outside South Africa. Where we transfer personal information internationally, we take steps consistent with POPIA to ensure appropriate protection, including contractual and technical safeguards with our providers.

11. Retention

Account and profile data: while your account remains active and for a reasonable period afterward for security, disputes, and legal compliance.
UGC and chats: while needed to provide the service, unless removed earlier by you (where the product allows), by moderation, or by deletion request.
Digi-Cert identity media: limited to verification / transfer / fraud-prevention needs as described above.
Push tokens and technical logs: for as long as needed for delivery, security, and debugging, then rotated or deleted.
Backup copies may persist for a limited time after deletion.

12. Security

We use technical and organizational measures appropriate to the sensitivity of the data, including encrypted transport (HTTPS), access controls, and provider security features. No system is perfectly secure. Please protect your device and account credentials and contact us immediately if you suspect unauthorized access.

13. Your rights & choices

Subject to POPIA and other applicable law, you may request to:

Access the personal information we hold about you.
Correct inaccurate information.
Object to or restrict certain processing.
Request deletion of your account / personal information (subject to legal retention needs).
Withdraw consent where processing is based on consent (for example stop sharing location).

You can update many profile fields in Settings. To request account deletion or a privacy request, email support@droptionsa.com from the email on your account. We may need to verify your identity before acting.

You may also control device permissions (camera, mic, photos, location, notifications) in your phone settings. Disabling permissions may limit features.

14. Children

DroptionSA is aimed at adult car enthusiasts and Digi-Cert builders. The app is not directed to children under 18. Do not create an account if you are under 18. If we learn that we collected personal information from a child under 18 without appropriate authority, we will take steps to delete it.

15. Changes to this Policy

We may update this Privacy Policy as DroptionSA evolves (for example when live payments launch). We will update the “Last updated” date and, where appropriate, provide additional notice in the app or by email. Continued use after an update means you accept the revised Policy.

16. Contact

Privacy questions or POPIA requests:
support@droptionsa.com
Website: https://droptionsa.com