Legal

Privacy Policy

Last updated: 24 October 2026
Effective for the DroptionSA mobile application and related services at droptionsa.com

This Privacy Policy explains what personal information DroptionSA collects, why we collect it, how we use and share it, and the choices available to you. By creating an account or using DroptionSA, you acknowledge this Policy and our Terms of Use. If you do not agree, do not use the app.

1. Who we are

DroptionSA (“we”, “us”, “our”) operates a South African car-culture platform for Digi-Cert builds, Garage, community Feed, Marketplace (including Protect), Plate Scanner, Crews, Battles, Gifts, Coins, My Safe, Events and tickets, and related features.

Privacy / support contact: support@droptionsa.com
Website: https://droptionsa.com

2. Scope

This Policy covers personal information processed when you use the DroptionSA mobile app, create an account, complete Digi-Cert or event-host verification, use Marketplace or Crew chat, complete Protect or ticket payments, manage My Safe / payout bank details, receive transactional emails or SMS, or visit our website legal pages.

3. Information we collect

3.1 Account & profile

Email address and password (if you use email sign-up / sign-in).
South African cellphone number (optional or required for certain flows) and verification status.
Google account details you authorize (typically name, email, profile image) if you use Continue with Google.
Apple account identifiers / email relay details if you use Sign in with Apple (where offered).
Display name, username, province, and profile photo/avatar.
Basic presence signals used in chat (for example whether you appear online / last active).

3.2 Digi-Cert, Garage & vehicle data

Vehicle details you enter (make, model, year, nickname, province, category, plate, VIN, hero image).
Identity and ownership documents you upload for Digi-Cert or ownership transfer, which may include: South African ID or passport images, NaTIS / registration or ownership documents, licence disc images, plate photos, multi-angle vehicle photos, verification video, and VIN evidence.
Verification outcomes, Digi-Cert / Droption Number, Build Level, DNA-related stats, certificates, and transfer history.

Face images may appear on identity documents or verification media you submit. We process that media only to verify ownership / Digi-Cert eligibility and for related safety and fraud prevention.

3.3 Content & communications you create

Feed Drops (photos and captions), comments (including voice comments where available), respects, follows, bookmarks, mentions, and shares.
Marketplace listings (title, description, price, condition, province, photos, part category) and inquiry chat.
Crew membership, crew photos, and crew chat.
Battle challenges, votes, and related activity.
Event hosting / RSVP / ticket records and results announcements.
Chat messages and attachments you choose to send: text, images, voice notes, and location pins.
Reports you submit about content, listings, profiles, or messages.

3.4 Location

Precise location only when you choose to share a location pin in Marketplace or Crew chat, or when you use in-app place search / nearby helpers that require device location permission.
Location labels and coordinates associated with shared pins; map links may open in Google Maps or another maps app on your device.

3.5 Payments, coins, gifts & Safe

In-app ledger information such as coin balances, gift sends, My Safe balances / holds / activity, listing prices, Protect orders, ticket purchases, fee amounts, and Safe→coin conversions.
Payment references and status from our payment partner (Paystack) for Protect checkout, event tickets, and payouts — we do not store your full card number in DroptionSA.
App store purchase tokens / order identifiers when you buy coin packs via Google Play or the App Store (processed under the store’s terms).
South African bank account details you submit for My Safe withdrawals and/or Marketplace Protect seller payouts (for example bank name, account holder name, account number, and account type). These are used to create payout recipients with our payment partner and to pay you.
Event host verification (Host KYC) details when you apply to host: identity document number / type, plus at least one contact method you provide (email and/or South African cellphone), as shown in the app, and moderator review outcomes.

3.6 Device, diagnostics & notifications

Device platform information, app diagnostics, and security logs needed to operate and protect the service.
Push notification tokens (for example Firebase Cloud Messaging tokens) if notifications are enabled.
Local preferences stored on your device (for example theme).
Permissions you grant for camera, microphone, photo library, files, SMS autofill (OTP), and location.
Plate Scanner inputs (camera / gallery / typed plate) used to look up Digi-Cert builds according to app rules and rate limits.
Plate-scan “spotted” notification metadata when another user scans a Digi-Cert build you own and you have that Garage notification setting enabled (subject to in-app daily limits). Spot notifications do not include the scanner’s GPS location.

4. How we use information

Create, authenticate, and secure accounts (including Google / Apple Sign-In, email auth, and SMS OTP).
Operate Digi-Cert verification (including automated photo / document assist for moderators), renewals, certificates, Garage, Feed, Marketplace Protect, Crews, Battles, Events and tickets, Gifts, Coins, My Safe (including convert and withdraw), Search, Plate Scanner, and notifications.
Show public identity information you choose to publish (for example username, avatar, Digi-Cert Build Pages, listings, and event details).
Enable human moderator review of Digi-Cert, ownership-transfer, and event-host verification submissions. Automated Digi-Cert tools may help moderators review submissions; they do not auto-approve Digi-Cert.
Notify Digi-Cert owners of plate scans by other users when they have opted into spot notifications.
Process payments, fees, Safe credits, refunds to Safe where applicable, and bank payouts via our payment partners.
Send transactional communications (OTP SMS, auth emails, ticket emails, certificate emails, important service notices).
Prevent fraud, spam, abuse, and unauthorized access (including soft rate limits on actions such as Digi-Cert AI assist, chat sends, gifts, and Plate Scanner lookups); investigate reports; enforce our Terms.
Maintain, debug, and improve reliability and security of the service.
Comply with applicable law and respond to lawful requests.

We do not sell your personal information.

5. Legal bases under South African POPIA

Where the Protection of Personal Information Act 4 of 2013 (POPIA) applies, we process personal information because it is necessary to conclude or perform a contract with you (providing the app), because you consented (for example optional location sharing or certain marketing if introduced later), because we have a legitimate interest in securing and improving the platform that does not override your rights, and/or because processing is required to comply with law. Special personal information (such as identity documents) is processed only for Digi-Cert / ownership verification, event-host verification where required, and related fraud prevention, with appropriate safeguards and access controls.

6. Google Sign-In & Sign in with Apple

If you use Continue with Google, Google provides us with account information you authorize (typically name, email address, and profile photo) so we can create or sign into your DroptionSA account. We do not receive your Google password.

You can review or revoke Google access at myaccount.google.com/permissions. Apple Sign-In, where available, works similarly under Apple’s rules (including optional Hide My Email).

7. Digi-Cert, host KYC & identity documents

Documents and media uploaded for Digi-Cert or ownership transfer are used to verify that a person is entitled to claim or transfer a Digi-Cert Build.
We may run automated checks on Digi-Cert photos and documents (for example OCR on papers and AI-assisted comparison of angle photos against submitted paperwork / Garage references) to help human moderators. These tools do not replace moderator decisions and do not auto-approve Digi-Cert.
Event-host verification / Host KYC (where required) uses the identity details you submit plus at least one contact method (email and/or cellphone) so we can review eligibility to host ticketed events. Authorized moderators may approve, reject, or request more information.
Authorized moderators may view Digi-Cert and host-verification submissions to approve or reject them.
Rejected verification media may be deleted promptly after rejection according to our operational practice.
A final rejection of an initial Digi-Cert submission may also remove the related unverified Garage vehicle under product rules. Digi-Cert renewals of already-verified builds are treated differently and are not automatically deleted on reject.
Approved verification / completed transfer media is retained only as long as needed for the verification purpose, audit, fraud prevention, and legal obligations, and is then deleted or minimized according to our retention schedule (including short post-completion cleanup windows where applicable).
Misuse of another person’s documents, or submitting forged media, may lead to rejection, account action, and reporting where required by law.

8. Location data

Location is optional. We do not continuously track you in the background for advertising. When you share a pin in chat, the other participant(s) in that thread can see the location you shared. Place search may use mapping / geocoding providers (for example OpenStreetMap-based services and device geocoding APIs) to help you pick a place.

We share personal information only as needed to run DroptionSA:

Other users — profile and content you make public or send (for example Feed posts, Build Pages, Marketplace listings, chat messages, crew membership, event details).
Supabase — authentication, database, file storage, realtime, and backend functions.
Paystack — card / payment processing for Protect and event tickets, and bank payout / transfer recipient processing for eligible My Safe and seller withdrawals.
Amazon Web Services (AWS) — Digi-Cert document OCR / text extraction used to assist moderator review (for example Amazon Textract), when that assist is enabled.
Anthropic — Digi-Cert AI-assisted review signals for moderators (for example document-risk and photo-vs-papers checks), when that assist is enabled. Assist results help humans; they do not auto-approve Digi-Cert.
Google — Sign-In; Firebase Cloud Messaging for push; Google Play Billing for coin packs on Android when offered; Maps links opened on device; fonts/resources as used by the app stack.
Apple — Sign in with Apple where offered; App Store In-App Purchase for coin packs on iOS where offered.
Twilio — SMS one-time passwords when phone verification is enabled.
Resend (or similar email provider) — transactional email such as auth mail, event tickets, and certificate emails.
Mapping / geocoding providers — to support place search and location sharing features you use.
Legal / safety — if required by law, or to protect DroptionSA, users, or the public against fraud, abuse, or security threats.
Business transfers — if we undergo a merger, acquisition, or asset sale, information may transfer under continued confidentiality protections.

10. International transfers

Some processors (for example cloud hosting, Google, Apple, AWS, Anthropic, Twilio, or email providers) may process data outside South Africa. Where we transfer personal information internationally, we take steps consistent with POPIA to ensure appropriate protection, including contractual and technical safeguards with our providers.

11. Retention

Account and profile data: while your account remains active and for a reasonable period afterward for security, disputes, and legal compliance.
UGC and chats: while needed to provide the service, unless removed earlier by you (where the product allows), by moderation, or by deletion request. Soft-deleted Feed content may be retained for a limited Ops restore / audit window before permanent removal.
Abuse-prevention rate-limit events: short-lived technical records used to enforce fair-use limits, then rotated or deleted.
Digi-Cert / host-verification identity media: limited to verification / transfer / fraud-prevention needs as described above.
Payment, Safe ledger, and payout records: for as long as needed for accounting, disputes, chargebacks, fraud prevention, and legal compliance.
Bank payout details: while linked to your account for withdrawals / payouts, and for a reasonable period afterward for audit and dispute handling.
Push tokens and technical logs: for as long as needed for delivery, security, and debugging, then rotated or deleted.
Backup copies may persist for a limited time after deletion.

12. Security

We use technical and organizational measures appropriate to the sensitivity of the data, including encrypted transport (HTTPS), access controls, and provider security features. No system is perfectly secure. Please protect your device and account credentials and contact us immediately if you suspect unauthorized access.

13. Your rights & choices

Subject to POPIA and other applicable law, you may request to:

Access the personal information we hold about you.
Correct inaccurate information.
Object to or restrict certain processing.
Request deletion of your account / personal information (subject to legal retention needs).
Withdraw consent where processing is based on consent (for example stop sharing location).

You can update many profile fields in Settings. To request account deletion or a privacy request, email support@droptionsa.com from the email on your account. We may need to verify your identity before acting.

You may also control device permissions (camera, mic, photos, location, notifications) in your phone settings. Disabling permissions may limit features.

14. Children

DroptionSA is aimed at adult car enthusiasts and Digi-Cert builders. The app is not directed to children under 18. Do not create an account if you are under 18. If we learn that we collected personal information from a child under 18 without appropriate authority, we will take steps to delete it.

15. Changes to this Policy

We may update this Privacy Policy as DroptionSA evolves. We will update the “Last updated” date and, where appropriate, provide additional notice in the app or by email. Continued use after an update means you accept the revised Policy.

16. Contact

Privacy questions or POPIA requests:
support@droptionsa.com
Website: https://droptionsa.com