Who is responsible
PulseSpot is run from Johannesburg, South Africa by its founder, Bongani Ndelu, who is the responsible party and Information Officer for PulseSpot. Contact us through the contact page (choose “Privacy or my personal information”).
What we collect and why
| Information | Why | How long |
|---|---|---|
| Google sign-in: your email address, name and Google account ID | To create your account and keep you signed in. Your name and email are never shown to other users. | Until you delete your account. Sign-in sessions last up to 30 days. |
| Email sign-in: your email address, and a one-time code we email to it | To create your account and sign you in. If you already have an account with the same email (for example from Google), you sign in to that account. Your email is never shown to other users. Codes are stored only in scrambled form and work for 10 minutes. | Your email until you delete your account; codes up to 10 minutes. Sign-in sessions last up to 30 days. |
| Phone sign-in: your cell number, and a one-time code we send it by SMS | To create your account and sign you in. Your number is never shown to other users. Codes are stored only in scrambled form and work for 10 minutes. | Your number until you delete your account; codes up to 10 minutes. Sign-in sessions last up to 30 days. |
| Public name (handle) | Shown on your posts instead of your real name. | Until you delete your account. |
| Posts and photos, including your replies, the public names you @mention and your reactions | To show them in the live chat (7 hours) and on your profile (3 days), and to tell people when you reply to or mention them. Photos are made smaller on your phone before they upload, which also removes hidden details such as where they were taken. | Deleted after 30 days, or when you delete them. |
| Warnings we send you about a post that broke the Community Rules: the reason, the start of the post and any note from us | To show you the warning once, and to deal with repeated problems. | 365 days, or until you delete your account. |
| Precise location, while you use location features | To show nearby spots, confirm you’re at a venue before a check-in or venue post, match you to a venue when you share activity, give directions and place road reports. | Your coordinates are used at that moment and are not stored, except a road report’s position (crash 1 hour, pothole 7 days). Activity sharing keeps only which venue you matched, for about 3 minutes. |
| Visits (check-ins) | Your private “spots visited” list, and the total number of check-ins. | 365 days. |
| Table requests: name, phone number, date, time, party size and note | Shared with the venue you choose so it can confirm your request. | Until 180 days after the booking date. |
| Deposits: the amount, your booking, the payment reference and status, and the type of payment (for example, card). Paystack receives your email address for your receipt. | To take and refund deposits, and to keep the financial records the law requires. We never see or store card numbers: Paystack handles them. | Payment records 5 years (tax law); the link to your account is removed after 180 days. |
| Venue claims: name, work email, role and the venue’s public contact details | To verify that you can manage the venue. | While the claim or verified ownership exists. |
| Venue payout accounts: business name, bank, the last four digits of the account number and a contact email. The full account number goes only to Paystack. | To pay venues their share of deposits. | While the venue takes deposits, then with the payment records. |
| Featured purchases (venue owners): the venue, the plan, the amount, the payment reference and status, and the type of payment. Paystack receives your email address for your receipt. | To sell Featured and keep the financial records the law requires. We never see or store card numbers: Paystack handles them. | Payment records 5 years (tax law); the link to your account is removed after 180 days. |
| Club profiles (venue owners): the deal, about text, hours, Instagram name and photos you add to your venue | Shown publicly on your venue’s spot. Photos are made smaller on your phone before they upload, which also removes hidden details such as where they were taken. | Until you change them, your claim ends or you delete your account. |
| Spots you add: name, type, map position and any address or note | To check the spot and show it on the map. Approved spots are public listings and don’t show who added them. | Suggestions we don’t use are deleted after 180 days. |
| Reports, blocks and messages you send us | To review content, act on take-down and privacy requests, and reply to you. | Reports 180 days; messages up to 365 days after they are resolved. |
| Usage counts: how many phones open PulseSpot each day, which spots are viewed, when directions or a ride app are chosen, and the rough city (from your network) | To see how PulseSpot is used and show venues the visits PulseSpot sends them. Each phone gets a scrambled code that changes every day, so nobody can be followed; only totals are kept. | Codes deleted after 2 days; totals up to 400 days. |
| Security data: a scrambled (hashed) form of your network address, and our hosting provider’s error and security logs | To prevent spam and abuse, and to keep PulseSpot running. | About a day for rate limits; logs for a short period. |
Giving us this information is voluntary, but some features don’t work without it: you can’t post or book without an account, or check in without location. We don’t collect special personal information (such as health, religion or beliefs) and we ask you not to share it in posts.
On your device
PulseSpot uses a sign-in cookie (to keep you signed in) and your browser’s local storage for settings such as your spot category, your 18+ confirmation, chat messages you cleared, your recent emoji and skin tone, which reply and mention pop-ups you’ve seen, and whether activity sharing is on. We don’t use advertising or tracking cookies.
Who we share it with
- Other users see your public name and what you post. Venues see the table requests you send them, and whether the deposit was paid.
- Service providers that run parts of PulseSpot for us: Cloudflare (hosting, database, photo storage and sign-in emails: your email address and the code), Google (sign-in, maps, traffic and directions), Google Firebase or BulkSMS (sends phone sign-in codes: your number and the code; Google’s reCAPTCHA also checks the sign-in page for automated abuse), openrouteservice by HeiGIT (backup directions), OpenStreetMap services (listings and speed limits, which receive map areas and route points, not your account) and Paystack (deposits and Featured: your email, the amount and the payment reference, under Paystack’s terms and privacy policy). Google receives your device’s address and map use when you view maps, under the Google Privacy Policy.
- The authorities, only when the law requires it or to protect someone’s safety.
We don’t sell personal information, and we don’t send marketing messages.
Information stored outside South Africa
Our providers store and process data in other countries, including in the European Union and the United Kingdom. They are bound by data-protection laws and agreements that give protection similar to POPIA.
Keeping it safe
Everything travels over encrypted connections. Sign-in sessions are stored in a scrambled (hashed) form, photos are only served through PulseSpot, and only the founder can reach the review tools. If a breach ever affects your information, we will tell you and the Information Regulator as POPIA requires.
Children
PulseSpot is for people aged 18 and over. We don’t knowingly collect information about children, and we delete accounts that belong to someone under 18.
Your rights
- Access and correction: ask what we hold about you, and have it corrected.
- Deletion: delete your account and everything linked to it from your profile at any time (see how), or ask us to.
- Objection: object to how we use your information, and stop activity sharing or location use whenever you like.
- Complaints: if you are unhappy with how we handled your information, you can complain to the Information Regulator (South Africa) at inforegulator.org.za.
Changes
We will update this policy when what we do changes, and ask you to accept important changes in the app.