This Privacy Policy explains how TRADEBASE (PTY) LTD ("Traderbase", "we", "us") collects, uses, shares and protects your personal information when you use the Traderbase marketplace and collection-tracking service at traderbase.co.za and our mobile apps. We process personal information in line with South Africa's Protection of Personal Information Act, 2013 (POPIA).
Responsible party: TRADEBASE (PTY) LTD
Information Officer: [Information Officer name — to be appointed]
Email: support@traderbase.co.za
Registered address: [Registered office address — placeholder]
We collect only what we need to run a card-only marketplace for physical trading cards:
| Category | Examples |
|---|---|
| Account & identity | Email address, display name, and the Google account identifier if you sign in with Google. |
| Profile & contact | Phone number (for order coordination), and for sellers your payout bank details. |
| Shipping | Delivery name, contact number and email, and where you want an order delivered: a street address, or the Courier Guy locker or PostNet store you choose. Checkout remembers these so you don't have to type them again; you can edit or remove them in Settings (app) or your profile (website). |
| Listings & content | Photos of cards you list, descriptions, prices, and messages you exchange with other users. |
| Transactions | Orders, amounts, courier and waybill/tracking numbers, refund and dispute records. |
| Payment data | Card payments are processed by Paystack. We do not store your full card number — Paystack handles card data and returns only a transaction reference and status to us. |
| Technical | Device and app data, log data, and local storage used to keep you signed in and remember preferences (e.g. theme). In the mobile app: crash reports, a small number of usage events, and, if you turn on notifications, a push token for your device (see section 3). |
Where we rely on consent, you can withdraw it at any time without affecting processing already carried out.
We do not sell your personal information. We share it only with service providers ("operators" under POPIA) who process it on our behalf under contract, and only as needed:
| Provider | Purpose |
|---|---|
| Firebase / Google Cloud | Authentication, database (Firestore), file storage, hosting and email delivery. |
| Paystack | Card payment processing and seller payouts. |
| RevenueCat | In-app subscription / purchase management on mobile (where applicable). |
| Couriers / delivery partners | We share the buyer's shipping details with the seller so the order can be shipped tracked. |
| Google (Places) | Street address suggestions while you type a delivery address. |
| Functional Software, Inc. (Sentry) | Crash reports from the mobile app. |
| PostHog, Inc. | Usage statistics from the mobile app, processed in the European Union. |
| Expo (650 Industries, Inc.), Apple and Google | Delivering push notifications, only if you turn them on. |
When you type a street address at checkout or in your delivery settings, what you type is sent through our server to Google's Places service to suggest South African addresses. Only the address you choose is saved.
To find and fix problems, the Traderbase app sends a crash report when something goes wrong. A crash report contains technical details: what the app was doing when the error happened, the app version, your device model and operating system version, and your Traderbase account ID. It does not contain your name, your email address or the cards in your collection. Crash reports are kept for up to 90 days.
To understand which features are used and where the app can be improved, the app also records a small number of usage events, for example that a scan was completed, a card was added or a screen for Traderbase Pro was opened. These events include the app version, your device model, operating system, language and time zone, a rough size range of your collection (for example "50 to 199 cards") and your Traderbase account ID. They do not include your name, your email address, card names or prices. Like any internet service, these providers receive your device's IP address when the app connects to them. Usage events are kept for up to one year.
You can stop usage events at any time in the app under Settings, Preferences, "Share anonymous usage data". The change takes effect immediately. Crash reports are not affected by this setting, because they are needed to keep the app working. Neither service may use this information for its own purposes, to advertise to you or to sell it.
If you turn on notifications, a push token for your device is stored with your account and sent to Expo, Apple and Google only to deliver notifications to you. You can turn notifications off at any time in the app under Settings, "Push notifications", or in your phone's settings. The token is deleted when you sign out on that device or delete your account.
We may also disclose information where required by law, court order, or to protect the rights and safety of users and the public.
Traderbase is a marketplace. When you transact, we share the information needed to complete the deal — for example, a seller receives the buyer's name, contact number and delivery destination (a street address, or the chosen Courier Guy locker or PostNet store, in which case also the buyer's email address, which the courier needs), and both parties can see messages exchanged about an order. Please share only what is necessary in messages.
Some of our providers (Google/Firebase, Paystack, RevenueCat, Sentry, PostHog, Expo) may process or store data outside South Africa. Where this happens, we rely on the transfer grounds permitted by POPIA, including that the recipient is subject to laws or binding agreements providing comparable protection.
We use reasonable technical and organisational measures to protect personal information, including encrypted connections (HTTPS), access controls, and reputable infrastructure providers. Card data is handled by Paystack within their PCI-DSS environment. No method of transmission or storage is perfectly secure, but we act promptly on any suspected compromise and will notify you and the Information Regulator where the law requires.
We keep personal information only as long as needed for the purposes above or as required by law (for example, transaction and tax records are kept for the periods required by South African law). When no longer needed, we delete or de-identify it. You can ask us to delete your account; some records linked to completed transactions, disputes or legal obligations may be retained for the required period.
Under POPIA you have the right to:
To exercise any of these, contact our Information Officer at support@traderbase.co.za. You may also complain to the Information Regulator at inforeg@inforegulator.org.za.
We use browser local storage and similar technologies to keep you signed in, remember preferences such as your theme, and operate the site. These are essential to the service. We do not use them for third-party advertising.
Traderbase is intended for users aged 18 and over. We do not knowingly collect personal information from children without the consent of a competent person. If you believe a child has given us information, contact us and we will remove it.
We may update this policy from time to time. We will post the updated version here with a new "Last updated" date, and notify you of material changes where appropriate.
Questions or requests about your personal information: support@traderbase.co.za.