Privacy policy

Data we collect

RubyVelvet may collect account identifiers, profile details, verification submissions, booking records, payment status, support requests, device diagnostics and moderation reports required to run a safety-first marketplace.

How data is used

Data is used for authentication, age-gate continuity, profile verification, booking workflow records, fraud prevention, support, reporting, analytics and legal compliance. We do not sell personal information to third parties.

Verification and moderation

Provider verification material is reviewed only by authorized administrators. Sensitive verification files are stored securely, access is logged and records are removed when no longer required by the verification or legal retention process.

Cookies and tracking

RubyVelvet uses an age-gate cookie to preserve your consent session, an authentication cookie for your login session, and Google Analytics (GA4) to measure anonymous usage patterns. You can clear cookies in your browser settings at any time; doing so will reset your age-gate and session state.

Third-party processors

Account and marketplace records are stored through the Afrihost MySQL service. Profile images are stored within RubyVelvet's protected Afrihost hosting environment. Analytics use Google Analytics when enabled. Online payment processing is disabled for the current launch phase.

Data retention

Active account data is retained while your account remains open. Booking and payment records are retained only for the period required by operational, safety and applicable legal obligations. Verification records follow a restricted retention process that must be approved during final legal review. After account deletion, anonymized or aggregated data may be retained for platform safety and analytics purposes.

Account controls

You can request account export, correction or deletion through the support page or the delete-account page. Requests are reviewed for identity verification, safety retention, fraud prevention, payment record obligations and applicable legal requirements before account data is exported, corrected or deleted.

Contact

Privacy requests should be sent to support@rubyvelvet.co.za.

Protection of Personal Information Act (POPIA)

RubyVelvet is designed to support applicable obligations under the Protection of Personal Information Act 4 of 2013 (POPIA). This policy, processing inventory and retention schedule require final review by qualified South African privacy counsel before launch.

Lawful basis for processing

We process personal information on the following lawful grounds under POPIA:

• Consent — Age-gate confirmation, marketing opt-ins and profile publication.
• Contractual necessity — Booking records, payment processing and account management.
• Legal obligation — Tax records, law enforcement requests and fraud prevention.
• Legitimate interest — Platform safety, moderation and fraud detection.

Your rights under POPIA

As a data subject you have the right to:

• Be notified that your personal information is being collected.
• Access the personal information we hold about you.
• Request correction of inaccurate, irrelevant or excessive personal information.
• Request deletion of your personal information (subject to legal retention requirements).
• Object to the processing of your personal information.
• Lodge a complaint with the Information Regulator of South Africa.

Information Regulator

If you believe your POPIA rights have been violated, you may lodge a complaint with South Africa's Information Regulator:

• Website: inforegulator.org.za
• Email: inforeg@justice.gov.za
• Tel: 010 023 5207

Data Responsible Party

The responsible party under POPIA for personal information processed by RubyVelvet is GoalVow Holdings (Pty) Ltd, operating RubyVelvet. All POPIA-related queries should be directed to support@rubyvelvet.co.za.

Cross-border transfers

Where personal information is transferred outside South Africa (for example, to payment processors or CDN providers), we ensure adequate protections are in place consistent with Section 72 of POPIA and applicable data transfer agreements.