Privacy Policy — Squared

This Privacy Policy describes how Squared Cash (Pty) Ltd ("Squared", "we", "us" or "our"), a company registered in the Republic of South Africa, collects, uses, stores, shares and protects the personal information of visitors, organizers, contributors and other users of the Squared website and platform (together, the "Service").

We are the responsible party for the processing of your personal information under the Protection of Personal Information Act, 2013 ("POPIA"), and we aim to comply with equivalent principles under the EU General Data Protection Regulation ("GDPR") and the UK GDPR where those laws apply to you.

1. Information we collect

We collect the following categories of personal information:

Account information — name, email address, password (stored as a hash), profile photo and preferences.
Pool information — pool names, descriptions, amounts, due dates, cover images and participant names supplied by organizers.
Payment information — payment amount, currency, timestamps, transaction reference, method (e.g. card brand and last four digits) and payout beneficiary details. Full card numbers are handled directly by our payment processors and are never stored by Squared.
Communications — messages you send to our support team and email or in-app reminders you choose to send to contributors.
Device & usage data — IP address, device type, browser, operating system, referral source, pages viewed and interaction events, collected via cookies and similar technologies.
Verification data — identity verification information you provide when you complete our KYC / verified organizer flow.

2. How we use your information

To provide, operate, maintain and improve the Service.
To create and manage your account and process pool contributions.
To send transactional messages (receipts, payment confirmations, reminders you triggered, security alerts and service updates).
To prevent, detect and investigate fraud, abuse, and violations of our Terms of Service.
To comply with our legal, tax, accounting and regulatory obligations.
To measure engagement and improve product performance using aggregated analytics.

3. Lawful basis for processing

Depending on the activity, we rely on one or more of the following legal bases: your consent, performance of a contract with you, compliance with a legal obligation, and our legitimate interests in operating and improving the Service in a way that is not overridden by your rights.

4. How we share information

We do not sell your personal information. We share it only in the following circumstances:

Payment processors (e.g. licensed card acquirers) to authorize and settle payments.
Infrastructure providers (hosting, databases, email delivery, error monitoring, analytics) acting as our operators / processors under written agreements.
Pool participants — organizers can see the names and payment status of their pool participants; contributors can see the pool title, cover image and organizer name.
Legal, regulatory or safety reasons where we are required by law or reasonably believe disclosure is necessary to protect the rights, property or safety of Squared, our users or the public.
Corporate transactions such as a merger, acquisition or asset sale, subject to appropriate confidentiality safeguards.

5. International transfers

Some of our processors are located outside South Africa. Where we transfer personal information across borders, we take reasonable steps to ensure it is protected by contractual, technical and organizational measures that provide a level of protection comparable to POPIA.

6. How long we keep your information

We retain personal information only for as long as necessary to provide the Service, comply with our legal obligations (including tax and anti-money-laundering record-keeping requirements), resolve disputes and enforce our agreements. When information is no longer required, we delete or anonymize it.

7. Security

We take appropriate technical and organizational measures to protect personal information against unlawful access, loss, destruction, alteration or disclosure. These include encryption in transit, hashed passwords, role-based access controls and regular security reviews. No system is completely secure, and we cannot guarantee absolute security.

8. Your rights

Subject to applicable law, you have the right to:

Access the personal information we hold about you.
Request correction of information that is inaccurate or incomplete.
Request deletion of your account and associated personal information (subject to legal retention duties).
Object to or restrict certain processing, and withdraw consent where processing is based on consent.
Lodge a complaint with the Information Regulator of South Africa or your local supervisory authority.

To exercise any of these rights, contact us using the details below.

9. Cookies

We use strictly necessary cookies to run the Service (for example to keep you signed in) and limited analytics cookies to understand aggregated usage. You can control cookies through your browser settings; disabling certain cookies may affect functionality.

10. Children

The Service is not directed to children under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take reasonable steps to delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Updated" date at the top of the page and, where the changes are material, notify you by email or in-product notice.

12. Contact us

Squared Cash (Pty) Ltd
Registered in the Republic of South Africa
Email: privacy@squared.cash