Privacy Policy
Last updated 22 September 2026
This explains what personal information ServiceBase collects, why we hold it, who can see it, how long we keep it and how you get rid of it. It is written to comply with the Protection of Personal Information Act, 2013 (POPIA).
1. Who is responsible for your information
ServiceBase is operated by Liam Glasby trading as ServiceBase. In POPIA terms we are the responsible party for the personal information described here.
Our Information Officer is Liam Glasby. Any question, request or complaint about your personal information goes to myservicebase@gmail.com or through the contact form, and we will respond within 30 days.
2. What we collect
We collect only what the service needs to work. We do not buy personal information from anyone, and we do not build profiles of you for advertising.
| Your account | Your name and email address. Your password is handled entirely by our authentication provider and is stored only as a cryptographic hash — nobody at ServiceBase can see or recover it. |
|---|---|
| Your listing (providers only) | Business name, contact name, contact email, phone number, town or city, website, description, services, certifications, years of experience, rates, photos and logo. You choose all of it and you can edit or delete it at any time. |
| Verification documents | If you ask to be verified, the identity or trade documents you upload. These are the most sensitive thing we hold, so they get the strictest handling — see sections 4 and 6. |
| Messages | The content of messages you send to other users through the site, so the conversation is there when you come back to it. |
| What you write to us | If you use the contact form, the name, email address and message you send, so we can answer you and show that we did. |
| Reviews and saved listings | The rating and text of reviews you leave, and which listings you have saved. Reviews are public and show the name on your account. |
| Payment information | For paid listings we store your subscription status and a reference from our payment processor. We never see, receive or store your card number — it goes directly to the processor and never touches our systems. |
| Which pages get used | A count of the pages that are opened and a few actions on them, such as tapping a provider’s phone number. Each row records the page, the action and the day. It does not record who you are, and there is no account, cookie or device identifier attached to it. |
| How often a listing is opened | So that a provider can see whether the listing they pay for is working, we keep a running total per listing per day: how many times it was opened, and how many times someone tapped the phone, email or message button on it. These are totals only — a number in a box. There is no record of who opened a listing, and nothing in these figures can be traced to a person or matched to the page counts above. |
| Crash reports | If a page breaks in your browser, we record the error message and the technical trace of where in our code it happened, so that it can be fixed. This is about our software, not about you: no account, no message content and nothing you typed is included. |
About the page counting. It is our own software running on our own servers. No advertising network, no analytics company and no third party of any kind receives it, and none of it leaves our infrastructure.
We do not store your IP address. Each visit carries two scrambled codes worked out from it, using a secret ingredient that is changed every night. One is worked out from your IP address and your browser together, and is what stops us counting the same person ten times when they read ten pages. The other is worked out from the IP address alone, and exists only to stop one machine flooding the counter with made-up visits — that one is shared by everybody on the same connection, so it groups a household or an office together for the day. The address itself is discarded immediately and never written down, neither code can be turned back into it, and because the ingredient changes daily neither can be matched to the ones you had yesterday. So we can tell that four different people visited on Tuesday. We cannot tell whether any of them had been before, and neither could anyone who took the whole database.
If your browser sends a Do Not Track signal we do not count your visits at all. Crash reports are the one exception and are still sent, because a crash report describes a fault in our code rather than anything about you, and because leaving the site broken for the people who asked for more privacy is not the courtesy it looks like.
Advertising. If you accept marketing cookies (see section 10), we also run the Meta (Facebook) Pixel, so we can tell whether our ads on Facebook and Instagram are actually bringing people to the site. Unlike the page counting above, this one does leave our infrastructure — Meta receives it directly — which is exactly why it only runs once you have said yes, and never before.
3. Why we are allowed to hold it
POPIA requires a lawful basis for processing. Ours are:
- To provide the service you asked for. Publishing your listing, delivering your messages and running your subscription are things you signed up for, and we cannot do them without this information.
- Your consent. Verification documents are entirely optional. You give them to us to get a verified badge, and you may withdraw that consent at any time by asking us to delete them.
- Legal obligation. Records of payments have to be kept for tax purposes, whatever else you ask us to delete.
- Our legitimate interests. Keeping the site secure, preventing fraudulent listings and enforcing our terms.
4. Who can see what
Not everything on your listing is public, and the split is enforced in the database rather than only in the interface.
| Anyone, signed in or not | Your business name, category, town, description, rates, photos, verified badge, star rating — and your contact name, contact email address and phone number. This is the advertisement. It is meant to be found, and a customer can call or email you without making an account first. |
|---|---|
| A warning about that | Because your contact details are public, they can also be collected automatically, the way anything published on the open web can be. We do not stop that and cannot promise to. Put on your listing only what you are content to have publicly visible — a work number rather than a personal one, if that matters to you. |
| Only you | Your verification documents, your saved listings and your messages. Messages are visible to you and the person you are talking to, and to nobody else. |
| ServiceBase administrators | Verification documents, and only to check them against your listing. Access is restricted to accounts holding an administrator role. |
We do not sell your personal information. We do not share it with anyone for their own marketing.
5. Companies that process it for us
Running ServiceBase means using specialist providers. They act on our instructions only, and are what POPIA calls operators.
| Supabase | Database, sign-in and file storage. Effectively everything described in section 2 is stored here. |
|---|---|
| PayFast | Payment processing for paid listings. A South African payment provider. |
| Resend | Sends our email — sign-in confirmations, billing notices, and alerts telling you someone has messaged you. |
| Netlify | Hosts and delivers the website itself. |
| Our business mailbox is Gmail, so anything you send us — including what you write on the contact form — is stored there while we deal with it. | |
| Meta (Facebook) | Receives Meta Pixel events (section 2) so we can measure our own Facebook and Instagram ads, but only from visitors who accept marketing cookies — see section 10. |
Some of these store or process information on servers outside South Africa. POPIA permits this where the receiving country or the provider's contractual commitments give comparable protection, which is the basis we rely on.
6. How long we keep it
POPIA does not allow us to keep personal information for longer than we need it. These are the periods we actually enforce.
| Account and listing | Until you delete your account. Deletion is immediate, not a scheduled queue. |
|---|---|
| Verification documents | Deleted 30 days after your listing is verified. The badge is the record of that decision — once it is made, the document has served its purpose and is removed automatically. |
| Messages | Kept while the conversation exists. If either person deletes their account, their messages go with it. |
| Contact form messages | Six months, then deleted automatically. Long enough to deal with what you raised and to answer for how we handled it. |
| Payment records | Five years, because tax law requires it. These survive account deletion, but they are detached from your account and are not used for anything else. |
| Page counts | 180 days, then deleted automatically. Long enough to compare one month with the last, which is the only question these numbers exist to answer. |
| Listing totals | 180 days, the same as the page counts, and immediately if the listing itself is deleted. |
| Crash reports | Ninety days after the error last happened. By then it is either fixed or gone, and the trace refers to a version of the site that no longer exists. |
7. Your rights
Under POPIA you may:
- Ask what personal information we hold about you, and get a copy of it.
- Have anything inaccurate corrected — most of it you can edit yourself from your profile.
- Have your personal information deleted.
- Object to us processing your information for a particular purpose.
- Withdraw consent you previously gave, such as for verification documents.
- Complain to us, and to the Information Regulator if we do not resolve it.
Deleting your account is the fastest of these and you do not need to ask us: go to your profile settings and use “Delete your account”. It removes your profile, listings, uploaded photos and documents, messages, reviews and saved listings. It cannot be undone.
For anything else, email myservicebase@gmail.com. We do not charge for these requests and we will answer within 30 days.
8. How we protect it
Information is encrypted in transit and at rest. Access is controlled at the database level, so one user's account cannot read another's messages or documents even if the interface were tricked into asking. Verification documents live in private storage that is not reachable by a public link. We never hold your password or your card number.
No system is perfectly secure, and we would rather say so than imply otherwise. If a breach does happen and it puts your information at risk, POPIA requires us to notify both you and the Information Regulator, and we will.
9. Children
ServiceBase is for adults. You must be 18 or older to create an account. We do not knowingly collect information about children, and if we learn that we have, we will delete it.
11. Changes to this policy
If we change how we handle your information we will update this page and the date at the top. Where a change materially affects your rights, we will tell you directly rather than relying on you to notice.
12. Complaints
Please raise it with us first at myservicebase@gmail.com — most things are quicker to fix directly.
If you are not satisfied, you may complain to the Information Regulator (South Africa), which regulates POPIA and can investigate. Their current contact details are published at inforegulator.org.za.