Privacy policy

• We collect what a marketplace needs to work: who you are, what you ordered, and — only if you allow it — where you are while you are browsing.
• We never see your full card number. Card payments happen on our payment provider’s own checkout page.
• We do not sell your personal information, and there are no advertising or tracking SDKs in the app or on this site.
• You can download everything we hold, correct it, or delete your account yourself, from Account Centre.
• Financial records outlive a deleted account by seven years because South African law requires it — but they stop being connected to you.

VarsityAlly Market is a marketplace connecting student and campus-area sellers with the people buying from them. This policy explains what we do with personal information when you use the website or the mobile app, whether you are buying, selling, or just browsing.

It covers everyone: shoppers, sellers, and the staff members a seller adds to their store team. Where something applies only to sellers, it says so.

We ask for information at the point we need it, not up front. Optional fields stay optional, and leaving one blank costs you nothing except the feature that depends on it.

Distance is the whole point of a campus marketplace, so location is the permission we are asked about most.

It is optional, and the product is built to work without it. Decline, and you pick a campus instead — you still see everything, ranked by that campus rather than by where you are standing.

We ask for location only while you are using the app. There is no background location permission, so the app cannot follow you around once it is closed. Coordinates rank what you see at the time of the request; we do not build a location history, and coordinates are stored only when you save an address yourself.

You can withdraw the permission at any time in your device settings, and revoking it does not lock you out of anything.

Card payments are handled by Yoco, a South African payment provider. You are taken to their checkout to enter card details, which means your card number, expiry and CVV never touch our servers or our database.

What we keep is the outcome: the amount, the status, the method, and the reference Yoco gives us, so an order can be matched to a payment and refunded if needed.

For a cash or bank-transfer order we record that the order was placed and how it was to be paid, so the buyer and the seller are looking at the same facts.

We split consent into four purposes, so agreeing to one does not quietly agree to the rest. Each is recorded separately with the date and the policy version, and the record is append-only — we keep the history rather than overwriting it.

We do not sell personal information, and we do not share it with advertising networks or data brokers.

Sellers see only what fulfilling an order requires: what was ordered, your name, and the collection details. They do not see your other orders, or anything you bought from someone else.

We use a small number of service providers to run the platform. They act on our instructions and may use the data only to provide their service to us.

Our servers and file storage are in the United States, and some providers above process data in the United States or the European Union. Using VarsityAlly Market therefore involves your information being transferred outside South Africa.

Where that happens we rely on the contractual commitments those providers make, and everything moves over encrypted connections. If you would rather your information were not processed abroad, we cannot offer the service on those terms — the honest answer is that the platform cannot run without it.

Two rules pull against each other here: personal information should not be kept longer than it is needed, and financial records must be kept for seven years. We resolve that by keeping the record and letting go of the person.

Under POPIA you can ask what we hold, have it corrected, and have it deleted. We would rather you did not have to ask: each of these is a screen you can use yourself, without emailing anyone or waiting on us.

Sign in and go to Account Centre → Your data → Delete account. If you cannot sign in, email us from the address on the account and we will verify you another way.

Because deletion is irreversible we ask you to confirm it deliberately: you prove it is you, we email a confirmation, and you type the confirmation phrase. Some things have to be settled first — an order still in flight, or money owed in either direction — and the wizard tells you exactly what is blocking it and what to do, rather than silently queueing a request that will never complete.

You then have thirty days in which signing back in cancels the deletion. Once that passes, the account is anonymised: your name, contact details, addresses, documents, saved items, preferences and device records are erased, and the transaction records that must survive stop pointing at you.

Deactivation is the gentler option in the same place — it hides your account and stops the notifications without destroying anything.

• Everything travels over encrypted connections (HTTPS/TLS). The mobile app can additionally pin our server certificate.
• Passwords are stored as salted hashes, never in a readable form. Changing your password ends every other session.
• Seller verification documents go to private storage that is never publicly reachable, and access to them is logged.
• Sign-in, verification and deletion endpoints are rate limited, and a reused refresh token is treated as a compromised session.
• Staff access follows the permissions a seller sets for their store team, so a cashier does not silently gain a manager’s view.

VarsityAlly Market is built for university communities and intended for people aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will remove it.

When this policy changes we publish the new version here with a new version number and date. Where a change is material we will tell you in the app or by email rather than relying on you to re-read the page.

Your consent records are versioned against the policy text in force when you gave them, so it is always possible to establish what you actually agreed to.

For anything in this policy — a question, a correction, a request, or a complaint — email us and a person will answer.

If you are not satisfied with how we have handled it, you are entitled to complain to the Information Regulator (South Africa), the authority that oversees POPIA. Doing so needs no permission from us and does not affect your account.