Privacy Policy | ActuallyFind

1. Who we are

This policy explains what personal information ActuallyFind collects, why, who it is shared with and what your rights are under the Protection of Personal Information Act (POPIA).

ActuallyFind is run by Edward Baitsewe as a sole proprietor, who is the responsible party and the Information Officer.

9 Arnold Wilhelm Street, Parow East, Western Cape, 7500
Email: info@actuallyfind.com
Legal process and physical correspondence: edward@actuallyfind.com

2. What we collect

Your account: your name, email address, phone number and password. Passwords are stored hashed with Argon2id, a one-way process: nobody, including us, can read them back. When you choose a password, we check it against known leaked passwords with Have I Been Pwned; only the first 5 characters of a hash of it leave our server, never the password.

Signing in with Google: Google sends us your name, email address and profile picture. We keep your name and email address and an ID that links your Google account; we don't keep the picture.

Your listings: the vehicle's details, photos, VIN, and the city and province it is in. The VIN is used only to check the vehicle and to stop the same vehicle being listed twice. We don't ask for your street address.

Phone-number reveals: when someone views a seller's phone number, we record which account did it, when, and from which IP address, so sellers can see the interest and we can stop misuse.

Listing views and shares: when you view or share a listing, we record it with your IP address, so we can give sellers an accurate count and leave out bots and search-engine crawlers. A seller viewing or sharing their own listing isn't counted.

Your watchlist: the listings you save.

Go Managed payments: Paystack collects your card details on its own page; we never see or store your card number. Paystack gives us a card token and customer code so it can charge Go Managed's monthly payments 2 and 3, plus the email address on the card. The token is useless without our Paystack account. We keep a record of each payment: amount, date, outcome and Paystack reference.

City suggestions: if you can't find your city and use the “Can't find your city?” option, we send the place name you type and the province you choose to Anthropic and OpenAI, our artificial-intelligence service providers, only so they can tell us where that place is. Nothing else about you goes with it. We keep what you typed, the answer and which account asked, so we can add the place to our list and limit each account to three suggestions a day. Because these providers are based outside South Africa, that place name is processed outside South Africa.

What you agreed to: which version of our Terms and this policy was in force when you signed up or bought Go Managed, and when; for Go Managed, also when you agreed that it starts immediately, and the wording you saw.

Email delivery: if emails to your address bounce or are reported as spam, our email provider tells us and we stop sending to that address.

3. Who can see what

Anyone: your listings, with the vehicle's details, photos, price, and its city and province.
Signed-in users with a verified email address and a phone number on their profile: your phone number, when they ask to see it.
Only us: the VIN, your email address, and the logs described above. Sellers see counts of views and phone-number requests, not who made them.

4. Why we use it

To run your account and show your listings (to provide the service you signed up for).
To let buyers contact sellers.
To take Go Managed payments and send receipts.
To send emails your account needs: verification, password resets, listing expiry, receipts and payment problems.
To keep the site safe and stop fraud, duplicate listings and misuse (our legitimate interest).
To keep the records the law requires, for example for tax.

We don't sell your information and we don't send marketing emails. If we ever do, it will only be to people who ask for them, with a way to unsubscribe.

5. Service providers

We use these companies to run the site. They only get what they need to do their part.

Hostinger: our servers and mailboxes, in Europe and the USA.
Cloudflare: our domain, security and photo storage.
Amazon SES: sends the site's emails.
Paystack: card payments for Go Managed.
Google: “Sign in with Google”, if you use it.
Have I Been Pwned: the leaked-password check described above.
Anthropic and OpenAI: city suggestions, as described above.

Several of these providers process information outside South Africa. We use them because the site can't run without these services, and only for the purposes above (POPIA section 72).

6. Cookies and browser storage

We only use cookies the site needs to work. There are no advertising or analytics cookies.

Session cookie: keeps you signed in. Deleted when you sign out or after a period without activity.
XSRF-TOKEN: protects forms against forgery.
cookie_notice_dismissed: remembers that you closed the cookie notice, for 6 months.

Your browser also keeps the location you filter searches by (until you clear it), and, while you edit a listing, the photos you are adding (removed once you save).

7. How long we keep it

Your account: until you ask us to close it.
Listings: a listing that is sold, taken down or expired is deleted 90 days later. A deleted listing disappears from the site, but we keep a record of it, including its VIN, to stop the same vehicle being listed twice and to help investigate fraud, until your account is closed.
IP addresses in view, share and phone-number reveal records: 90 days, then removed. The counts stay.
Payment records: 5 years from the date of the tax return they relate to (Tax Administration Act, section 29), even after your account is closed.

Closing your account: email info@actuallyfind.com from the address on the account. Within 30 days we delete the account, its listings and the information above, except payment records, unless legal action involving the account is pending.

8. Keeping it safe

The site uses HTTPS, passwords are hashed, login attempts are limited, and only we can reach the database and stored files. No system is perfectly secure; if a breach puts your information at risk, we will tell you and the Information Regulator as POPIA requires.

9. Your rights

You can ask us:

what personal information we hold about you, and for a copy;
to correct or delete it;
to stop using it, where you have the right to object (POPIA section 11(3)).

Email info@actuallyfind.com. We may ask you to confirm who you are first. Our PAIA manual explains formal requests for records.

If you're not happy with how we handled your information, you can complain to the Information Regulator:

Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Complaints: POPIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za, 010 023 5200
Website: inforegulator.org.za

10. Children

Accounts are for people aged 18 and over. We don't knowingly collect information about children.

11. Changes to this policy

If we change how we use your information in an important way, the next time you sign in you'll see a notice of the change with a link to the new version, and you'll be asked to accept it before you carry on. We record when you accept. Small corrections just change the date at the top.

12. Contact

Questions about this policy or your information: info@actuallyfind.com. Legal process and physical correspondence: edward@actuallyfind.com.