Privacy Policy

Who we are

Decluttering Solutions (Pty) Ltd is the “responsible party” for your personal information. That means we decide why and how it is processed. Our Information Officer is Petrus Johannes van Vuuren (Johan van Vuuren). His registration with the Information Regulator is in progress.

Company

Decluttering Solutions (Pty) Ltd, trading as Decluttering

Registration number

2026/697223/07

Information Officer

Petrus Johannes van Vuuren (Johan van Vuuren)

Physical address

177 Nkwe RoadTierpoort0056

Phone

078 902 5258

Email

support@decluttering.co.za

Website

decluttering.co.za

What this policy covers

Decluttering is an online marketplace where people in South Africa buy and sell goods, most of them second-hand. Buyers pay sellers directly: we do not receive or hold buyers’ money. This policy covers everyone who uses the website, whether you browse without an account, buy, sell, or do all three. Our Terms of Use explain the rules of the marketplace, and our Cookie Notice explains the cookies we use.

What we collect and why

We only collect what we need to run the marketplace and to make trading on it safer. For each kind of information, here is what we collect and why.

Your account and sign-in

What: your email address, and a record of each sign-in session. You sign in with a one-time code sent to your email, or with Google or Apple. If you use Google or Apple, they tell us only your email address and that they have confirmed it. With Apple’s “Hide My Email”, that is a private relay address that forwards to you. We do not receive your Google or Apple password, contacts or other data. If you use Apple, we also keep a token Apple gives us, encrypted, so that when you delete your account we can tell Apple to end the link between your Apple ID and Decluttering. We use it for nothing else. We do not use passwords.

Why: to create your account, sign you in, and contact you about your account, listings and orders.

Your profile

What: the display name you give us, your shop link name (the handle in your /s/ shop address), the date you joined, and statistics about your sales and reviews, and, if you buy, how many purchases you cancelled, didn’t pay for in time, or didn’t collect after the seller accepted. The area shown beside a seller’s name is not a separate detail you give us: it is the suburb and city of the address the seller chooses for buyers to collect from (see Addresses and contact numbers below).

Why: so buyers and sellers know who they are dealing with and roughly where an item is, and so sellers can judge how reliable a buyer is.

Identity verification

What: sellers must verify their identity before their first listing. Buyers may choose to verify, and must do so to buy from a seller who sells only to verified buyers. Verification is done by our provider, Didit, in a window on our verification page. You give Didit photos of your South African identity document, a selfie and a short video of your face, and a code sent by SMS to your phone. Didit reads your ID number and the other details from the document, checks that the document is genuine, and matches your face to the photo on it. Didit also receives technical information about the device and connection you use for the check, such as your internet (IP) address. Didit keeps the document images, the selfie and the video for 12 months. Didit sends us the result, and we keep your verified name, South African ID number, date of birth, phone number, the country of your document, and the reference and outcome of the check. We do not keep copies of the images or the video.

Why: to confirm that every seller, and every buyer who verifies, is a real, identifiable adult, to stop one person opening several accounts, to prevent fraud, and to have records we can give to the authorities when the law requires it. Once a seller accepts an order, we also show the other person on that order your verified name, so each of you knows who you are dealing with (see What other users can see).

Matching your selfie and video to your identity document uses biometric information, which POPIA treats as “special personal information”. We process it only with your consent. Before the check opens, we ask you to agree to Decluttering and Didit processing your ID document, ID number, phone number, and your biometric selfie and video to verify your identity, and we keep a record of that consent and of the wording you agreed to. You can withdraw your consent at any time by contacting us. If you do, you will not be able to sell until you verify again.

Our second check: after Didit approves you, a member of our team checks the result again. They view the document images, the selfie and the video, which we fetch from Didit for that review without saving copies, and compare them with the details Didit read. You can use your account while this happens. If our team finds a problem, for example a document that is not genuine or a face that does not match, we suspend your account and remove your verified status. We also put the ID number, in scrambled (hashed) form, on our blocked list, with a record of why, so that the identity cannot be used to verify another account. A member of our team can remove an ID number from the list, and must record why. To be verified again, you must complete a new identity check.

Changing your phone number: to change the phone number on your account, you complete a new identity check with Didit, which sends a code to the new number. Our team checks that result again too. We do not ask for proof of your address, and changing your address does not need a new check.

If someone else tries to take over an account: if the new check for a phone change shows a different person from the account holder, the phone number is not changed, and our team reviews what happened. We keep the phone number that was used, and that person’s ID number only in scrambled (hashed) form. If our team confirms that someone tried to take over the account, we suspend the account and put the account holder’s ID number on our blocked list, and the other person’s too, where the check could read the other person’s ID number.

Bank details for direct payments (sellers)

What: the account holder name, bank, account number and branch code you give us, and the bank account confirmation letter you upload as proof.

How we check them: when you submit or change your bank details, our AI provider, Anthropic, reads the letter and tells us what it shows: the account holder’s name, the account number, the bank and branch code, and your ID number if the letter shows it (see How we use AI). We then check the letter against your verified name and ID number, and the account number on the letter against the one you typed. Where the AI could read the letter, this check runs inside our own systems, and we keep its results, and the name, bank and branch code read from the letter, with your submission. Where it could not, a member of our team reads the letter and does the check. Your verified ID number is never sent to the AI. We keep the letter itself, but do not separately store the ID number or account number read from it.

A member of our team reviews every submission, including your first and every change, before it is used, and we keep a record of every submission, including ones we rejected and why. Until a change is approved, buyers keep seeing your previously approved details. When a buyer places an order with you, the approved details at that moment are fixed onto the order, so a later change never alters what an existing order shows.

Why: so a buyer paying you directly knows where to send the money, and so our team can check that the account is in your name, or in the name of your registered business on Decluttering, before any buyer sees it. Who can see these details is explained in What other users can see.

Addresses and contact numbers

What: the addresses you save, with the contact name and mobile number for each; the Courier Guy locker or kiosk a seller drops parcels at; the locker a buyer chooses for an order; and, if you buy without a phone number verified by our identity check, the mobile number you give us for an order, at checkout or on the order page. We cannot check that number by SMS, so it is shown as “not verified”.

Why: to show roughly where an item is and, for a seller, the area shown beside their name (only the suburb and city of the address buyers collect from, never the street address), to tell the courier who to contact about a parcel, to let the seller of an order reach the buyer to arrange the collection or book the courier, and to get courier prices for delivery.

Listings and photos

What: the photos, title, description, price, condition, category and area of each item you list.

Why: to show your items to buyers, and to check listings against our rules.

Orders and payments between users

What: what you bought or sold, prices, the delivery or collection choice, courier price quotes, any tracking reference you add, the proof of payment a buyer uploads, each step of the order (such as acceptance, confirmation of payment and receipt), and the fees we invoice to sellers. We do not take card payments and do not receive any card details.

Why: to run your orders, keep a record both of you can rely on in a dispute, invoice our fees, and meet our legal and tax obligations.

A log of who saw bank details, names and phone numbers

What: each time a buyer is shown a seller’s bank details on an order, or a buyer or seller is shown the other person’s verified name or phone number on an order, we record who was shown it, which order, when, and whether it was a name, a phone number or bank details.

Why: to protect buyers and sellers, and to look into fraud or misuse of these details.

Messages and offers

What: the messages and images you send other users, and the offers and counter-offers you make. Phone numbers, email addresses, bank account numbers and phrases like “WhatsApp me” are hidden automatically, and the other person is shown the message with those details hidden. We keep the original text as well.

Why: to let buyers and sellers talk, keep deals where we can help if something goes wrong, and look into scams, abuse, reports and disputes.

Disputes and reports

What: what you tell us in a dispute or report, the photos and files you upload as evidence, and records of how it was decided, including a seller’s report that a buyer didn’t collect an order, and the buyer’s reply.

Why: to resolve problems fairly and protect users from fraud.

Reviews

What: the ratings and comments you give and receive after an order, and any reply.

Why: to help people decide whom to trade with.

Your location

What: only if you allow it in your browser. “Near me” uses your location to find listings close to you, and, when you list an item for courier delivery, to find Courier Guy kiosks and lockers near you. We use it for that search and do not save it. For the kiosk and locker search we round it to about 1 km before asking the courier, and keep the list of kiosks for that area for a week, not linked to you. Where live location sharing is available for a collection, you can choose to share your current location with the other person on that order. We keep only your latest position, and delete it when you stop sharing or when the handover ends or is cancelled. Live location sharing is not available on direct sales.

Why: to show nearby items and kiosks and lockers, and to help buyer and seller find each other at a meetup.

Device and fraud-prevention information

What: while you are signed in, we record a scrambled (hashed) summary of your browser type, screen size, time zone and language, together with your browser’s description of itself. We make this record when you open any page in your account area and no more than once an hour for the same browser. We do not make it while you are signed out. We also check whether an ID number, bank account number, phone number or device is already linked to another account.

Why: to detect one person running several accounts, and other patterns that point to fraud.

AI credits

What: a record of the AI credits you receive and use.

Why: to apply the daily AI credit rules in our Terms of Use.

Support requests and feedback

What: what you send us when you ask for help or give feedback.

Why: to answer you and improve the service.

Listing views

What: when you open a listing, we count one view for that listing per person per day. To tell whether you have already been counted today, we make a scrambled code (a keyed hash) from your account number if you are signed in, or from your internet (IP) address and your browser’s description of itself if you are not, together with the listing and the date. The code cannot be turned back into your address, browser or account, changes every day, and is deleted after two days. We keep only the number of views per listing per day. We set no cookie for this. The seller’s own visits are not counted, and only the seller (and our team) can see the numbers.

Why: to show sellers how often their listings are seen.

Technical and error information

What: our web server keeps a log of the requests it receives, including your internet (IP) address, the page asked for, the time, and your browser’s description of itself. We keep these logs for up to 90 days. We also use your IP address for a short time to limit repeated sign-in attempts, and do not save it for that purpose. When something goes wrong, our error-tracking service records technical details of the fault, the type of browser and device, the addresses of the pages involved, and internal reference numbers, such as an order or account number (not your name or email address). We remove cookies, form contents and anything after the “?” in a web address before this information is sent.

Why: to keep the website working and secure.

Your agreement to our terms

What: a record that you confirmed you are 18 or older and accepted our Terms of Use and this policy, with the version and the date.

Why: so we can show what you agreed to, and when.

How we use AI

We use one AI service provider, Anthropic, the company that makes Claude, for four things. Apart from the bank details and letter described below, we do not send your name, email address or account details with any of them.

• Listing drafts from photos (optional). If you ask for an AI draft, we send up to four of the photos you choose, and nothing else, to Anthropic, which suggests a title, description, category and price range. You can edit or ignore the draft, or write your listing yourself without using AI.
• Listing screening. When you publish a listing, and when you change a live one, we send its title, description, price and category, and up to four of its photos, to Anthropic to check it against our rules. A listing the check flags is held, and does not go live until our team has reviewed it.
• Message moderation. After contact details are hidden, we send the text of each message to Anthropic to look for scams, harassment and abuse. This does not block or delay your message. Our team reviews flagged messages and messages that users report, seeing the text with contact details still hidden, and may remove a message that breaks our rules.
• Bank account confirmation letters (sellers). When you submit or change your bank details for direct payments, we send the confirmation letter you upload, with the account holder name, bank, account number and branch code you typed, to Anthropic. Anthropic tells us how well the letter matches what you typed, and what the letter itself shows, including your ID number if it is printed on the letter. We do not send Anthropic the ID number from your identity verification: we compare it with the ID number on the letter inside our own systems, in scrambled (hashed) form. The result is a guide for our team, never an automatic decision: a person approves every submission and every change.

See Sending information outside South Africa for where Anthropic processes information.

Automated decisions

Some decisions are made automatically, based on rules. They are:

• A listing the AI check flags, or a listing priced far below the price range its AI draft suggested, is held for a person to review instead of going live straight away. If the AI check is unavailable, the listing also waits for a person.
• A buyer cannot have more than 5 orders waiting for payment at once.
• An order lapses if the seller does not accept it, or the buyer does not upload proof of payment, in time.
• Identity verification can be refused if Didit cannot confirm that the document is genuine or that your face matches it, the details do not match, the document is not South African, you are under 18, the identity is already verified on another account, or our team has flagged the identity.

You can ask for a person to review any of these decisions and tell us your side. Contact us using the details below.

Our lawful basis

POPIA allows us to process personal information on these grounds:

• To carry out our agreement with you (your account, listings, orders, messages, disputes and our fees).
• To meet our legal obligations, for example financial and tax record-keeping, and responding to lawful requests from the authorities.
• For our legitimate interests, or those of other users, in making the marketplace safer: verification, checking bank details, fraud prevention, screening, moderation, security and error tracking. We only rely on this where it does not override your own interests.
• With your consent, for biometric matching during identity verification, optional AI drafts from your photos, and sharing your location. You can withdraw consent at any time, but that does not affect what we did before, and some features will then not be available to you.

You can object to processing that relies on our legitimate interests. See Your rights.

What other users can see

Some information is visible to other people, because the marketplace needs it:

• Anyone, including people without an account: your listings and their photos, your display name, when you joined, whether your identity is verified (a “Verified” badge), your shop page, and published reviews. If you sell, they also see the suburb and city of the address buyers collect from, but never its street address. Listing pages can be found by search engines.
• The other person on an order or conversation: your messages (with contact details hidden), your offers, and the details of the order, such as the delivery choice and any tracking reference.
• The buyer on a seller’s order: the seller’s bank account holder name, bank, account number and branch code. A buyer sees these only after the seller has accepted the order, and only while the order is open. We stop showing them once the order is completed or cancelled, and we log every time they are shown. A buyer who chose to pay in cash when they collect is not shown them.
• The buyer and the seller of an order, once the seller has accepted it: each other’s display name, whether your identity is verified and, if it is, your full name as it appears on your identity document. Your display name and “ID verified” badge stay on the order. Your full name is shown only while the order is open, from acceptance until it is completed or cancelled. We log every time it is shown. If you sell as a business, this is the verified name of the person who verified the account.
• Phone numbers on an accepted order. On a collection order, the buyer and the seller each see the other’s phone number, to arrange the collection. This is the number verified by our identity check or, for a buyer who has none, the mobile number the buyer gave for that order, marked “not verified”. On a courier order, the seller sees the name and mobile number the buyer chose for the courier (or the buyer’s own number if there is none), to book the parcel. The buyer is not shown the seller’s number. Numbers are shown only to the other person on that order, only while it is open, and we log every time one is shown.

Apart from an order as described above, we never show your ID number, email address, phone number or full name to other users, and we never show a buyer’s bank details to anyone.

Service providers and other recipients

We do not sell your personal information. We share it only with these service providers (“operators” under POPIA), who act on our instructions and must keep it confidential and secure:

If you sign in with Google or Apple, that company processes the sign-in under its own privacy policy, as its own responsible party. Our emails use a font from Google Fonts, so opening one of our emails may connect your email app to Google.

We may also share personal information:

• with the police, courts, regulators or other authorities when the law requires it, or to protect people from fraud or harm. We keep a record of every such request;
• with our professional advisers, such as lawyers, auditors and accountants, who must keep it confidential; and
• with a buyer of our business, or of part of it, if that ever happens. The buyer would have to keep to this policy.

Sending information outside South Africa

Some of our service providers process or store information outside South Africa:

• Anthropic, Resend, Google and Apple: in the United States;
• Sentry: in the United States or the European Union;
• Didit: in the European Union, in Ireland; and
• Cloudflare: our backups may be stored outside South Africa.

Section 72 of POPIA allows us to send personal information to another country only in certain cases. We rely on these:

• we require each provider to be bound by a written agreement, or by laws or binding rules, that give your information protection substantially similar to POPIA, including limits on sending it on again;
• the transfer is necessary to carry out our agreement with you (for example, to send your emails); or
• you have consented to it, as you do for identity verification.

For identity verification, Didit processes your information in Ireland, where the European Union’s General Data Protection Regulation (GDPR) applies, and under a data processing agreement with us. We rely on these as giving your information protection substantially similar to POPIA, and on your consent.

How we protect your information

We take reasonable technical and organisational steps to protect your information. Among them:

• ID numbers and bank account numbers are stored encrypted. A seller’s full account number is shown only to the buyer of an accepted, open order, and every time it is shown is logged.
• To spot duplicate accounts, we compare ID numbers, bank account numbers and device details in a scrambled form (a keyed one-way hash), not as readable numbers.
• Database access rules mean a signed-in user can reach only their own private records. Staff access to identity records is limited and logged.
• We do not use passwords. Sign-in codes are stored scrambled and expire after 10 minutes. The sign-in cookie cannot be read by scripts on the page.
• We do not take card payments, so we hold no card details.
• Our website is served over encrypted (HTTPS) connections.
• Error reports are cleaned of cookies, form contents and web address details before they are sent.

No system is completely secure. If we believe someone has gained access to your personal information without authority, we will tell you and the Information Regulator as POPIA requires.

How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, or as long as the law requires. Our retention periods are:

When we no longer need information, we delete it or remove the details that identify you. We may keep it longer if we need it for an open order, a dispute, a claim or an investigation, or if the law requires it.

Your rights

Under POPIA you have the right to:

• ask whether we hold personal information about you, and for a copy of it;
• ask us to correct information that is wrong, incomplete or out of date;
• ask us to delete information we are no longer allowed to keep;
• object to processing that relies on our legitimate interests;
• withdraw a consent you have given;
• ask for a person to review a decision made automatically (see Automated decisions); and
• complain to the Information Regulator.

You can change your display name and your saved addresses (which set the area shown beside your name) yourself in your account, and turn email notifications off in your notification settings. You can delete your account yourself from your Profile (see how deleting works). For anything else, email support@decluttering.co.za. You may use the forms in the POPIA Regulations, but you do not have to. We will need to confirm your identity before we act on a request, and we will reply within 30 days. Requests for records are handled under our PAIA manual.

We may not be able to delete everything straight away. For example, we must keep financial records for as long as the law requires, and we cannot delete an order that is still in progress or under dispute.

Complaints to the Information Regulator

If you are unhappy with how we handle your personal information, please contact our Information Officer first so we can try to put it right. You also have the right to complain to the Information Regulator:

• Complaints email: POPIAComplaints@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za
• Phone: 010 023 5200, or toll-free 0800 017 160
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Website: inforegulator.org.za

Direct marketing

We do not send direct marketing. The emails and notifications we send are about your account, listings, orders, messages, watched items, disputes and invoices. You can switch email notifications off in your notification settings, but sign-in codes are always sent by email. If we ever want to send you marketing, we will ask for your consent first, and every marketing message will include a way to opt out.

Children

Decluttering is for adults only. You must confirm that you are 18 or older before you can use your account, and identity verification refuses anyone whose ID number shows they are under 18. We do not knowingly collect personal information about children. If you believe a child has given us personal information, please contact us and we will delete it.

Changes to this policy

We may update this policy, for example when we add a feature or a service provider. We will show the date of the change at the top of the page. For a material change, we will email you at least 14 days before it takes effect.

Contact us

For any question about this policy or your personal information, contact our Information Officer:

Company

Decluttering Solutions (Pty) Ltd, trading as Decluttering

Registration number

2026/697223/07

Information Officer

Petrus Johannes van Vuuren (Johan van Vuuren)

Physical address

177 Nkwe RoadTierpoort0056

Phone

078 902 5258

Email

support@decluttering.co.za

Website

decluttering.co.za