Privacy Policy

1. Categories of Personal Information Collected (POPIA Section 18)

We collect and process only the minimum personal information necessary to deliver the Candibean service:

• Identity & Contact Information: Your full name, email address, South African mobile contact number, and optional profile photo. When you invite friends to join a collaborative Group POT by email, your name and the POT invitation details are displayed to the invited participant so they can verify the invitation before accepting.
• Account & Closed-Loop Ledger Records: Your Prepaid Value balance, active Membership Pass tier (Starter Pass, Premium Pass, or Pay-As-You-Go), Group POT contributions and exits, event ticket QR codes, Uber Ride Voucher requests, Vibe Coin balance, and referral code activity.
• Device Telemetry, Push Notifications & App Diagnostics: Device model, Android OS version, Firebase Cloud Messaging (FCM) push notification token, Google Advertising ID (com.google.android.gms.permission.AD_ID), and crash diagnostics used strictly to deliver real-time ticket/voucher alerts, prevent duplicate or fraudulent redemptions, and maintain app stability. Candibean never sells your personal data or Advertising ID to third-party advertisers.

2. Biometric Security & Special Personal Information (POPIA Section 26)

To protect your Prepaid Value, tickets, and Uber Ride Vouchers against unauthorized device access, the Candibean Android app provides an optional Biometric App Lock (fingerprint or facial recognition):

• Strictly Local On-Device Hardware Processing: Biometric authentication is executed exclusively on your device using Android's system-level BiometricPrompt API and hardware-backed Android Keystore (Trusted Execution Environment / Secure Element).
• Zero Server Collection or Storage: Candibean never collects, reads, transmits, or stores your fingerprint templates, facial recognition data, or raw biometric identifiers on our servers or in any cloud database. Our app receives only a local cryptographic pass/fail result from your Android operating system.

3. Purpose & Lawful Basis for Processing (POPIA Sections 11 & 13)

We process your personal information strictly on lawful bases under POPIA Section 11:

• Contractual Performance: To register and authenticate your account, allocate closed-loop Prepaid Value, administer Group POTs (including POT contributions, leader disbandments, and individual 10% early exit calculations), issue event tickets and Uber Ride Vouchers, and manage Vibe Coins and Referral rewards.
• Transaction Integrity & Fraud Prevention: To enforce cryptographic idempotency keys (preventing double charges during internet disconnections), verify dynamic event ticket QR codes, and protect accounts against unauthorized access.
• Statutory & Tax Obligations: To maintain verifiable financial and accounting records as mandated by South African tax legislation.

4. Payment Processing & Third-Party Operators (POPIA Sections 20, 21 & 72)

Candibean engages trusted, contractually bound operators under POPIA Section 21:

• Paystack Payments (A Stripe Company): All card, EFT, and subscription pre-payments are processed directly through Paystack, a PCI-DSS Level 1 certified payment gateway. Candibean never collects, sees, or stores your full debit/credit card numbers, CVV security codes, or internet banking PINs.
• Google Firebase (Google Cloud Platform): Used for encrypted authentication, Firestore database hosting, Cloud Functions execution, and push notifications. Where data is processed on cloud servers outside South Africa, transfers are protected by binding data-protection agreements and standard contractual safeguards in compliance with Section 72 of POPIA.

5. Security Safeguards (POPIA Section 19)

We implement bank-grade technical and organizational security safeguards to protect your personal information against loss, damage, or unauthorized access:

• 256-Bit AES-GCM Local Encryption: Sensitive session states and local preferences on your Android device are encrypted using Android Jetpack Security (EncryptedSharedPreferences) backed by master keys stored in the Android Hardware Keystore.
• TLS Encryption in Transit: All network communication between the Candibean mobile app, Firebase Cloud Functions, and Paystack is encrypted via HTTPS/TLS.
• Server-Side Atomic Ledger & Role-Based Access: All financial calculations and balance updates occur strictly inside server-side Cloud Functions with role-based access controls and immutable audit logs.

6. Data Retention & Account Deletion (POPIA Sections 14 & 24)

• Active Accounts: We retain your profile data only for as long as your Candibean account remains active.
• Account & Data Deletion: You may permanently delete your account at any time inside the Android app (via Profile → Personal Information / Delete Account) or online via our Account Deletion Portal. Upon deletion, your personal profile, login credentials, and active app session data are immediately purged.
• Statutory Accounting Retention: In compliance with Section 29 of the South African Tax Administration Act (Act 28 of 2011), anonymized historical transaction and invoice records are retained securely for five (5) years solely for tax and audit compliance before permanent destruction.

7. Your POPIA Rights & Contact Information

Under Sections 23 to 25 of POPIA, you have the right to request access to your personal information, request correction or deletion of inaccurate data, object to processing, or withdraw consent at any time:

• Information Officer & POPIA Compliance Desk: info@candibean.co.za
• Customer Support Desk: support@candibean.co.za
• Physical Address: 41 Juta Street, Braamfontein, Johannesburg, Gauteng, 2001, Republic of South Africa
• Information Regulator (South Africa): You also have the right to lodge a complaint with the Information Regulator at inforeg@justice.gov.za or complaints.IR@justice.gov.za (JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001).