Privacy Policy

Last updated 6 May 2026 · ZaFlip is operated by AquaSoft, Stellenbosch, South Africa

Plain language: we collect the minimum personal info we need to run a marketplace, we don't sell it, and you can ask us to delete it. This policy is written to comply with South Africa's Protection of Personal Information Act (POPIA).

1. Who we are

ZaFlip ("we", "us", "the marketplace") is a service operated by AquaSoft (Werner Swanepoel, Stellenbosch, South Africa) that connects buyers and sellers of South African web domains. For any privacy-related question or request, email info@zaflip.co.za.

2. What information we collect

We only collect what we genuinely need to run the marketplace and process payments:

  • Account info — your email address, a hashed password (we never see or store the plain text), your chosen display name, and (for sellers) the PayPal email address where we'll send your payout when a domain sells.
  • Listing info — for sellers: the domain you're listing, your description, asking price, and a one-time DNS verification token used to prove ownership.
  • Offer and transaction info — when you make or receive an offer, we record the amount, the buyer/seller IDs, and timestamps. When a buyer pays via PayFast, we receive a payment confirmation but never see card numbers — those go directly to PayFast.
  • Audit log — administrative actions on listings (create/verify/approve/withdraw) are logged for accountability.
  • Technical data — your IP address, browser user-agent, and pages visited, retained briefly in server logs for security and debugging.
  • Cookies — a session cookie to keep you logged in, an antiforgery cookie to protect form submissions, and (if enabled) anonymous usage analytics.

3. Why we collect it (lawful basis under POPIA)

  • Contract performance — most of the data we collect is necessary to provide the service you signed up for: listing a domain, making an offer, processing a sale, paying a seller.
  • Legitimate interests — server logs and audit logs help us detect fraud, prevent abuse, and resolve disputes.
  • Legal obligation — we retain transaction records as required by South African tax and accounting law.
  • Consent — we only send you marketing or newsletter emails if you explicitly opt in (e.g. via the subscribe form). You can opt out at any time.

4. Who we share it with

We share the minimum necessary data with the following processors:

  • PayFast (Cape Town, South Africa) — for buyer payments. PayFast receives your email, the transaction amount, the listing reference, and the buyer's payment-card details (which we never see).
  • PayPal — when a seller is paid out, we manually send the payout to the seller's nominated PayPal email. PayPal sees the payee's email and the amount.
  • Microsoft Azure (South Africa North datacenter) — hosts our application and stores the database. Azure is bound by Microsoft's POPIA-compliant data processing terms.
  • Google Search Console + Bing Webmaster Tools — receive aggregate, anonymous data about which of our pages are indexed and how they perform in search.
  • Google Analytics 4 (only if currently enabled — check the page source for a gtag snippet) — receives anonymous usage data: pages viewed, approximate location, device type. Personal identifiers are not sent.
  • Public DNS resolvers — when a seller verifies domain ownership, we make outbound DNS queries (e.g. to Google's 8.8.8.8). Only the domain name is sent; no personal data.

We do not sell, rent, or trade your personal information to third parties for marketing.

5. Cross-border data transfers

Your data is primarily stored in Azure South Africa North. Some operational systems (email delivery, analytics) may process data in Microsoft and Google datacenters in the European Union or United States. POPIA permits these transfers when the receiving party is bound by laws or binding corporate rules that provide an adequate level of protection — both Microsoft and Google qualify.

6. How long we keep it

  • Active accounts — for as long as you're signed up. You can delete your account at any time.
  • Listings — withdrawn or sold listings are kept for audit purposes; the domain field stays visible (it was public anyway when listed) but personal seller info is unlinked on request.
  • Transaction records — kept for a minimum of 5 years to comply with South African tax law.
  • Server logs — rotated and deleted after 90 days unless flagged for security investigation.

7. Your rights under POPIA

You have the right to:

  • Access — request a copy of the personal information we hold about you.
  • Correction — ask us to fix inaccurate or incomplete information.
  • Deletion — request that we delete your account and personal information (some transaction records may need to be retained for legal compliance — we'll explain what stays and why).
  • Object — object to specific uses of your data (e.g. unsubscribe from marketing email).
  • Portability — request your data in a machine-readable format.
  • Complain — lodge a complaint with the South African Information Regulator if you believe we've mishandled your information.

To exercise any of these rights, email info@zaflip.co.za. We respond within 30 days.

8. Security

All traffic to and from ZaFlip is encrypted via TLS (HTTPS). Passwords are stored as salted hashes, never plaintext. The database is in Azure with managed backups and access restricted to the application. We do not store payment card information — PayFast handles all payment processing under its own PCI-DSS compliance.

That said, no system is perfectly secure. If we ever experience a breach affecting your personal information, we'll notify you and the Information Regulator within the timeframes POPIA requires.

9. Children

ZaFlip is not directed at children under 18. If you're under 18, please don't use the marketplace. If we learn we've collected information from a child, we'll delete it.

10. Changes to this policy

We may update this policy as we add features. Material changes will be announced on the home page and (if you're a registered user) emailed to you. The "Last updated" date at the top reflects the most recent change.

11. Contact

Email: info@zaflip.co.za
Postal: AquaSoft, Stellenbosch, Western Cape, South Africa