Privacy Policy

ExoticPassport is the responsible party for your personal information under the Protection of Personal Information Act (POPIA).

Service

ExoticPassport, exoticpassport.co.za

Email

lourens@siesbru.co.za

Your account

Your name, username, email address and country, and the details that let you sign in. If you sign in with Google, Google gives us your name and email address. Passwords are handled by our sign-in provider: we never see them.

Your animals

Species, morphs, sex, birth or hatch date, weights and lengths, feeding, shed and care records, notes, photos and lineage, and breeding records such as pairings, clutches and your breeding journal.

Verification and trust

Verification requests and the notes you add to them, reviewers' decisions, tiers, badges, roles, and expert applications, including the credentials you describe.

Payments

The amount, date and reference of what you buy and, for plans, a token PayFast gives us so renewals can be charged. PayFast collects your card details: we never receive them.

The Showroom

Your listings (the animal, price, province and town, your description, and a WhatsApp number if you add one), the enquiries you send (your message and the phone number or email address you choose to share), and reports.

Transfers

Who offered which animal to whom, and any note on a claim link.

Technical information

Your IP address while you use the app, to slow down abuse (it isn't stored in our database); the cookies that keep you signed in; the address your device gives us for push notifications, if you turn them on; and the record our sign-in provider keeps of recent sign-ins (device, browser and approximate location) to protect your account.

• To run ExoticPassport for you: your account, passports, cards, care reminders, transfers and plan.
• To verify animals, keep records trustworthy, and spot fake records, duplicate accounts and abuse.
• To take payments and keep the records the law requires.
• To introduce buyers and sellers in the Showroom, when you list an animal or send an enquiry.
• To send you notifications in the app and, if you allow it, on your phone.
• To understand how ExoticPassport is used, from totals such as how many keepers registered an animal this month, so we can improve it. These totals don't single anyone out.
• To meet our legal obligations, and to protect members' safety and our rights.

POPIA lets us do this because it is needed to give you the service you signed up for, because you agreed (to push notifications, or to share contact details with a seller), because the law requires it, or for legitimate interests such as keeping ExoticPassport secure, which never override your rights.

We don't sell your information, and we don't use it for advertising.

• Anyone can open an animal's passport page from its passport ID or QR code. It shows the card (name, species, morphs, sex, birth date, size, photo, stats, rarity, tier and who verified it) and never who keeps the animal.
• Other members see your display name and, depending on your profile privacy setting, your collection and your place on the leaderboard. “Hidden” keeps you off the leaderboard and the keeper directory.
• In the Showroom, anyone can see a listed animal with its price, province and town. Signed-in members also see the seller's display name, username, roles, badges, how long they've been a member, how many verified cards they have, and the WhatsApp number if the seller added one.
• When you send an enquiry, the seller sees your message, your display name and username, and the phone number or email address you entered.
• When you transfer an animal, the other keeper sees your display name and username. A verified animal's new keeper sees its previous keepers in its history.
• The verifier you choose (a breeder or an event) sees the animal, your note, your name and your country.
• Our admins can see account and animal records, to run, verify and moderate ExoticPassport.

These providers process information for us under contract, only to provide their part of ExoticPassport:

• Clerk, for sign-in and account security (United States)
• Supabase, our database (servers in Stockholm, Sweden)
• Fly.io, which runs the app (servers in Stockholm, Sweden)
• PayFast, for payments (South Africa)
• Google, if you choose to sign in with Google
• Your browser's push service (for example Google or Apple), if you turn on notifications
• A separate storage server that holds our encrypted daily backups

We also share information when the law requires it, for example with a court or the police, or to protect someone's safety.

Our database and the app run in Sweden, in the European Union, and our sign-in provider is in the United States. POPIA allows this when the information stays protected to a standard like its own: the EU's data protection law provides that, and our providers are bound by contract to protect your information.

• While your account is open, we keep your records, so your animals' history stays complete.
• When you delete your account (from your profile), we delete your profile, animals, photos, care and breeding records, listings, enquiries and notifications straight away, and your name drops out of other keepers' animal histories. Our encrypted backups are replaced within 30 days.
• Animals you transferred before deleting your account stay with their new keepers.
• PayFast keeps its own records of your payments for as long as the law requires.

• Connections to ExoticPassport, and between our servers, are encrypted.
• Card details are handled by PayFast and never reach our servers.
• Backups are encrypted before they leave our servers.
• Only our admins can see records beyond what members can, and every change to an animal is recorded in its history.
• If a breach puts your information at risk, we will tell you and the Information Regulator, as POPIA requires.

You can:

• ask what information we hold about you, and get a copy;
• correct or update it (you can change most of it yourself in the app);
• have it deleted: delete your account from your profile, or ask us;
• object to how we use it, or withdraw a consent: turn off push notifications, remove the WhatsApp number from a listing, or take a listing down;
• complain to the Information Regulator (see the last section).

To use these rights, email lourens@siesbru.co.za. We may need to confirm it's you before we act, and we'll reply within 30 days.

• We use only the cookies ExoticPassport needs to work: the ones that keep you signed in (set by our sign-in provider, Clerk) and one that remembers the Showroom region you last chose.
• The app also keeps a note on your device if you dismiss the “install the app” prompt, and the installed app runs a small service worker so notifications can reach you.
• We don't use advertising or tracking cookies, and no analytics service follows you around the app.

ExoticPassport is for people 18 and older, and for younger keepers whose parent or guardian has agreed to our Terms of Use for them. POPIA treats anyone under 18 as a child, so a parent or guardian's consent is needed before we process a child's information. If you believe a child is using ExoticPassport without that consent, tell us and we'll close the account. Only people 18 and older may use the Showroom.

We don't send marketing. Our sign-in provider sends the emails you need to sign in, such as verification codes. Everything else from ExoticPassport arrives as a notification in the app, and on your phone if you allow it.

If we change this policy, the date at the top will change, and we'll tell you in the app before an important change takes effect.

Questions, requests or complaints about your information:

Service

ExoticPassport, exoticpassport.co.za

Email

lourens@siesbru.co.za

If you're not happy with how we handled your information, you can complain to the Information Regulator of South Africa: inforegulator.org.za (complaints are made through its eService portal), enquiries@inforegulator.org.za, 010 023 5200.