This manual is published under section 51 of the Promotion of Access to Information Act, 2000 (PAIA), as amended by the Protection of Personal Information Act, 2013 (POPIA). It explains what records YadaYada Internet (Pty) Ltd keeps, how to ask for access to them, and how we process personal information.
1. Company details
| Company | YadaYada Internet (Pty) Ltd |
| Registration number | 2026/774497/07 |
| Trading name | Yada Yada |
| Physical and postal address | 27 Kalsedoon Street, Bonanne, Vanderbijlpark, 1911, Gauteng, South Africa |
| Head of the private body and Information Officer | Vuyisile Khoba (Director) |
| Information Officer email | [email protected] |
| General email | [email protected] |
| Website | yadayada.net.za |
| Information Regulator registration | 2026-068435 |
No deputy information officer has been appointed yet. Until one is, the Information Officer handles all requests.
2. The Information Regulator's guide
The Information Regulator publishes a guide on how to use PAIA and POPIA, in all official languages. It explains your rights and how to make a request. You can get it from the Information Regulator:
- Website: inforegulator.org.za
- Email: [email protected]
- Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
You may also ask us for a copy during office hours.
3. Records available without a request
These are available to anyone, without a PAIA request:
- Our Privacy Policy and Terms of Use, at yadayada.net.za/privacy.html and yadayada.net.za/terms.html
- This manual
- Product, pricing and contact information on our website and app store listings
If you use Yada Yada, you can see, download and delete your own information at any time in the app (*Profile → Privacy & data*). You don't need a PAIA request for that.
4. Records kept under other laws
We keep records as required by, among others:
- Companies Act 71 of 2008
- Income Tax Act 58 of 1962 and Tax Administration Act 28 of 2011
- Value-Added Tax Act 89 of 1991 (if and when registered)
- Basic Conditions of Employment Act 75 of 1997, Labour Relations Act 66 of 1995 and Employment Equity Act 55 of 1998 (once we employ staff)
- Broad-Based Black Economic Empowerment Act 53 of 2003
- Electronic Communications and Transactions Act 25 of 2002
- Consumer Protection Act 68 of 2008
- Protection of Personal Information Act 4 of 2013
5. Subjects and categories of records
| Subject | Records |
|---|---|
| Company | Registration documents (CIPC), memorandum of incorporation, share register, director records, B-BBEE certificate, minutes and resolutions |
| Finance and tax | Financial statements, accounting records, bank statements, invoices, tax returns and SARS correspondence |
| Contracts | Agreements with operators (hosting, AI, payments), schools and partners |
| Users | Account details, settings, items found in chats users chose to share, reminders, consent records, support messages |
| Technology | System logs (no chat content), security and incident records, source code |
| Marketing | Website content, store listings, public communications |
| Staff (when employed) | Employment contracts, payroll, leave and tax records |
Listing a record here does not mean access to it will be granted. Requests are considered under PAIA, and some records may be refused on the grounds in Chapter 4 of Part 3 of PAIA (for example, to protect another person's privacy, commercial information or confidential information).
6. How we process personal information (POPIA)
Purpose
We process personal information to run Yada Yada: to create and secure accounts, read the chats and messages users choose to share, find the items that matter to them (dates, payments, things to bring), send the reminders and notifications they ask for, manage subscriptions, support users, keep the service secure and meet our legal obligations.
Categories of data subjects and their information
| Data subject | Information |
|---|---|
| Users | First name, email address, sign-in provider, settings, children's first names, grades and classes (only with separate consent), items found, reminders, calendar entries, subscription status, device notification token, usage counts |
| Members of users' groups | Shortened names (for example "Mrs N.") and short quotes inside items. Phone numbers are never stored. Raw chats are deleted after reading, always within 24 hours |
| Schools and partners | Contact person's name, work email and phone number, contract and billing details |
| Suppliers | Company and contact details, bank and invoice details |
| Staff (when employed) | Identity, contact, banking, tax and employment records |
Recipients
We share personal information only with operators that process it on our instructions under written agreements: Amazon Web Services, Neon, Anthropic, Clerk, ImageKit, ElevenLabs, Cloudflare, Inngest, RevenueCat, Expo and Sentry. Our Privacy Policy lists what each one does and where. We also share information when the law requires it (for example with SARS or a court).
Cross-border transfers
Several operators are in the United States or run global networks. These transfers happen with users' consent and under agreements that require adequate protection (POPIA section 72). Uploaded chats are stored in Cape Town, South Africa, until they are deleted.
Security measures
- Encryption in transit and at rest
- Sender names replaced with labels, and phone numbers and email addresses removed, before any text is analysed
- Raw uploads deleted after processing, always within 24 hours
- One-time upload links that expire after 15 minutes; private photo links that expire
- Least-privilege access to every service; secret keys kept only on our servers
- Error reports with personal details and chat content removed
- Optional app lock (Face ID, fingerprint or passcode) on the user's phone
- A breach response process, including notice to affected users and the Information Regulator
7. How to request access
- Complete the prescribed request form (Form 2 under the PAIA Regulations), available from the Information Regulator's website or from us.
- Send it to the Information Officer at [email protected], or post or deliver it to the address in section 1.
- Give enough detail for us to identify the record, say which form of access you want (for example a copy or an inspection), and explain which right you want to exercise or protect and why the record is needed for it.
- If you ask on behalf of someone else, include proof of your authority.
We'll respond within 30 days. We may extend this once, by up to 30 more days, where PAIA allows it, and we'll tell you why.
Fees
Fees are set by the PAIA Regulations and are the same for everyone. A request fee may apply (except when you ask for your own personal information), and an access fee may apply for searching, preparing and copying records. We'll tell you about any fee before we do the work. Users can always download their own data free of charge in the app.
Personal information requests under POPIA
To ask us to confirm, correct or delete personal information we hold about you, or to object to its processing, email the Information Officer. Most of this you can do yourself in the app. We may ask you to confirm your identity first.
8. Complaints and remedies
If we refuse your request, or you're unhappy with how we handled it, you may complain to the Information Regulator within 180 days, or apply to a court.
- Information Regulator complaints: [email protected]
- Website: inforegulator.org.za
9. Availability and updates
This manual is available on our website and, on request, at our address free of charge. We review it at least once a year and whenever our processing changes.