Privacy Policy

The short version

1. Who we are

Klyvelo is run by Klyvelo (Pty) Ltd, a private company registered in South Africa on 21 October 2026 with registration number 2026/842870/07 ("Klyvelo", "we", "us"). You can reach us at our help address.

Our business address will be published here.

We provide a point of sale, a loyalty programme, a back office website and messaging to South African shops, such as spazas, butcheries, cafés, corner shops and salons.

2. Two different roles

• Klyvelo as responsible party. We decide why and how information is used for: the people who sign up for Klyvelo and use our website (shop owners, and the admins and managers they invite); visitors to our website; people who contact us; and our sales representatives. Sections 3 to 15 cover this.
• Klyvelo as operator. For a shop's own customers (its members) and its staff, the shop is the responsible party. We process that information only for the shop, on its instructions, under our Data Processing Terms, as sections 20 and 21 of POPIA require. Section 16 explains what this means if you buy from a shop that uses Klyvelo.

One part sits with us even then. Klyvelo's own WhatsApp number sends messages for many shops, so we keep one list of the numbers that replied STOP to it, and honour that list for every shop. For that list, Klyvelo is a responsible party too (section 16).

3. What we collect, and from where

From you, when you sign up and use Klyvelo

• Account details: your first name and surname, e-mail address, mobile number, password (kept only as a secure hash by our sign-in provider), and whether two-step sign-in is on. When you sign up we send a code to your e-mail address, to check that it is yours.
• Business details: the shop's name, its legal name and registration number if you add them, the kind of business, stores and their addresses, VAT number, trading hours, logo and social media handles, and the answers you give during set-up.
• Documents that confirm your business: a copy of your ID (or passport) and, for a company, its CIPC registration certificate; a VAT certificate if you choose to send one. A person at Klyvelo looks at them to confirm the business is real and that you run it. We keep only the result (who checked it and when). We delete your ID copy within a day of approving it, and the other documents 30 days after.
• Your ID number, if you give it: so Klyvelo support can confirm it's you when you call. It is kept locked (encrypted with a key only Klyvelo holds), shown to our support team only after they confirm it's them with two-step sign-in, and every look is logged.
• Billing: your plan, billing period, payment history and the reference codes our payment provider gives us (Paystack, or Yoco while our Paystack account is being set up). The provider collects your card details on its own page. We never see or store your card number.
• Support: what you tell us when you contact us, the feedback you send from the app, and the record of every time our support team looked at or changed something in your account (who, when, why and what).
• Connections you switch on: for Xero, the name of the Xero organisation, an access token (kept encrypted), the accounts you choose and which days were sent. For Sage Accounting, the e-mail address and password of the Sage user you make for Klyvelo (the password kept encrypted), the company and accounts you choose and which days were sent. For the Yoco card-machine link (not available yet), an access token (kept encrypted) for your own Yoco account.

From other people, about you

• When an owner invites you: your name, e-mail address and role (admin, manager or staff).
• When you came through one of our sales representatives: the representative's code, kept with your sign-up so they are paid for it.

Automatically, from your devices

• Service information: your points of sale (name, when each was last seen, app version), how syncing is going and how many messages you have used. Each point of sale has a random identifier that Klyvelo makes, not your phone's or computer's own serial number; the staff console keeps only a one-way code of a browser's identifier, to recognise a browser it has seen before.
• Your IP address: our hub sees it when you sign up, sign in or ask for a code, and uses it to limit how many attempts can be made from one place and for the bot check at sign-up. It is not kept with your account.
• Logs and error reports: technical logs, and error reports from the app, sent to Sentry. Error reports are built to leave personal information out: names, phone numbers, e-mail addresses, ID numbers, PINs and passwords are masked on the device before anything is sent, and no screen recordings are made.
• Basic web data: our web host and providers see your IP address and browser details when you load a page, as for any website. On klyvelo.com only, and only if you say yes, we use Google Analytics to count visits (ads off, IP not stored by Google Analytics 4). Google's tag loads on every page, but until you say yes it sets no cookies and sends Google only a basic, cookie-free signal that the page was opened (Google's consent mode). Never in the app, the counter or the console. We don't sell data or show ads. We use no advertising trackers. See the Cookie and Storage Policy.

Our sales representatives

For the people who sell Klyvelo for us, we keep their name, e-mail address, mobile number, referral code, the businesses they brought in and the commission due, so we can pay them and keep our books.

4. Why we use it, and our lawful basis

We use personal information only for these purposes, or for a purpose compatible with them (section 15). We do not sell personal information. We do not use your data, your customers' data or any photos to train artificial intelligence models, and we won't without your explicit consent.

5. What you must give us

Your name, e-mail address and mobile number are needed to open an account, and billing details are needed for a paid plan. Without them we cannot provide the service. Everything else is your choice.

You can sell from the day you sign up. To send offers to your customers, connect the Yoco card link and pay for a plan by card, you must send the documents for your kind of business; they are due within 30 days.

Some laws require us to keep certain records, including the Tax Administration Act, 2011 (tax records, generally five years) and the Companies Act, 2008 (company records, generally seven years).

6. Who we share it with

We share personal information only with the providers below, and only what each needs to do its job for us, under written terms that require them to keep it secure and confidential (section 21). Those marked "also for shops" also handle shops' customer and staff information; the Data Processing Terms list them in full.

Connections a shop chooses. If a shop connects Xero or Sage Accounting, we send each trading day's sales to the shop's own accounting company as one invoice to "Klyvelo sales": never customers' names, phone numbers or e-mail addresses, and never single sales. If a shop connects the Yoco card-machine link (not available yet), we read the shop's Yoco orders, payouts, catalogue, staff, card machines and locations, and create orders and payment links for its sales; Yoco handles card payments under the shop's own agreement with Yoco. A shop may also use its own mail server or WhatsApp number. Those are the shop's providers, under its own agreements.

We may also disclose information where the law requires it, to protect someone's safety, or to a company that takes over Klyvelo's business, which must then honour this policy.

7. Information sent outside South Africa

Our main database is in Ireland, and so are the identity documents you upload while we check them. Some providers work from other countries. Under section 72 of POPIA we only send personal information outside South Africa when:

• the recipient is subject to a law, binding corporate rules or a binding agreement that gives protection substantially similar to POPIA's. Supabase (Ireland), Sentry (Germany) and Paystack's hosting (Ireland) are subject to the European Union's General Data Protection Regulation, and every provider is bound by a data processing agreement; or
• the transfer is needed to carry out our contract with you, or a contract in your interest, as section 72(1)(c) and (d) allow.

8. How long we keep it

• Account and business details: while your account is open, and for 30 days after you ask us to close it, so you can export your data. Then we delete them from our database. Our backups replace themselves: today every copy is gone within 14 days, and we promise no longer than 90 days.
• Documents that confirm your business: your ID copy is deleted within 24 hours of approval, and your CIPC and VAT certificates 30 days after. A copy we asked you to send again, or uploads for a business that never finishes, are deleted after 30 days. The record of the check (what was checked, the outcome, who checked it, when and the reason) stays while your account is open and for a year after.
• Billing and tax records: for as long as tax and company law require (generally five to seven years).
• Sign-up codes: cleared within a day.
• Security and support logs, and the record of each ID number opened: for 12 months, unless we need them longer to look into an incident.
• Error reports: for 90 days.
• Sales representatives: while they work with us, then for as long as tax law requires for commission records.

When we no longer need information, we delete it or make it anonymous (section 14).

9. How we protect it

We take reasonable technical and organisational measures (section 19), including:

• encryption on every connection, and backups encrypted (AES-256) before they leave our server;
• row-level security in our database, so one business can never read another's data;
• passwords and staff PINs stored only as hashes, and the access tokens for Xero and Yoco sealed with encryption;
• full ID numbers (a shop customer's, or yours) are kept locked: encrypted with a key that only Klyvelo holds, opened only by our support team after two-step sign-in, a limited number an hour, and every look logged;
• uploaded documents are kept in a private store that only you and the Klyvelo staff who check them can open, through links that expire after a minute, and every look is logged;
• two-step sign-in, compulsory for Klyvelo staff and available to every customer;
• support staff who can see a shop's whole account so they can help quickly, with every look and change logged and shown to the shop on its Account page;
• regular reviews of who on our team has access, and error reports that mask personal details.

No system is perfectly secure. We keep these measures under review as risks change.

10. If something goes wrong

If we have reasonable grounds to believe that someone has accessed or acquired your personal information without authority, we will tell the Information Regulator through its eServices portal, and tell you as soon as reasonably possible (section 22). We will say what happened, what we are doing about it and what you can do to protect yourself.

If it affects a shop's customer or staff information, we tell the shop straight away, because the shop must then notify the Regulator and the people affected. Our Data Processing Terms set out how we help.

11. Our marketing

We may e-mail our customers about Klyvelo's own similar products and services, as section 69(3) allows. Every such e-mail lets you stop with one click, free of charge. We send no marketing to anyone else without their consent, and we never use a shop's customer list to market Klyvelo.

Service messages (receipts, security notices, payments) are not marketing, so they still come after you stop marketing.

12. Automatic decisions

One part of the service acts by itself: when a paid period ends without payment, the account has seven days' grace and then moves to the Free plan's limits until payment. Selling, refunds, cash-up and sync never stop. This follows our terms, which you agreed to. If you think it happened in error, tell us and a person will look at it (section 71). We make no other decisions about people based solely on automatic processing.

13. Your rights

Under POPIA you may:

• ask whether we hold information about you, and for a copy of it and who has had it (section 23);
• ask us to correct or delete information that is wrong, out of date, incomplete or excessive, or that we may no longer keep (section 24);
• object to our use of it for our legitimate interest (section 11(3)), and at any time to direct marketing;
• withdraw consent you have given, without affecting what was done before;
• complain to the Information Regulator (section 18).

You can change most account details yourself on the Account page. For anything else, write to our Information Officer at our help address, or ask by WhatsApp, by post or in person. You may use the Regulator's forms (Form 1 to object, Form 2 to correct or delete), but you do not have to. Asking costs nothing. We may first need to check who you are, and we answer in writing within 30 days.

To ask for other records we hold, see our PAIA manual.

14. Children

Klyvelo accounts are only for adults (18 or older) acting for a business. We do not knowingly collect children's information for our own purposes.

Shops decide whom they enrol as members. Under POPIA (sections 34 and 35) a shop may only record a child's information with the consent of a parent or guardian, or where another ground in section 35 applies. A shop selling age-restricted goods must not enrol anyone under the legal age for them.

15. Cookies and storage

We use no advertising or tracking cookies. On klyvelo.com only, and only if you say yes, we use Google Analytics to count visits (ads off, IP not stored by Google Analytics 4). Google's tag loads on every page, but until you say yes it sets no cookies and sends Google only a basic, cookie-free signal that the page was opened (Google's consent mode). Never in the app, the counter or the console. We don't sell data or show ads. We use a few small cookies and some browser storage that the website and the point of sale need, for example to keep you signed in and to keep selling when the internet drops. Our Cookie and Storage Policy lists every one.

16. If you buy from a shop that uses Klyvelo

If you joined a shop's loyalty programme, or a shop sends you receipts or messages through Klyvelo, this part is for you.

The shop decides

The shop is responsible for your information. It decides what to ask for, why, and how long to keep it. The privacy notice you saw when you joined, at the counter or on your phone, comes from the shop.

What Klyvelo holds for the shop

• Your name and surname, a nickname if you gave one (staff use it to greet you; it never goes on slips or in messages), your mobile number and e-mail address, your member number, points, tier, visits, what you bought, and notes the shop's staff write about your account.
• Your consents, with dates: to the privacy notice, to points and receipts by WhatsApp or e-mail, and, separately, to offers.
• Only if the shop turns these on: your date of birth, your address, the outcome of an ID check (when, how and by whom) and your acceptance of the shop's membership agreement.
• Your ID number, if the shop asks for it, is shown masked (only its last four characters). Klyvelo keeps it locked, encrypted with a key only Klyvelo holds, so that Klyvelo support can confirm who you are when you or the shop call; the shop's staff and other businesses cannot read it, and every look by our support team is logged. No copy or scan of your ID is ever kept.
• If you buy on account at the shop ("the book"), what you owe and what you pay.
• Vouchers the shop gives you, and whether you have used them.
• A record of the messages sent to you. In our delivery log your number is kept only as a one-way code.

Klyvelo works for the shop

We store and process this information only to give the shop its point of sale, points, receipts and messages, under a written agreement that requires us to keep it secure and confidential. We do not sell it, we never use it to market to you ourselves, and we do not use it, or any photo, to train artificial intelligence models. It is stored in our database in Ireland and on the shop's own devices.

Messages

• A shop may send you receipts and points updates if you said yes to them, and offers or "we miss you" messages only if you said yes to those as well.
• Many shops send through Klyvelo's WhatsApp number, or by e-mail from Klyvelo. WhatsApp is switched off for now, so messages go by e-mail. The message always names the shop.
• To stop offers, reply STOP on WhatsApp, or tap the "Stop offers" link at the foot of any offer or "we miss you" e-mail (your mail app may show it as its own Unsubscribe button; one tap is enough, no sign-in). We record it at once. A STOP to Klyvelo's number stops offers from any shop that uses Klyvelo; the e-mail link stops that shop's offers. Receipts and points updates you asked for still come, and say why you are getting them. Replying START lifts the block, but a shop must ask for your consent again before it sends you offers.

Your rights

To see, correct or delete your information, or to object or withdraw a consent, ask the shop first: it can do most of this at the counter. If you cannot reach the shop, or would rather not, write to us at our help address with the shop's name and your mobile number. We will pass your request to the shop within one business day and help it answer. A shop can delete your details completely; your old slips then show only your member number.

If you have not visited for a long time, the shop's point of sale lists your details for deletion: after 36 months, unless the shop chose another period. When the shop deletes you, your name, contact details, nickname and locked ID number go from its devices and from our hub; your old sales keep only your member number.

Complaints

You can complain to the shop, to us, or to the Information Regulator (section 18).

17. Information Officer

Our Information Officer is Jordan Richard Rudd, director of Klyvelo (Pty) Ltd. We have no Deputy Information Officer for now, so he handles every request himself.

• E-mail: our help address
• Phone: Our phone number will be published here.
• By post or in person: Our business address will be published here.

18. Complaints

Please tell us first, and we will try to put it right. You also have the right to complain to the Information Regulator (South Africa):

• Website: inforegulator.org.za
• Complaints: POPIAComplaints@inforegulator.org.za
• Enquiries: enquiries@inforegulator.org.za, 010 023 5200
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

19. Changes to this policy

We update this policy when our practices or the law change, and change the date at the top. If a change matters to you, we tell you by e-mail or on the website at least 30 days before it applies.

See also our Terms of Service, Data Processing Terms, Cookie and Storage Policy, PAIA manual and Refunds and cancellation.