1. Who we are
Curb Crew ("we", "us") operates the smart business card platform at curbcrew.co.za. We are the responsible party for your personal information under the Protection of Personal Information Act (POPIA) of South Africa. You can reach us any time at altgasstove@gmail.com.
2. What we collect
- Your full name, skills, suburb / city, photo, short bio
- Your email address and a hashed password (so you can log back in)
- Your phone number — kept strictly private, never shown on the public profile
- Optional media links (Website, Instagram, Facebook, TikTok, etc.) you choose to display
- Your unique 8-character card code
- Your name, phone number, and the message you wrote to the cardholder
- The card code you scanned
- An anonymous scan record: city / region / country (derived from your IP), device type, and timestamp
- We do not store your IP address in a way that links it back to you, and we never share scan locations publicly
- Your name, business email, phone number, and a hashed password
3. Why we collect it
We use your data only for the following purposes:
- To display your public cardholder profile when someone scans your QR code
- To relay lead messages to you privately, so a potential employer can reach you
- To let you log back in and edit your card
- To help us understand which cities our cards are most active in (anonymous, aggregated)
- To investigate and prevent fraud or abuse of the platform
We do not sell your data, swap it with marketers, or use it to train AI models.
4. The privacy core: your phone number
Cardholder phone numbers are never displayed on the public profile.
When a visitor scans your QR, they see your name, photo, skills and any media links you've chosen to enable — and that's it. They submit their own phone number; we relay the lead to you. You decide who you want to call back.
5. Who we share data with
We use a small set of trusted service providers, strictly to operate the platform:
- Emergent — hosting (compute, database, object storage). Data lives in our isolated database; no other Emergent customer can see it.
- Resend — sending transactional emails (lead notifications, password resets).
- ipapi.co — converting an IP address into an approximate city for the scan map. The IP is sent for lookup but is not stored on their side beyond their normal request logs.
- OpenStreetMap — map tiles for the admin scan map (no personal data sent).
We will never share your data with anyone else without your express consent — except where we are legally compelled to do so (e.g. by a valid court order).
6. How we keep it safe
- All traffic between your device and our servers is encrypted with HTTPS / TLS
- Your password is never stored in plain text — only a one-way bcrypt hash
- Database access is restricted to the minimum required services; no third party can query it directly
- Photos are stored in private object storage and served through authenticated URLs
- We log access events and review them for unusual activity
No system is 100% secure. If we ever discover a breach that affects you, we'll tell you (and the Information Regulator) within a reasonable time, as POPIA requires.
7. How long we keep it
- Cardholder profile: for as long as your card is active. You can delete it at any time by emailing us.
- Leads: kept for 24 months so you can review them, then archived.
- Anonymous scan events: rolling 12-month window for analytics, then deleted.
- Lost-card reports: retained for fraud-prevention purposes for 24 months.
8. Your rights under POPIA
You have the right to:
- Access the personal information we hold about you
- Correct anything that's wrong (you can do most of this yourself in your dashboard)
- Delete your account and have your data erased
- Object to processing or withdraw consent at any time
- Lodge a complaint with the Information Regulator if you think we've handled your data badly
To exercise any of these rights, email altgasstove@gmail.com. We'll respond within 14 working days.
Information Regulator (South Africa): inforegulator.org.za
9. Cookies & tracking
We keep tracking minimal:
- An authentication cookie that keeps you logged in (essential — no opt-out, but no tracking either)
- No third-party advertising trackers. No Facebook Pixel. No Google Ads.
- No "fingerprinting" of your browser
10. Children
Curb Crew is not intended for users under 18. If you become aware that a minor has activated a card, please email us and we'll remove the account immediately.
11. Changes to this policy
If we change anything material, we'll update the "last updated" date at the top of this page and, where appropriate, notify you by email.
Contact
Questions, complaints, deletion requests — all welcome. Email altgasstove@gmail.com.