Privacy Policy

Last updated: 8 August 2026

Draft notice: This document was written to accurately reflect how PackStack actually handles data and operates today, based on the systems that run it - it has not been reviewed by a lawyer. If you're relying on this for a live product handling real customer data, have it reviewed by a qualified attorney familiar with South African law (including POPIA) before treating it as final.

PackStack ("PackStack", "we", "us") builds business software for South African companies, currently the Booking Appointment app for salons and service businesses, alongside custom web/app/SEO/social media project work. This policy explains what personal information we collect, why, and what rights you have over it.

1. Who this applies to

This policy covers three different groups of people, because we handle their data differently:

  • Visitors to this marketing site (packstack.co.za).
  • Tenant accounts - the salons and service businesses who use the PackStack dashboard, and their staff.
  • End customers - the people who book appointments through a tenant's public booking page. For this group, the tenant business is the data controller and PackStack acts as their data processor - see section 5.

2. What we collect

Marketing site visitors

  • Contact form submissions: name, email, the type of work you're enquiring about, and your message. Stored so we can reply to you.
  • Optional analytics (Google Analytics), only loaded if you click "Accept" on the cookie banner and only if we've configured it - see section 6.

Tenant accounts (business owners and staff)

  • Account email address and a securely hashed password (we never store your password in plain text).
  • Business details you enter: business name, tagline, logo/banner, brand colors, contact info, social links.
  • Credentials for third-party integrations you connect (WhatsApp via WATI, email via Resend, payments via Yoco) - encrypted at rest, never stored in plain text.
  • Billing information for your PackStack subscription, processed by PayFast - we don't store your card details.

End customers (booked through a tenant's page)

  • Name, phone number, and optionally email, provided at booking time.
  • Booking history, appointment notes, and loyalty points recorded by the business.
  • Deposit payment details if the business requires one - processed directly by Yoco; PackStack stores only the payment status and amount, never card details.

3. Why we collect it

  • To operate the booking system: scheduling, confirmations, reminders, and managing your account.
  • To respond to enquiries made through the contact form.
  • To process subscription billing and deposit payments.
  • To send booking confirmations and appointment reminders over WhatsApp and/or email, where a business has connected those channels.
  • To improve the site, if you've consented to analytics.

4. Who we share it with

We use the following third-party service providers to run PackStack. Each only receives the data it needs to do its job:

  • MongoDB Atlas - database hosting for all application data.
  • Cloudinary - hosts logo/banner images tenants upload for their branding.
  • PayFast - processes PackStack subscription billing.
  • Yoco - processes end-customer deposit payments, connected individually by each tenant.
  • WATI - sends WhatsApp booking confirmations and reminders, where connected.
  • Resend - sends email booking confirmations and reminders, where connected.
  • Google Analytics - optional, only if you've consented to cookies and we've configured it.

We do not sell personal information to anyone.

5. If you're a tenant business: your responsibilities

When you collect your own customers' information through your PackStack booking page, you are the data controller for that information under South Africa's Protection of Personal Information Act (POPIA) - PackStack is your data processor, acting only on your instructions (via the platform's normal functionality). You're responsible for having a lawful basis to collect your customers' information, being transparent with them about how you use it, and complying with POPIA and any other laws that apply to your business.

6. Cookies and local storage

The marketing site uses your browser's local storage (not a traditional cookie) to remember whether you've accepted or declined cookies, so we don't ask again every visit. If you click "Accept," and only then, we may load Google Analytics to understand site traffic - if you click "Decline," no analytics script loads at all.

The PackStack dashboard uses one essential, httpOnly session cookie to keep you logged in. It's required for the product to function and isn't used for tracking or advertising.

7. How long we keep it

We keep account and business data for as long as your account is active, plus a reasonable period afterward for legal, accounting, or dispute-resolution purposes. Contact form submissions are kept until we've resolved the enquiry and for a reasonable period after. You can ask us to delete your data sooner - see section 9.

8. Security

  • Passwords are hashed with argon2, never stored in plain text.
  • Third-party integration credentials (WhatsApp, email, payment provider keys) are encrypted at rest.
  • Each business's data is isolated from every other business on the platform.
  • Access to the dashboard requires an authenticated session.

No system is 100% secure, but we take reasonable technical measures to protect your information.

9. Your rights under POPIA

If you're in South Africa (or otherwise covered by POPIA), you have the right to:

  • Ask what personal information we hold about you.
  • Ask us to correct inaccurate information.
  • Ask us to delete your information, subject to legal retention requirements.
  • Object to how we're processing your information.
  • Lodge a complaint with South Africa's Information Regulator if you believe we've mishandled your data.

To exercise any of these, contact us using the details in section 11. If your data was collected by a tenant business (you booked an appointment with them), you may also need to contact that business directly, since they control that data.

10. Children

PackStack accounts (tenant owners and staff) are intended for business use by adults. We don't knowingly collect account information from children. A tenant's booking page may be used by customers of any age depending on the services offered by that business.

11. Contact us

Questions about this policy, or want to exercise your rights above? Email packstack36@gmail.com or call +27 78 268 5826. We're based in Johannesburg, South Africa.

12. Changes to this policy

If we change how we handle personal information, we'll update this page and change the "Last updated" date at the top.

Chat with us!