Privacy Policy

Last updated: [effective date]

Draft, pending legal review before public launch. Bracketed items are placeholders to be completed.

Handoff is operated by Observable (Pty) Ltd (registration number [reg no]), a company incorporated in the Republic of South Africa (“Handoff”, “we”, “us”). This policy explains how we process personal information under the Protection of Personal Information Act, 2013 (POPIA).

Our Information Officer can be reached at [Information Officer name and email].

Information we collect

Account details: your email address, optionally your name, a password hash (bcrypt) if you use email sign-in, or your Google account identifier if you use Google, and the date and version of your consent to this policy.
Instagram data (once you connect an account): your Instagram user id, username, profile picture, account type and the permissions you grant, plus an encrypted access token we store to act on your behalf.
Comments and messages: the comments on your posts (including the commenter’s username, id and comment text), the direct messages we send in response, and any replies buyers send back.
Automation settings you enter: keywords, message content, your WhatsApp number, PayShap ID, coupon codes and links.
Usage data: automation outcomes, taps on your WhatsApp handoff links, and basic technical logs.

How we use it

To provide the service: run your automations, send DMs on your behalf, and show your inbox and results.
To keep your account secure and prevent abuse.
To operate, maintain and improve Handoff.

We rely on your consent, the performance of our contract with you, and our legitimate interests in running the service as the lawful basis for this processing.

Buyers who comment on your posts

For people who comment on your Instagram posts, you (the seller) are the responsible party and Handoff acts as your operator (processor), processing their personal information on your instructions. You are responsible for having a lawful basis and for providing any notices and opt-outs those individuals are entitled to.

Who we share it with

We share personal information only with service providers who help us run Handoff, including Meta Platforms (Instagram and WhatsApp), Google (sign-in) and our hosting and infrastructure providers, and only as needed to provide the service. We do not sell personal information.

Cross-border transfers

Some of these providers process data outside South Africa (for example in [hosting region] and the United States). Where personal information is transferred across borders we take reasonable steps to ensure it receives an adequate level of protection.

Security and retention

Access tokens are encrypted at rest, traffic is served over HTTPS, and access is restricted. We keep your information while your account is active and delete it when you delete your account or on request, subject to any legal retention obligations.

Your rights under POPIA

You may access, correct, delete or object to the processing of your personal information, and you may lodge a complaint with the Information Regulator of South Africa. You can export or permanently delete your data from your account settings, and removing the Handoff app from Instagram triggers deletion of the connected account’s data.

Changes and contact

We may update this policy and will post the new version here with a revised date. Questions can be sent to [contact email].