Privacy Policy

Last updated: 4 September 2026

Before this goes live: this is a starting template, not a finished legal document, and has not been reviewed by a lawyer. It assumes South Africa as TweakHub’s primary jurisdiction (POPIA) with GDPR provisions for EU users, since that’s what docs/tweakhub-master-plan.md’s compliance checklist names — confirm that’s correct, fill in the bracketed placeholder (registered entity), and have this reviewed by an attorney before relying on it. If TweakHub has users in Nigeria, Kenya, or other countries with their own data protection laws (plausible given the mobile money coverage below), those laws may impose additional obligations this document doesn’t yet cover.

1. Who we are

This Privacy Policy explains how [Registered Company Name] (“TweakHub,” “we,” “us”), trading as TweakHub at tweakhub.co.za, collects, uses, and protects your personal information when you use our service. We are the “responsible party” under South Africa’s Protection of Personal Information Act, 2013 (POPIA) and, where it applies to you, the “data controller” under the EU General Data Protection Regulation (GDPR).

Our Information Officer (POPIA) / EU representative (GDPR) can be reached at info@tweakhub.co.za.

2. What we collect

Account information

Email address, full name, password (stored as a salted hash — we never store or can see your plain-text password), country, and, if you sign up through Google, the profile information Google shares with us for that. If you join or create a Team/Business account, we also hold your organization membership and role.

Files you process

The files you upload to run a tool, and the files that tool generates. These are encrypted at rest and automatically deleted after 48 hours by default (see “How long we keep it” below) — we do not manually review, read, or use file contents for any purpose other than running the specific operation you requested.

Payment information

For card and mobile money payments, your card/mobile money details are entered directly on DPO Group’s own hosted payment page — TweakHub never receives, sees, or stores your full card number, CVV, or mobile money PIN. We keep a record of the transaction itself (amount, status, a DPO-issued transaction token, and your billing reference) but not the underlying payment instrument. For direct bank transfers, we keep the reference number and amount needed to match your payment.

Usage and technical data

Which tools you run, when, and their credit cost; your IP address (used for rate-limiting and fraud prevention — see our Terms of Service); basic device/browser information from standard web request headers. We do not currently run analytics or advertising cookies/trackers of any kind — if that changes, this section and our cookie practices will be updated first, with a way to opt out where required by law.

Referral data

If you use or are referred through our referral program, we store the referral code and which account it’s tied to.

3. Why we process it (lawful basis)

To provide the service — account creation, running tools you request, delivering results, billing (necessary to perform our contract with you).
Security and fraud prevention — rate limiting, detecting abuse (our legitimate interest, balanced against your rights).
Legal compliance — tax/financial recordkeeping, responding to lawful requests from authorities.
With your consent — for anything not covered above (e.g. marketing email, if we ever add it), which you can withdraw at any time.

4. How long we keep it

Files: uploaded inputs and generated outputs are deleted automatically after 48 hours by default (configurable per deployment — [confirm current production value]). Deletion is enforced by a scheduled cleanup job, not immediately on the object store itself, so a file may briefly persist past that window before the next cleanup run.

Account data: kept for as long as your account is active, plus a reasonable period after closure to comply with legal, tax, and dispute-resolution obligations, after which it’s deleted or anonymized.

Payment records: transaction records (not payment instrument details, which we never hold) are kept as required by South African tax and financial recordkeeping law.

5. Who we share it with

DPO Group — payment processing (card, mobile money).
Our hosting/infrastructure providers — to run the servers, database, and storage that operate the service.
Law enforcement or regulators — only where legally required.

We do not sell your personal information, and we do not share file contents with anyone except as needed to run the tool you requested.

6. International transfers

TweakHub’s tools are used across multiple African countries (our payment methods alone span mobile money providers operating in many of them — MTN Mobile Money, Airtel Money, Orange Money, M-Pesa, and Wave), and our infrastructure may be hosted outside your own country. Where we transfer personal information across borders — including to the EU/EEA or elsewhere — we do so only where POPIA section 72 (or, for EU data, GDPR’s transfer rules, e.g. standard contractual clauses) is satisfied, such as an adequate level of protection at the destination or your consent.

7. Your rights

If POPIA applies to you (South Africa)

You have the right to:

Be notified that we hold your personal information, and access it
Request correction or deletion of information that’s inaccurate, irrelevant, excessive, out of date, incomplete, or misleading, or obtained unlawfully
Object to processing of your information, including for direct marketing
Complain to the Information Regulator (South Africa) if you think we’ve mishandled your information — inforegulator.org.za

If GDPR applies to you (EU/EEA)

You additionally have the right to data portability, to restrict processing, and to lodge a complaint with your local supervisory authority. Where processing is based on consent, you can withdraw it at any time without affecting processing already carried out.

Everyone

Whatever your jurisdiction, you can ask us to access, correct, or delete your personal information, or close your account entirely, by emailing info@tweakhub.co.za. If your country has its own data protection law that gives you additional rights beyond what’s listed here, those rights apply too and we’ll honor a valid request made under them.

8. Security

Files are encrypted at rest (AES-based encryption, whichever storage backend is in use), passwords are stored as salted hashes never in plain text, and access to the service requires an authentication token that expires. We restrict internal access to personal information to what’s needed to operate the service. No system is perfectly secure, and we can’t guarantee absolute security — if we become aware of a breach affecting your personal information, we’ll notify affected users and, where required, the Information Regulator or relevant supervisory authority, within the timeframe the law requires.

9. Children

TweakHub is not directed at children and we do not knowingly collect personal information from anyone under the age of majority in their country without appropriate consent. If you believe a child has provided us with personal information, contact us and we’ll delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. We’ll post the updated version here with a new “Last updated” date, and for material changes we’ll make a reasonable effort to notify you before they take effect.

11. Contact

Questions, or to exercise any right above: info@tweakhub.co.za.