Legal

Privacy Policy

Last updated: 25 August 2026  |  Effective: 25 August 2026

1. Who We Are

Responsible Party: Elementary Data And Software (Pty) Ltd, trading as Modiri, a company incorporated in the Republic of South Africa, registration number 2023/958330/07.

Information Officer: Modiri has designated an Information Officer, who can be contacted at privacy@modiri.co.za. Registration of the Information Officer with the Information Regulator of South Africa is in progress. This does not affect any of your rights under this policy — you can exercise all of them today, at the address above.

Modiri is a marketplace. We connect homeowners (clients) with artisans (individual service providers and service companies). Both are our users, but they give us different information, so this policy describes each separately.

2. What This Policy Covers

• The Modiri client app — for homeowners who book work.
• The Modiri artisan app — for artisans and company members who do the work and get paid.
• modiri.co.za — this website, including the interest-registration (waitlist) form, which is still open.

Modiri also runs an internal administration console used only by our own staff. It is not a public product, but our staff use it to see the information described in this policy, and section 8 explains who they are.

3. What We Collect From Everyone With an Account

When you create a Modiri account, in either app, we collect:

• First name and last name — so the other party to a booking knows who they are dealing with
• Email address — to sign you in, and to send booking and account emails
• Mobile number — to send booking SMS and WhatsApp messages, and so the other party to a confirmed booking can reach you
• Password — stored only as a one-way cryptographic hash (bcrypt). We never store or display your password, and nobody at Modiri can read it
• Profile photo (optional) — shown on your profile
• Account activity — bookings, quote requests, messages, status changes and timestamps, which we keep as the record of what happened

All of this is linked to your identity, and all of it can be corrected or deleted on request (see section 11).

4. Addresses and Location

This is the area users ask about most, so we set it out in full.

Addresses you type in. Both apps ask you for a service address (homeowners) or a base address and working radius (artisans). As you type, the app sends what you have typed to Mapbox, our mapping provider, which returns matching addresses. When you pick one, we store the street address, suburb, city, province, postal code, country, the Mapbox place identifier and the latitude and longitude of that address. We use the coordinates to find artisans near you and to rank search results by distance.

The client app does not access your device's location. It does not request location permission on either iOS or Android. Everything the client app does with location is based on the address you typed in yourself.

The artisan app does access precise device location, but only in the foreground and only during a job. When an artisan taps to say they are on their way, the app streams their position so the homeowner can see them approaching and an estimated arrival time. This works only while the artisan has the app open — there is no background tracking, and the artisan can stop sharing at any time, which immediately clears the stored position.

Live tracking positions are not kept. They are held only in our short-lived in-memory cache: the "currently moving" signal expires after about 21 seconds of silence, and the last known position expires after 4 hours. Live positions are never written to our database and are not part of your booking history.

Your address is not shown to strangers. An artisan sees a client's full service address only for a booking involving them. Search results show artisans by distance and area, not by home address.

5. Photos

Homeowners can attach up to six photos of the job — the leaking pipe, the broken gate — when creating a booking or a request for quotes, so artisans can price the work properly. Photos are resized on your device before they are uploaded.

Job photos are stored on Modiri's own servers, not in a third-party image service. They are visible to you, to the artisan or artisans invited to that job, and to Modiri staff handling a dispute or a support query. They are served only through short-lived signed links, so a photo URL cannot simply be shared or guessed. Profile photos are, by their nature, publicly visible on your profile.

6. Artisans: Identity Documents and Vetting

This section applies only to artisans and company members. Homeowners are never asked for any of it.

Before an artisan's profile can go live, they must complete vetting. For this we collect:

• An identity document — a South African ID, or a passport, work permit, visa or driver's licence — including the document number, nationality where applicable, issue and expiry dates, and a photograph or scan of the document itself
• Your explicit consent to a criminal-record check, and your acknowledgement of what that check involves, both recorded with the date and time you gave them
• Trade and qualification information — services offered, years of experience, and any certificates you upload
• Vetting outcome — your trust tier, whether your criminal check, qualifications and insurance are verified, and when those verifications expire

Document numbers are encrypted at rest using AES-256, separately from the rest of the database. Uploaded vetting documents are restricted to Modiri staff — no other user can see them.

Information about criminal behaviour is special personal information under POPIA. We process it only on the basis of the consent you give in the app, and only for deciding whether to admit you to the platform and what trust tier to award. You may withdraw that consent at any time, but we will not be able to keep a vetted profile live without it.

At present, vetting is carried out by Modiri's own review team, who check your documents against what you have told us. Where an external criminal-record check is required, we use Managed Integrity Evaluation (MIE), a registered South African background-screening bureau, which would receive your name and identity-document details. We will not send your details to MIE, or to any other screening bureau, without the consent described above.

7. Payments, Earnings and Tax Records

Payments are processed by PayFast, a South African payment gateway. When you pay for a booking, you are taken to PayFast's own secure page.

Modiri never sees or stores the card or banking details you pay with. They are entered on PayFast's page and stay with PayFast. What we send to PayFast to start a payment is our own booking reference, the amount, and our merchant identifiers — not your name, email or phone number. What we store afterwards is our payment reference, the amount, the payment status, PayFast's own transaction identifiers, and the confirmation message PayFast sends us, which we keep exactly as received as proof of the transaction.

Money for a booking is held in escrow and released to the artisan, net of commission, once the job is marked complete. For artisans, we keep a running record of earnings, commission, escrow holds and payouts.

Banking details — artisans only. To pay artisans what they have earned, we ask them for banking details: account holder name, bank, account number and branch code. We collect these for that single purpose — making payment to the artisan — and for no other. We do not use them for anything else and we never disclose them to another user. An artisan may correct or withdraw their details by contacting us, though we cannot pay them out without them. Homeowners are never asked for banking details.

Artisans and companies who are registered for tax may also give us their income tax reference number and VAT number so that Modiri can generate compliant tax invoices. These are encrypted at rest. Tax invoices record the issuer's and the client's name and address, the amount, the VAT, and a description of the service.

8. Who We Share Your Information With

We do not sell your personal information, and we do not share it with anyone for advertising. We share it only with the following, and only for the purposes described:

• The other party to your booking. Once a booking is confirmed, the homeowner and the artisan see each other's name, profile photo, mobile number and the service address, and can message each other in the app. This is the whole point of the platform.
• Mapbox (Mapbox Inc.) — receives the address text you type while searching, and the coordinates needed to draw a map or calculate a route to a job. This request is made from your device, so Mapbox also sees your device's IP address. Mapbox does not receive your name, email or account details.
• PayFast (Payfast (Pty) Ltd) — receives the payment amount, our reference, and whatever card or banking details you enter on their page. See section 7.
• Clickatell (Clickatell (Pty) Ltd) — our South African messaging gateway. Receives your mobile number and the content of the SMS or WhatsApp message we are sending you, such as a booking confirmation.
• Our email provider — we send email through a third-party SMTP relay, which handles your email address and the content of the message.
• Managed Integrity Evaluation (MIE) — for artisan background screening, with your consent, as described in section 6.
• Hetzner Online GmbH — our hosting provider, whose servers hold our databases and files. See section 9.
• Modiri staff — administrators and quality-assurance officials, who can see accounts, bookings, job photos, vetting documents and disputes in order to run the platform, verify artisans and resolve complaints. Staff access is role-restricted and logged.
• Law enforcement or regulators — where we are legally obliged to disclose information, or where it is necessary to establish, exercise or defend a legal claim.

Every one of these providers acts as an operator under POPIA: they may process your information only on our instructions and for our purposes, and not for their own.

9. Where Your Information Is Stored

Our servers, databases and file storage are hosted with Hetzner Online GmbH in Nuremberg, Germany. Your personal information therefore leaves South Africa and is stored in the European Union.

POPIA permits this where the destination country has comparable data-protection law. Germany is subject to the EU General Data Protection Regulation, which affords protection substantially similar to POPIA. Mapbox and, to a lesser extent, our other providers may also process information outside South Africa.

10. How Long We Keep It

• Live tracking positions — minutes to hours. Cleared automatically; never written to our database.
• Waitlist registrations — a maximum of 24 months, or until you ask us to delete them, whichever comes first.
• Your account, bookings, messages, reviews and job photos — for as long as your account is open, and afterwards only as long as we need them to settle payments, resolve a dispute or defend a legal claim.
• Tax invoices, VAT records and provisional tax records — five years, as required by section 29 of the Tax Administration Act 28 of 2011. We cannot delete these earlier, even on request. This is a legal obligation, not a choice.
• Vetting documents and criminal-check outcomes — for as long as the artisan's profile is live, and for a reasonable period afterwards so that we can show why an artisan was admitted or refused.

11. Your Rights Under POPIA

You have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — request that we correct information that is wrong or out of date. Most of it you can edit yourself in the app
• Deletion — request that we delete your account and your personal information. We will do so within 30 days, except where the law requires us to keep a record (see section 10)
• Objection — object to the processing of your information
• Withdrawal of consent — withdraw a consent you have given, including consent to a criminal-record check, and unsubscribe from our messages at any time
• Complaint — lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za if you believe your rights have been infringed

To delete your account and data, use the account deletion page — it works without the app and without signing in, and it lists exactly what is destroyed and what we have to keep. To exercise any other right, email privacy@modiri.co.za from the address on your account, or message us on WhatsApp. We will confirm your identity, action the request, and reply within 30 days.

12. Security

• All traffic between the apps and our servers is encrypted in transit using TLS.
• Passwords are stored only as bcrypt hashes and are never recoverable.
• Identity-document numbers, income tax references and VAT numbers are encrypted at rest with AES-256.
• Access tokens are held in the device's secure hardware-backed storage — the iOS Keychain and Android's encrypted storage.
• Job photos and vetting documents are reachable only through short-lived signed links.
• Staff access is restricted by role and logged.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach occurs that creates a real risk to you, we will notify you and the Information Regulator as POPIA requires.

13. What We Do Not Do

We think it is as important to be clear about what we do not collect:

• The apps contain no advertising networks, no analytics SDKs and no crash-reporting SDKs. We do not collect advertising identifiers, and we do not track you across other apps or websites.
• We do not sell, rent or trade your personal information.
• We do not build advertising profiles, and we do not make automated decisions with legal consequences for you without a human reviewing them.
• We do not collect your contacts, your calendar, your call logs, your SMS messages, your microphone, or the files on your device beyond the photos you choose to attach.
• We do not track your device location in the background. See section 4.

14. Notifications and Messages

We contact you about your bookings by email, by SMS or WhatsApp through Clickatell, and through in-app notifications delivered over our own live connection while you have the app open. Booking notifications are part of the service and cannot be switched off entirely, but you can unsubscribe from marketing messages at any time.

15. This Website and the Waitlist

The interest-registration form on this website is still open. If you use it, we collect your name, email address, mobile number and city (both optional), which track you registered under — Homeowner, Individual Artisan or Company — the platform you are interested in, and the date you registered. We use this only to tell you when Modiri is available to you, and we delete it as described in section 10.

This website uses no tracking cookies and no third-party analytics. It uses your browser's localStorage only to hold your form entries until you submit them. The apps do not use cookies at all.

16. Children

Modiri is not directed at children. You must be 18 or older to create an account or to register your interest. We do not knowingly collect personal information from anyone under 18, and if we discover that we have, we will delete it.

17. Changes to This Policy

We will update this policy as Modiri changes — for example, when we add a payout method or a new provider. Material changes will be communicated to registered users by email and in the app. The "last updated" date at the top of this page always reflects the most recent revision.

18. Contact Us

For any privacy question, or to exercise any right in section 11:

• Email: privacy@modiri.co.za
• WhatsApp: +27 63 416 9418