This policy explains what personal information Body Recode collects, why we collect it, and what you can do about it. It follows the Protection of Personal Information Act (POPIA).
Who we are. Body Recode is run by Tash Coetzee (Sole proprietor, not a registered company). Our Information Officer is Tash Coetzee, and you can reach her at privacy@bodyrecode.co.za.
What we collect
| Information | Examples | Why we need it |
|---|---|---|
| Contact and account details | Name, WhatsApp number, email, area | To create your account, sign you in and contact you about your membership and orders |
| Delivery details | Delivery address | To deliver your orders |
| Payment records | Plan, amounts, dates, payment status | To bill your membership and keep tax records. Your card details are entered on PayFast's secure pages and never reach us |
| Health and wellness information | Weight, measurements, progress photos, check-in answers, daily logs | To run your check-ins, track your progress and let Tash coach you |
| Community posts | Posts, comments, photos you share | To run the member community |
| Messages | WhatsApp and email messages with us | To answer you and keep a record of your requests |
| Usage information | Pages visited, device type (only with your consent for analytics) | To improve the site and app |
Health information. Weight, measurements, progress photos and check-in answers are health information, which POPIA treats as special personal information. We only collect it with your explicit consent, which you give when you join. You can withdraw that consent at any time in your profile settings. If you do, we stop collecting it and delete what we hold, but check-ins and progress tracking stop working. Progress photos are encrypted and private: only you and Tash can see them, and never in the community unless you post them yourself.
Messages and marketing. We send you messages about your account, orders and check-ins. Offers and news are sent only if you opted in. Every marketing message lets you opt out, and on WhatsApp you can reply STOP at any time.
Who we share it with. We never sell your information. We share only what each of these service providers needs to do its job for us, under agreements that require them to keep it safe:
- Amazon Web Services, which hosts the site, app and database in Cape Town, South Africa, and sends our emails
- PayFast and Payflex, which process payments
- Meta (WhatsApp), which delivers our WhatsApp messages
- Our courier, which delivers orders, and our product supplier, who packs and sends them (they receive your name, number, address and the items ordered)
- Zoho, which hosts our email inbox
- Google Analytics, only if you accept analytics cookies
- Sentry, which receives error reports with personal details removed
- Our technology service provider, who builds and maintains the platform under a confidentiality and data-processing agreement
Some of these providers store information outside South Africa. We use them only where the law of that country or our agreement with them protects your information as POPIA requires.
How long we keep it
| Information | Kept for |
|---|---|
| Account and contact details | While your account is open, then deleted within 30 days of closing it |
| Health information and progress photos | While your account is open, or until you withdraw consent, then deleted within 30 days |
| Order and payment records | 5 years, as tax law requires |
| Backups | Overwritten within 35 days |
How we protect it. Everything is encrypted when it travels and when it's stored. Only people who need access have it, each with their own sign-in that can be switched off at any time, and every change they make is recorded. If a security breach puts your information at risk, we will tell you and the Information Regulator as soon as reasonably possible.
Your rights. You can:
- see the information we hold about you, and download it from your profile
- ask us to correct or delete it, or delete your account yourself from your profile
- object to us using it, and withdraw any consent
- opt out of marketing at any time
- complain to the Information Regulator at inforegulator.org.za
Email privacy@bodyrecode.co.za for anything you can't do from your profile. We reply within 30 days.
Cookies. We use essential cookies to keep you signed in and to remember your cart. Analytics cookies are used only if you accept them in the cookie notice, and you can change your choice at any time.
Age. Body Recode is for people aged 18 and over. We don't knowingly collect information from anyone younger.
Changes. If we change this policy in a way that affects you, we'll tell you by email or WhatsApp before the change applies.