Privacy Policy

1. Introduction

Allsorts Directory ("we," "our," or "us") is operated by Allsorts Web Designers, a company based in South Africa. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our services marketplace (the "Service") as a consumer searching for a service provider, or as a provider listing a business.

We are committed to protecting your privacy and complying with the Protection of Personal Information Act (POPIA) of South Africa.

2. Information We Collect

2.1 Consumer accounts

• Name, email address, phone number (optional)
• Password (stored hashed, never in plain text)
• Callout requests and booking details you submit to providers, and any reviews you leave

2.2 Provider (business) accounts

• Business name, description, address, phone, WhatsApp, and category
• Verification data: a free web-presence check result and an AI-generated risk read, both reviewed by a human before your listing goes live
• Optional CIPC registration number
• If you connect Allsorts Bookings, your business slug is stored so customers can book real appointments

2.3 Technical data

• IP address (used for rate limiting, security, approximate location so search results default to your area, and fraud prevention)
• Cookies required for authentication and session management

Because South Africa has a real and documented risk of business impersonation and identity fraud, we retain the signup IP address, street address, and contact details associated with each provider account for as long as the account exists, specifically so that a fraudulent listing can be traced and reported. This information is never shown on public listing pages.

3. AI Features

Allsorts Directory uses an optional AI provider (Groq, and optionally OpenRouter) for two features: classifying a consumer's written problem description into a category and urgency level when requesting a callout, and generating an advisory risk read shown to our human reviewers during provider verification. Neither feature makes an automated decision about you — a human always makes the final verification call. AI provider API keys are configured at the platform level and stored encrypted.

4. Data Sharing and Disclosure

We may share information with:

• Providers you contact: your name, contact details, and request description are shared with the specific business you send a request to
• Allsorts Bookings: if you book a real appointment, your booking details are sent to that connected product to schedule it
• PayFast: to process feature-ad payments from providers (we never see or store card details)
• AI providers: only the text of a request description or verification data needed for the two features described above
• Law enforcement: we disclose account records — including signup IP address, street address, and contact details — only in response to a valid legal request (e.g. a police investigation into a fraudulent or impersonated listing), never proactively or for any other purpose

5. Data Security

• Encryption in transit (TLS/SSL)
• Secure password hashing (bcrypt)
• Encrypted storage of platform API keys and credentials (AES-256-GCM)
• Rate limiting and account lockout on repeated failed logins
• Security headers (CSP) and access controls

6. Your Rights

Under POPIA, you have the right to access, correct, and request deletion of your personal information, and to object to or withdraw consent for processing. You can exercise most of these rights directly:

• Download a copy of your data from your account settings at any time
• Request account deletion from your account settings at any time
• Contact our Information Officer for anything else — see below

7. Contact / Information Officer

You have the right to lodge a complaint with the Information Regulator of South Africa if you believe your privacy rights have been violated.