Privacy Policy

iIndex Tech (Pty) Ltd ("we", "our", or "us") operates the Secure Management System (SMS) — a platform built for stokvels, burial societies, and cooperatives across Africa.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and web platform. By accessing or using SMS, you agree to the collection and use of information in accordance with this policy.

a) Information You Provide Directly

• Full name, surname, and membership number
• Email address and phone number
• Organisation/society name and administrator details
• Beneficiary information you voluntarily add
• Profile photo (optional)
• Password (stored in encrypted/hashed form — never in plain text)

b) Financial & Contribution Data

• Contribution amounts and payment dates
• Event details (funerals, fundraisers, projects)
• Contribution status and history per member
• Society fund totals and statistics

c) Automatically Collected Information

• Device type and operating system version
• App version and crash/error logs
• Push notification tokens (FCM device tokens)
• Login timestamps and session information

We use the information we collect for the following purposes:

• Creating and managing your member account and society profile
• Recording and tracking contributions, events, and society activities
• Generating PDF reports and registers for society administrators
• Sending push notifications about contributions, events, and updates
• Authenticating users and maintaining secure sessions
• Providing customer support and responding to inquiries
• Improving our platform through aggregated, anonymised analytics
• Complying with legal obligations applicable in South Africa

We will never use your personal data for advertising profiling, resale to third parties, or any purpose not directly related to operating the SMS platform.

All data is stored in a MongoDB cloud database hosted on secure, access-controlled infrastructure. We implement industry-standard security measures:

• Passwords are hashed using bcrypt — they are never stored in plain text
• All API communication is encrypted using HTTPS/TLS
• Authentication is handled via JWT tokens with expiry controls
• Database access is restricted to authorised application services only
• Society data is logically segregated — one society cannot access another's data

Data is retained for as long as your account or organisation remains active on the platform. Upon request for deletion, we will remove personal data within 30 days, except where retention is required by law.

We do not sell, rent, or trade your personal information to any third parties. Data is shared only in these limited circumstances:

• Within your society: Administrators of your registered society can see member contribution records and details you have provided
• Service providers: Firebase (Google) for push notification delivery — they do not receive financial data
• Legal compliance: If required by South African law, court order, or regulatory authority
• Business transfer: In the event of a merger or acquisition, you will be notified before data transfer occurs

All third-party service providers we use are bound by confidentiality obligations and are not permitted to use your data for their own purposes.

The SMS app may send push notifications to your device to inform you of:

• New contributions recorded against your account
• Upcoming or active events in your society
• New member registrations (admin only)
• Important society announcements

Push notifications are delivered via Firebase Cloud Messaging (FCM) by Google. Your device token is stored securely and is only used to route notifications to your device.

You can disable push notifications at any time through your device's notification settings. This will not affect your ability to use any other features of the app.

Under the Protection of Personal Information Act (POPIA) of South Africa, you have the following rights regarding your personal data:

• Right to access: Request a copy of the personal data we hold about you
• Right to correction: Request that inaccurate or outdated information be corrected
• Right to deletion: Request deletion of your personal data (subject to legal retention requirements)
• Right to object: Object to the processing of your data in certain circumstances
• Right to data portability: Request your data in a structured, machine-readable format
• Right to complain: Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, please contact us using the details in Section 11. We will respond within 30 days of receiving your request.

The SMS platform is intended for use by adults managing financial societies and organisations. The app is not directed at children under the age of 13, and we do not knowingly collect personal information from anyone under 13 years of age.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately so we can delete that information from our systems.

Our application uses the following third-party services, each governed by their own privacy policies:

• Firebase / Google (FCM): Push notification delivery — firebase.google.com/support/privacy
• MongoDB Atlas: Secure cloud database hosting — mongodb.com/legal/privacy-policy
• Google Play: App distribution — governed by Google's policies

We encourage you to review the privacy policies of these third parties. iIndex Tech is not responsible for the privacy practices of external services.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the "Effective Date" at the top of this page
• Send a push notification to all registered users (where possible)
• Display a notice within the application on next login

Continued use of the SMS platform after changes are posted constitutes your acceptance of the updated policy. We recommend reviewing this page periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• Company: iIndex Tech (Pty) Ltd
• Website: www.indextech.co.za
• Email: privacy@indextech.co.za
• Product: Secure Management System (SMS)