Last updated: 11 July 2026
This Privacy Policy explains how Studio Continua (Pty) Ltd (trading as Pavemints, "we", "us", "our") collects, uses, shares, and protects your personal information when you use pavemints.co.za and related services (the "Service"). We process personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA).
1. Who we are (Responsible Party)
- Responsible party: Studio Continua (Pty) Ltd (trading as Pavemints)
- Registration number: 2024/121785/07
- Registered address: 334 Kent Avenue, Ferndale, Randburg, Johannesburg, 2194, Gauteng, South Africa
- Contact: support@pavemints.co.za (email is our contact channel)
2. The personal information we collect
We collect only what we need to run the Service:
| Category | Examples | Source |
|---|---|---|
| Account information | Name, email address | You, at sign-up / onboarding |
| Alert preferences | Followed releases, chosen channels, lead time, and whether you asked to be told about a restock or a price drop | You, when you set up alerts |
| Drop outcomes | Your answer to "Did you cop?" for a release you tracked — got it, missed it, or didn't try — and whether you opened a stockist link from an alert | You, when you answer the one-tap email; recorded when you follow a buy link |
| Payment information | Subscription tier, status, billing period, and Paystack customer/subscription references | Created when you subscribe (see section 4) |
| Usage & technical data | App events (page/feature usage), approximate request metadata, log data | Automatically, as you use the Service |
We do not collect special personal information (e.g. health, race, religion), and we do not knowingly collect information from children under 18 (see section 10).
3. How and why we use your information (lawful basis)
We process your personal information for these purposes, each with a POPIA lawful basis under section 11:
- To provide the Service — manage your account and watchlist (performance of our contract with you).
- To send the alerts you request — drop reminders and restock notifications via the channels you choose (your consent / your request).
- To process payments and manage subscriptions — via Paystack (performance of contract).
- To operate, secure, and improve the Service — first-party analytics and abuse prevention (our legitimate interests, balanced against your rights).
- To report demand in aggregate — if you answer "Did you cop?", or open a stockist link, that outcome is counted towards figures we share with brands and retailers on our Business plan. Those figures are aggregated and never identify you: any breakdown backed by fewer than ten people is withheld entirely rather than shown, and no row-level data about you is ever shared (our legitimate interests, balanced against your rights — you can decline simply by not answering).
- To comply with legal obligations — tax, accounting, and lawful requests (legal obligation).
Direct marketing (POPIA section 69): The drop and restock alerts you sign up for are messages you requested — not marketing. We will only send you promotional messages if you have opted in, and every such message will offer an easy opt-out.
4. Payments
Subscriptions are billed through Paystack, a PCI-DSS–compliant payment processor. When you subscribe, you enter your card details on Paystack's hosted checkout page — your card number never touches Pavemints' servers and we never store it. We store only the non-card references Paystack returns to us (customer code, subscription code, tier, status, and current period end) so we can manage your subscription and grant access.
5. Who we share your information with (Operators)
We do not sell your personal information. We share it only with service providers ("operators" under POPIA) who process it on our behalf and under written agreement, and only as needed to run the Service:
| Operator | Purpose | Data shared |
|---|---|---|
| Paystack | Payment & subscription processing | Email, name, payment details (entered directly on Paystack) |
| Resend | Sending transactional email (e.g. sign-in links, alerts) | Email address, message content |
| Vercel | Application hosting & delivery | Technical/log data |
| Neon | Database hosting (Postgres) | Account and app data at rest |
| Google (if you sign in with Google) | Authentication | Email, name, profile identifier |
We may also disclose information where required by law or to protect our legal rights.
6. Cross-border transfers (POPIA section 72)
Some of our operators process personal information on servers located outside South Africa (for example, in the United States or European Union, where our hosting, database, and email providers operate). Where this happens, we take steps required by POPIA — relying on the operator's contractual data-protection commitments, adequate-protection safeguards, and/or your consent — to ensure your information remains protected to a comparable standard.
7. How long we keep your information
We keep personal information only as long as necessary for the purposes above:
- Account data — while your account is active, and for a reasonable period afterwards.
- Billing records — for the retention period required by South African tax and company law.
- Analytics events — retained in PII-free form for reporting.
When information is no longer needed, we delete or de-identify it.
8. How we protect your information (POPIA section 19)
We maintain reasonable technical and organisational safeguards, including encrypted transport (HTTPS), access controls, and processing payments only through a PCI-DSS–compliant provider. No system is perfectly secure, but we work to protect your information and will notify you and the Information Regulator of a compromise as required by POPIA section 22.
9. Your rights
Under POPIA you have the right to:
- Access the personal information we hold about you;
- Correct or update inaccurate information;
- Delete your information or object to processing, where the law allows;
- Withdraw consent (e.g. stop alerts) at any time;
- Complain to the Information Regulator.
To exercise any of these, contact us at support@pavemints.co.za. We will respond within a reasonable time.
10. Children
The Service is intended for users 18 and older. If you believe a child has provided us personal information, contact us and we will delete it.
11. Changes to this policy
We may update this policy from time to time. Material changes will be notified in the app or by email, and the "Last updated" date above will change.
12. Complaints — Information Regulator (South Africa)
If you are unhappy with how we handle your information, you may lodge a complaint:
The Information Regulator (South Africa) JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 Email: POPIAComplaints@inforegulator.org.za Website: inforegulator.org.za