1. Who is responsible
The responsible party is Michael Ross Tarr, an individual trading as Beaches Africa. Our Information Officer is Michael Ross Tarr, who you can reach at welcome@beaches.africa.
2. What we collect
- Account details (managers and admins only): your email address and a hashed password, stored by Supabase Auth, plus the beaches and role you have access to.
- Beach suggestions: the beach details you send, and, only if you choose to give them, your name and email so a reviewer can contact you.
- Your location: only when you tap "show my location". It is used in your browser to centre the map and sort beaches by distance. We don't send it to our servers or store it.
- Technical data: like any website, our host Cloudflare processes your IP address, browser details and the pages you request, and keeps short-lived logs to run and secure the site.
- Cookies and local storage: see below.
4. Why we use it (purposes and lawful basis)
- To run your account and let you manage beaches: to perform our agreement with you.
- To review beach suggestions and contact you about them: your consent, which you give by adding your details, and which you can withdraw at any time.
- To keep the site secure, prevent abuse and fix problems: our legitimate interest in running a safe, reliable service.
- To meet legal obligations, if any apply.
We don't sell your personal information or use it for direct marketing.
5. Who processes it for us
- Supabase: database and authentication.
- Cloudflare: hosting, content delivery, security and caching (Workers KV).
- Mapbox: map tiles, loaded directly by your browser, and place names for beach coordinates.
- Open-Meteo: weather and ocean forecasts. We send only beach coordinates, never anything about you.
- Fonts: served from our own domain, so Google Fonts isn't contacted when you visit.
Some of these providers store or process information outside South Africa. Under section 72 of POPIA we only use providers that are bound by laws, binding corporate rules or agreements that give an adequate level of protection.
6. How long we keep it
- Account details: while your account is active, and deleted within a reasonable time after it closes.
- Suggestion contact details: until the suggestion is reviewed and any follow-up is done.
- Server logs: for the short period our host keeps them.
7. Security
We use reasonable technical and organisational measures to protect personal information, including encrypted connections (HTTPS), hashed passwords, and access controls that limit who can see what. No system is perfectly secure. If a breach affects you, we'll tell you and the Information Regulator as POPIA requires.
8. Your rights
Under POPIA you can:
- ask whether we hold personal information about you, and for a copy of it;
- ask us to correct or delete it;
- object to us processing it, or withdraw consent you gave; and
- complain to the Information Regulator at inforegulator.org.za.
To use these rights, email welcome@beaches.africa. We may need to confirm who you are first.
9. Children
The site is for general audiences and we don't knowingly collect personal information from children under 18. Accounts are for adults only. If you think a child has sent us their details, email us and we'll delete them.
10. Changes and contact
We may update this policy; the "last updated" date above shows when. Questions? Email welcome@beaches.africa. See also our Terms of Service.