Privacy policy

Last updated 24 October 2026.

This policy explains what personal information YBC Society collects when you use ybcsociety.co.za, why, who it is shared with and what your rights are under the Protection of Personal Information Act (POPIA).

Who we are

[To confirm: the responsible party: legal or trading name, company registration number if any, physical address, and the name of the Information Officer.]

What we collect

When you create an account:

• Your email address and the password you choose. Passwords are held by our sign-in provider, Supabase, in a form we cannot read.
• Your first name and WhatsApp number, so we can address you by name and reach you about your account.
• The date and time you agreed to these terms, and, if you ticked the box, the date you chose to receive updates.
• Where you came from, if you arrived through one of our links (for example a link in our Instagram bio), so we know which links bring people here.

While you are a member:

• Your membership status, the date your access is paid up to, and a PayFast reference for your subscription.
• A record of each payment notice PayFast sends us: the date, amount, PayFast's reference and whether it succeeded. Card details go to PayFast and never reach us.
• The name you choose to show in the community, and the posts and comments you write.
• The last time you visited the members area, recorded at most once an hour, so we can check in if you have been away for a while.

Cookies and browser storage:

• The cookies needed to keep you signed in.
• A cookie that remembers which link you arrived through, for up to 30 days.
• One browser setting for the motion switch (pausing animations). This stays on your device.

We do not use advertising cookies or trackers.

Why we use it

• To create and run your account, and to give you access to the lessons, live calls and community.
• To take your monthly payment through PayFast, confirm it and keep the records tax law requires.
• To send you messages about your own account: confirming your email, resetting your password, a welcome message, a reminder before a live call, and a notice if a payment fails or your membership is cancelled. These go by email, and by WhatsApp if you gave us a number.
• To send you updates about new lessons, live calls and offers, but only if you ticked the updates box. You can untick it on your account page at any time, use the unsubscribe link in any such email, or reply STOP on WhatsApp.
• To see which of our links bring people to the site.

Who we share it with

Only the services that run the site, each of which processes information for us under its own terms:

• Supabase: accounts and database.
• PayFast: payments. PayFast is a South African payment provider and handles your card details.
• Vercel: hosting of the website.
• Resend: sending our emails.
• Meta's WhatsApp Business platform: sending our WhatsApp messages.
• Bunny.net: streaming the video lessons.

We do not sell personal information, and we do not share it with anyone else unless the law requires it. Some of these services store information outside South Africa; each one commits to a level of protection in line with POPIA.

How long we keep it

• Your account details, community posts and visit record: for as long as you have an account.
• Payment records: for five years after the payment, as tax law requires. If you delete your account, these records are kept but are no longer linked to your name or email.
• Messages we have sent you: a log of which messages were sent and when, for as long as you have an account.

Your rights

Under POPIA you may:

• Ask what personal information we hold about you and receive a copy.
• Ask us to correct it. Your name, community name and WhatsApp number can be changed on your account page.
• Ask us to delete your account and personal information. We will do so, keeping only the payment records tax law requires.
• Object to direct marketing at any time: untick the updates box on your account page, use an unsubscribe link, or reply STOP on WhatsApp.
• Complain to the Information Regulator (South Africa) at inforegulator.org.za if you believe we have not handled your information lawfully.

To use these rights, email us at the address below. We answer within 30 days.

Changes to this policy

If we change this policy, the new version is published here with a new date, and we email members about any change that affects them.

Contact

[To confirm: the email address for privacy requests and questions.]