credible
Coming soonWhatsApp us

Privacy policy

How Credible handles your personal information

Last updated: 5 November 2026 · Version 1.3

1. Introduction and our role

Credible ("Credible", "we", "us") lets two people who found each other online trade goods safely: the buyer pays into escrow with our escrow partner, the seller sends the item, and we release the money once the buyer confirms the item arrived or the inspection period ends.

This policy explains what personal information we collect, why, who we share it with, how long we keep it, and what rights you have. It applies to our website at oncredible.co.za, our web application, and any related services (together, "the Service").

We are the responsible party for the personal information described here, and we process it in line with the Protection of Personal Information Act 4 of 2013 ("POPIA").

2. Our details and our Information Officer

  • Legal entity: ONCREDIBLE
  • Registration number: 2026/849119/07
  • Information Officer: JD Alberts
  • Email: info@oncredible.co.za

Our Information Officer is registered with the Information Regulator of South Africa. Our PAIA manual is available on request.

3. What "personal information" means

"Personal information" means information that identifies you and can be linked to you — for example your name, mobile number, email address, identity or passport number, bank account details, photographs that show your face, your device and IP address, and information about the deals you are part of. It does not include information that has been irreversibly de-identified.

4. What we collect

Information you give us.

  • When you create an account: your mobile number (this is your account identity — you sign in with a code we text you), the name you want other people to see, and, if you choose, an email address for receipts.
  • When you create or join a deal: the item details you enter (title, description, condition, quantity), the price and delivery amounts, how the item is delivered, the inspection period you choose, any photos you upload, and — if you choose to name the other party — their mobile number.
  • When we verify you (before money is paid out to you, or when a dispute opens): your ID or passport number, a selfie and liveness check, and your bank account details so we can confirm the account is in your name.
  • When you pay for a deal, or a deal you sell is paid for: we pass your details to our escrow partner so it can hold and pay out the money (section 7).
  • When a dispute happens: the reason, any message you send us, and any evidence you upload.
  • When you contact support: whatever you choose to tell us.
  • When you sign up for updates on our landing page: your email address, the date and time you consented, the version of the notice you agreed to, and whether you have confirmed.

Information we get from the other party in your deal. If the other person enters your mobile number, we use it to link you to the deal and to text you the link.

Information collected automatically. When you use the Service we receive standard technical information: your IP address, browser and device type, operating system, and the dates and times you use the Service. We use this for security, fraud prevention and troubleshooting.

What we do not collect. We do not collect card numbers, card security codes or internet banking login details. Payments are made on our escrow partner's payment page; we only receive a reference, the method you chose and the outcome.

5. What the other party sees about you

This matters, so we say it plainly. The other person in your deal sees the deal itself — the item, the amounts, how it will be delivered, the inspection period, and its progress. They do not see your name, mobile number, email address, identity document or bank account details.

There are two exceptions worth knowing about:

  • If you enter the other party's mobile number when you create a deal, the text message we send them includes your display name, so they know who they are dealing with.
  • If you entered their mobile number, you see the last four digits of it on the deal, so you can tell you have reached the right person.

Your deal history and your verification status are not shown to the other party.

6. Why we use your personal information

We only process personal information that is adequate and relevant for a specific purpose.

  • Create and secure your account, and keep you signed in — performance of our contract with you.
  • Create, share and administer a deal, and keep both parties informed — performance of our contract with you.
  • Hold, release and refund money, and keep the required financial records — contract, and our legal obligations (including FICA record-keeping).
  • Verify your identity before we pay out to you, or when a dispute opens — our legal obligations (FICA / AML).
  • Send you messages about your deals, including money and dispute messages — performance of our contract with you.
  • Detect and prevent fraud, and keep the Service secure — our legitimate interests, balanced against your rights.
  • Send you updates about Credible — your consent, and only if you opted in and confirmed.
  • Handle disputes, complaints and support requests — performance of our contract with you.
  • Comply with the law, court orders, and protect our legal rights — legal obligation.
  • Understand, in aggregate and de-identified form, how the Service is used — our legitimate interests.

We will not use your personal information for a new, unrelated purpose without telling you and explaining the lawful basis. We do not sell your personal information, and we do not use it to make automated decisions that have legal effects about you — a person reviews every dispute.

7. Who we share it with

We share the minimum necessary, and only where there is a reason.

  • The other party in your deal — the deal terms and your display name (see section 5).
  • Our escrow partner, currently Trade-Safe Holdings (Pty) Ltd, trading as TradeSafe, which holds the money for a deal and pays it out. It receives what it needs to do that, and to meet its own legal duties (including FICA): for both parties, full name, email address and mobile number; for the seller, also their ID or passport number and the bank account their payout goes to; and the deal's reference, title, description and amounts. TradeSafe is a responsible party in its own right for what it does to meet its legal duties, and its own privacy policy applies to that (tradesafe.co.za). It may contact you about the payments it holds.
  • Service providers who work for us under written contracts that require them to protect your information and to use it only to provide their service to us: hosting and infrastructure (our servers are in South Africa); Cloudflare, which serves the public landing page from its global edge; object storage, for item photos and dispute evidence; SMS and email delivery; our identity verification provider; and courier partners, where a deal is delivered by courier.
  • Professional advisers — lawyers, accountants, auditors and insurers, where needed.
  • Law enforcement, regulators or other third parties where we are legally required to, or where we believe in good faith it is necessary to prevent harm or financial loss, or to investigate suspected illegal activity.
  • A new owner — if Credible is sold, merges or transfers its business, your personal information may pass to the new owner, and this policy will continue to apply.

8. Where your personal information is stored

The personal information we hold in the app and its database is stored on servers in South Africa. The public landing page is static and is served by Cloudflare from its global edge.

Some of it is processed outside South Africa in the course of providing the Service. In practice this means:

  • the emails we send — including your email address and the contents of the message — pass through our email delivery provider, which operates outside South Africa;
  • an email's destination mailbox may be anywhere in the world, and we do not control where your email provider holds it;
  • our escrow partner processes the details in section 7 on its own systems; where any of that is outside South Africa, the section 72 basis below applies;
  • Cloudflare processes request metadata (such as IP address, browser and time of request) on its global edge to deliver and protect the landing page; where that is outside South Africa, the section 72 basis below applies.

Where personal information leaves South Africa we rely on section 72 of POPIA: either the transfer is necessary for the performance of our contract with you, or the recipient is subject to a law, binding corporate rule or binding agreement that provides an adequate level of protection. Every service provider we use is bound by a written contract that requires them to protect your personal information and to use it only to deliver their service to us.

9. How long we keep it

We keep personal information only as long as we need it for the purpose we collected it, or as long as the law requires.

  • Sign-in codes — deleted within 24 hours.
  • Email signups that were never confirmed — deleted after 7 days.
  • Email signups that were confirmed — until you unsubscribe, or until we no longer need to contact you.
  • Account, deal, payment and money records — at least 5 years after the last activity on the deal, for financial record-keeping (FICA).
  • Dispute evidence and deal history — the same retention period as the deal.
  • Technical and security logs — 30 days.

We keep the reference our escrow partner gives you (a token, not your details) for as long as we keep the deal records it belongs to.

If you ask us to delete your personal information and no legal retention duty applies, we will delete it. Where we must keep a record (for example a financial transaction record), we de-identify it instead of deleting it.

10. How we protect it

We protect your personal information with technical and organisational measures: encrypted connections (TLS) throughout, encryption of sensitive fields such as identity and bank details, access limited to the people who need it to do their jobs, strict separation between mutable account data and append-only records (transaction, money and audit records cannot be altered or deleted), malware scanning of uploaded files, removal of location metadata from photos, and monitoring for suspicious activity.

No system is completely secure. If you believe your information has been compromised, contact our Information Officer immediately.

11. Your rights

Under POPIA you have the right to:

  • know whether we hold personal information about you, and to access it;
  • have your personal information corrected if it is inaccurate or misleading;
  • have your personal information deleted, where we are not required to keep it;
  • object, on reasonable grounds, to our processing it;
  • withdraw your consent at any time (this does not affect processing that already happened);
  • not have your personal information processed for direct marketing once you have opted out;
  • lodge a complaint with the Information Regulator of South Africa.

You will not be charged for exercising these rights. We may ask you to confirm your identity first, and we may refuse a request that is clearly unfounded, repetitive or excessive — in which case we will tell you why. We aim to respond within one month.

To exercise a right, contact our Information Officer (section 2). If you are not happy with our response, you may complain to the Information Regulator:

Information Regulator (South Africa) · JD House, 29 Stal Street, Nebo, Johannesburg · info.regulator@justice.gov.za · https://inforegulator.org.za

12. Updates emails and your consent

You will only receive updates about Credible if you asked for them: you tick a box on our landing page and then confirm your email address by clicking a link we send you. We record the date you consented and the version of the notice you agreed to.

You can withdraw that consent at any time by using the unsubscribe link in any email we send, or by contacting our Information Officer. We will then stop sending you updates.

Messages about a deal you are part of — including anything about money, shipping or a dispute — are not marketing. We send those because they are necessary to provide the Service, and we will send them regardless of your marketing preferences.

13. Cookies and browser storage

Our landing page sets no cookies and uses no advertising or analytics trackers.

Our web application stores your sign-in token in your browser's local storage so that you stay signed in between visits. Clearing your browser's site data removes it. Our hosting provider keeps standard server logs (IP address and time of request) for security and troubleshooting.

14. Children

The Service is for people aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

15. Links to other websites

Our Service may link to other websites, for example the marketplace where you found the person you are trading with. We do not control those sites and are not responsible for their privacy practices — please read their privacy policies.

16. Changes to this policy

We may update this policy as the Service changes. The current version is always on this page, with the date it was last updated. If a change materially affects how we use your personal information, we will tell you before it takes effect.

17. Contact us

For anything about this policy or your personal information, contact our Information Officer using the details in section 2.

Back to Credible