Privacy Policy

Last updated 14 October 2026

This policy explains what personal information CurlCab collects, why we need it, who we share it with and what you can ask us to do with it. It is written to meet the Protection of Personal Information Act 4 of 2013 (POPIA).

CurlCab is the responsible party for the information described here. You can reach us at support@curlcab.co.za.

1. What we collect

When you create an account

• Your first and last name.
• Your email address and South African mobile number, and whether each has been verified.
• Your password, stored only as a hash — we cannot read it, and neither can anyone who obtains the database.
• The date you accepted these terms.
• Your notification preferences.

Your service addresses

Because a professional has to find you and get in, an address record holds more than most: a label such as Home or Work, the street address, unit or complex, suburb, city, province and postal code, its latitude and longitude, and any access, parking or location notes you add.

Your bookings

• The style, date and time, hair length and hair condition.
• Any notes you write for the professional, and reference images you attach.
• A snapshot of the address, price and terms as they were at the moment you booked. These snapshots are deliberate: they keep the record of what was agreed accurate even if you later change or delete the address.
• The status history of the booking, and notifications sent to you about it.

Payment information

We never see or store your card number, CVV or banking login. Those are entered on PayFast's own secure pages. What we hold is:

• An encrypted token that lets us charge the card you chose, and the PayFast agreement reference.
• The card brand, the masked number (last four digits) and the expiry month and year, so you can tell your cards apart.
• Payment and refund records: amounts, dates, status and the PayFast reference.

If you work as a professional

Your display name, the services and skills you offer, your base location and travel radius, the areas you serve, your availability, your verification status, and your ratings, acceptance and completion rates.

Automatically

Technical information needed to run the site securely, such as your IP address in server logs, and the cookies described in section 6. We do not use advertising or analytics trackers, and there are no third-party tracking scripts on this site.

2. Why we use it, and on what basis

3. Who sees your information

Your professional — and only what they need

This is the part we have built most carefully. Before a professional accepts your booking, they see only the suburb or general service area, the style, the date and time, the approximate travel distance and your notes. They do not see your exact street address, your surname, your contact details or anything about your payment.

After they accept, the assigned professional — and only that professional — receives the exact address and the access details needed to carry out that one appointment. Offers to everyone else are withdrawn.

Our service providers

• PayFast, our payment provider, which handles card details and processes payments and refunds.
• Microsoft Azure, which hosts the site and database in its South Africa North (Johannesburg) region — your information stays in South Africa.
• Providers used to deliver email, SMS and push notifications to you.

These are operators acting on our instructions. They may use your information only to provide their service to us.

We do not sell your information

We do not sell, rent or trade personal information. We will disclose it where the law requires it, or where it is necessary to establish or defend a legal claim.

4. How we protect it

• The whole site runs over HTTPS.
• Passwords are stored as hashes, never in a readable form.
• Payment tokens are encrypted at rest, and card details are masked wherever they are displayed.
• Every customer and professional request is authorised on the server, so you cannot reach another person's bookings, addresses or payments.
• Exact addresses are withheld from professionals until acceptance, as described above.
• Logs and audit records are redacted — they never contain payment tokens, card data or full addresses.
• Changes to payments, bookings and prices are recorded in an audit trail.

No system is perfectly secure. If a breach affects your personal information we will notify you and the Information Regulator as POPIA requires.

5. How long we keep it

• Account details: while your account is open.
• Bookings, payments, refunds and their snapshots: at least five years after the transaction, which South African tax and company law requires. These survive account closure.
• Addresses: until you delete them. A deleted address is removed from your account, but the snapshot attached to a past booking stays with that booking's record.
• Payment tokens: until you remove the payment method or it expires.
• Unaccepted bookings: a booking that no professional accepts within 30 minutes is refunded, and its record is kept with the rest of your payment history.
• Reviews you write: kept, because other customers rely on them when choosing a professional. If you close your account the review stays but is no longer linked to a name.
• Notifications we sent you: deleted when you close your account.

What closing your account actually does

We remove your name, email address, mobile number, saved addresses and payment tokens, and lock the account permanently so nobody can sign in to it again. We keep the bookings, payments and refunds themselves, for the five years named above — the law requires us to, and deleting them would take the record of what you paid with them. What remains is a financial record that is no longer attached to an identifiable person.

If you have a booking still in progress, or a refund or dispute outstanding, we settle that first — otherwise there would be nobody to pay back.

6. Cookies

We use only the cookies the site needs to work: one that keeps you signed in, and one that protects forms against cross-site request forgery. There are no advertising, analytics or tracking cookies, so there is nothing here to opt out of. Blocking the essential cookies will stop you being able to sign in.

7. Your rights

Under POPIA you may:

• See what personal information we hold about you.
• Correct anything inaccurate — most of it you can edit yourself under My account.
• Delete your account and personal information. There is a request button on your profile. We action it subject to the retention periods in section 5: records we are legally required to keep are retained, and the rest is removed.
• Object to processing, or withdraw consent for marketing at any time.
• Complain to us, or directly to the Information Regulator.

Email support@curlcab.co.za to exercise any of these. We will respond within a reasonable time, and within any period POPIA sets.

8. Children

You must be 18 or older to hold a CurlCab account. A booking may be made for a child by their parent or guardian, who must be present at the appointment. We do not knowingly collect information directly from children.

9. Changes to this policy

We will update this policy as CurlCab changes. The date at the top shows when it last changed, and we will bring material changes to your attention.

10. Contact and complaints

Questions or requests: support@curlcab.co.za.

If we have not resolved your concern, you may complain to the Information Regulator (South Africa):
inforegulator.org.za · complaints.IR@justice.gov.za

Read this together with our Terms of Use and refund & cancellation policy.