Privacy Policy

Strove Group (Pty) Ltd (“Strove”, “we”, “us”, “our”) operates a WhatsApp-native commerce platform that connects buyers with verified South African service businesses. This policy explains how we collect, use, share, and protect personal information, and the rights you have in relation to that information.

This policy is issued in compliance with the Protection of Personal Information Act 4 of 2013 (“POPIA”), and takes into account the Electronic Communications and Transactions Act 25 of 2002 (“ECTA”) and the Consumer Protection Act 68 of 2008 (“CPA”) where relevant.

By using Strove — whether as a merchant, a buyer, or a visitor to strove.co.za or our WhatsApp service — you acknowledge that you have read and understood this policy.

Personal information

means information relating to an identifiable living natural person, and where applicable, an identifiable existing juristic person, as defined in POPIA.

Processing

means any operation performed on personal information, including collection, storage, use, dissemination, and destruction.

Responsible party

means the party that determines the purpose of and means for processing personal information (Strove, in respect of the processing described here).

Operator

means a party that processes personal information on behalf of a responsible party (our service providers).

Data subject

means the person to whom personal information relates (you).

Merchant

means a service business that subscribes to and lists on Strove.

Buyer

means a person who books or purchases a service through Strove.

Strove's Information Officer is Nadia Naidoo.

All privacy enquiries, requests, and complaints may be directed to: support@strove.africa

The Information Officer is responsible for ensuring Strove's compliance with POPIA and for handling data subject requests.

This policy applies to personal information processed through:

• The Strove website (strove.co.za) and merchant storefronts (strove.co.za/store/[merchant-slug]);
• The Strove WhatsApp service operated through a single Meta-verified Strove WhatsApp number;
• The merchant onboarding and dashboard flows;
• The Strove buyer application (where used for payment authentication); and
• Advertising and discovery channels operated by Strove on behalf of merchants.

Merchants remain independent responsible parties for the personal information of their own customers that they receive, store, and use to deliver their services. Section 18 sets out the division of responsibility.

5.1 From merchants

• Identity information: full name, South African ID number, and a photograph of your ID document, used to verify identity at onboarding.
• Business information: trading name, company registration number (CIPC), VAT number (optional), physical address, and category.
• Financial information: bank account details and a bank statement image, used to verify the account into which payouts are made.
• Credentials: professional qualifications and credentials submitted for verification and display on your profile.
• Contact information: email address, WhatsApp number, and phone number.
• Subscription and billing information processed through our payment provider.
• Storefront content you upload, including logos, images, service descriptions, and team details.

5.2 From buyers

• Contact information: name and WhatsApp or phone number.
• Booking and transaction history, including the services booked, merchants engaged, and amounts.
• Messages, text, and images you send to the Strove WhatsApp number (for example, an image sent to help find a matching service).
• Location information, only where you choose to share it to find a nearby service or pickup point.
• Reviews and ratings you submit, which are tied to completed bookings.
• Where you use the Strove app, device and authentication data required to deliver a one-time payment code.

5.3 Payment information

Payment card and account details entered at checkout are collected and processed directly by our payment provider on their PCI-DSS-compliant infrastructure. Strove does not store full card numbers. Strove does not hold or take custody of buyer funds — payments are made directly to the merchant through the payment provider's split-payment facility, with Strove's platform fee retained at the point of charge.

5.4 Information collected automatically

• Referral parameters passed when you tap a “Message on WhatsApp” advertisement (for example, the merchant identifier in a click-to-WhatsApp link).
• Log and device data such as IP address, browser type, and device information.
• Cookies and similar technologies, as described in Section 16.

We collect information directly from you when you onboard, message our WhatsApp service, book or purchase a service, create an account, or contact us. We also collect information automatically when you interact with our website, advertisements, or WhatsApp service, and from third parties such as identity- and bank-verification providers used to confirm the information you supply.

We process personal information for the following purposes:

• To provide the service — creating and operating merchant accounts and storefronts, enabling buyers to find, book, and pay for services, and processing transactions. Lawful basis: performance of, or entering into, a contract.
• To verify merchants — confirming identity, business registration, and bank account details to maintain a trusted marketplace. Lawful basis: legitimate interest and compliance with legal obligations, including FICA and RICA where applicable.
• To authenticate payments — generating and validating one-time payment codes. Lawful basis: performance of a contract and our legitimate interest in preventing fraud.
• To operate discovery and search — interpreting search queries and matching them to listings. Lawful basis: performance of a contract and legitimate interest.
• To communicate with you — sending booking confirmations, payment notifications, reminders, and service updates. Lawful basis: performance of a contract.
• To improve and secure the platform — analytics, troubleshooting, and fraud prevention. Lawful basis: legitimate interest.
• For marketing and re-engagement — described in Section 10. Lawful basis: consent and, for existing customers, legitimate interest as permitted by law.

Where we rely on consent, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

All buyer and merchant interactions on WhatsApp flow through a single Meta-verified Strove WhatsApp number. When you message us, we process the content of your messages, your WhatsApp number, and any media you send in order to respond, to find or book a service, and to complete a transaction.

WhatsApp messaging is provided by Meta. Message delivery is currently facilitated through a business messaging provider. Your use of WhatsApp is also subject to WhatsApp's and Meta's own terms and privacy policies.

Strove will never send you an unsolicited payment request over WhatsApp. Any payment communication follows only after you have registered and initiated a transaction.

To operate discovery, search, and support, we use third-party AI services to:

• interpret natural-language search queries;
• analyse images you send in order to match them to relevant listings; and
• generate content such as storefront descriptions and discovery articles.

For these functions we use services provided by Anthropic and OpenAI. This may involve transferring the relevant content outside South Africa, as described in Section 12. We do not use your messages to train third-party AI models beyond what is necessary to return a result to you, and we limit the information sent to what is required for the task.

Strove operates advertising and re-engagement on behalf of merchants. Where enabled and consented to, this includes:

• Advertising — running campaigns on Meta platforms (Facebook and Instagram) that route interested buyers into a WhatsApp booking conversation.
• Conversions attribution — sharing transaction event data with Meta's Conversions API to measure and optimise advertising performance. Merchant consent for this use is captured explicitly in the merchant terms of service before it is activated.
• Re-engagement — win-back and referral campaigns sent through WhatsApp and email to buyers who have transacted with a merchant.

You may opt out of marketing communications at any time using the unsubscribe mechanism in the message or by contacting support@strove.africa. Opting out of marketing does not affect transactional messages necessary to deliver a service you have requested.

We share personal information only as necessary, and only with:

• The relevant merchant or buyer — a buyer's booking details are shared with the merchant fulfilling the service, and a merchant's public profile is shown to buyers.
• Operators (service providers) who process information on our behalf under written agreements, including: the payment provider that processes payments and payouts; the WhatsApp and messaging providers that deliver messages; Meta, for advertising and conversions measurement as set out in Section 10; AI providers (Anthropic, OpenAI) for search, image analysis, and content generation; our database and hosting providers (Supabase, Netlify); our email delivery provider (Resend); and identity, bank-account, and business-registration verification providers.
• Professional advisers, auditors, and insurers, where reasonably required.
• Regulators, courts, and law enforcement, where required by law or to protect our rights.

We do not sell your personal information.

Some of our operators are located outside South Africa, including in the United States and the European Union. Where we transfer your personal information across borders, we do so in accordance with Section 72 of POPIA — that is, where the recipient is subject to laws, binding rules, or agreements that provide an adequate level of protection substantially similar to POPIA, where the transfer is necessary to perform our contract with you, or where you have consented. We put appropriate contractual safeguards in place with these operators.

We maintain appropriate, reasonable technical and organisational measures to protect personal information against loss, damage, and unauthorised access, including:

• encryption of data in transit;
• one-time payment codes that are stored only as a hash and never transmitted over WhatsApp;
• payment codes that are single-use, time-limited, and validated against a specific order, amount, merchant, and expiry in a single atomic transaction;
• role-based access controls and the principle of least privilege; and
• reliance on PCI-DSS-compliant infrastructure for card processing.

If a security compromise affecting your personal information occurs, we will notify you and the Information Regulator as required by POPIA.

We retain personal information only for as long as necessary to fulfil the purposes described in this policy, or as required by law. Transaction, tax, and FICA-related records are retained for the periods prescribed by applicable legislation (generally at least five years). Verification documents are retained for the duration of the merchant relationship and a reasonable period thereafter. When information is no longer required, we securely delete or de-identify it.

Subject to POPIA, you have the right to:

• be notified that your information is being collected or has been accessed without authorisation;
• request access to the personal information we hold about you;
• request correction, updating, or deletion of inaccurate, irrelevant, excessive, or unlawfully obtained information;
• object, on reasonable grounds, to the processing of your information;
• object to processing for direct marketing and to withdraw consent;
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects; and
• lodge a complaint with the Information Regulator.

To exercise any of these rights, contact support@strove.africa. We may require verification of your identity before acting on a request, and will respond within the period required by law.

Our website uses cookies and similar technologies to operate the site, remember preferences, measure performance, and support advertising and conversions measurement. You can control cookies through your browser settings. Disabling certain cookies may affect how the site functions. Advertising and conversions tracking are described in Section 10.

Strove is not intended for use by children. We do not knowingly collect personal information from anyone under the age of 18. If we become aware that we have collected such information without appropriate consent from a competent person, we will delete it.

When a merchant receives a buyer's personal information through Strove in order to deliver a service, the merchant becomes an independent responsible party for that information and is responsible for its own compliance with POPIA. Strove is a disclosed intermediary between buyer and merchant: the merchant is the direct supplier of the service under the CPA. This policy governs Strove's own processing and does not govern a merchant's independent use of customer information.

We may update this policy from time to time. Material changes will be communicated through the platform or by email. The “Effective date” above reflects the latest version. Continued use of Strove after an update constitutes acknowledgement of the revised policy.

If you are not satisfied with how we have handled your personal information, you may lodge a complaint with:

We ask that you contact support@strove.africa first so that we can attempt to resolve the matter directly.