Privacy Policy.
Last updated: 12 October 2026
Responsible party
Setld (Pty) Ltd, registration number 2026/439792/07, 91 Lovell Street, Die Boord, Stellenbosch, is the responsible party for the purposes of the Protection of Personal Information Act 4 of 2013 (POPIA).
Information Officer: Reuben Pieter Faure, support@setld.co.za
General privacy enquiries: support@setld.co.za
What personal information we collect
- Identity and contact: your name, username, mobile number and email address
- Legal details: your legal first and last name and date of birth, collected at sign-up to confirm you are 16 or older
- Identity verification: if you send, pay or withdraw more than R500 in 30 days, a photo of the front and back of your South African ID or driver's licence
- Profile: your profile photo, if you add one, and your privacy settings (such as whether people can find you by phone number) and the people you block
- Account security: your PIN hash (one-way, server-side; your raw PIN is never stored or transmitted in readable form). Face ID and fingerprints stay on your device: if you turn on Face ID sign-in, your device creates a passkey and we store only its public key, which cannot be used to identify you or unlock anything on its own
- Financial: wallet balance, transaction history, top-up and withdrawal records, and bank account details you provide for withdrawals
- Payment: card payments are handled entirely by Yoco. We never see, receive, or store your card number or CVV
- Usage: requests and payments, groups and their messages, bills you split (including receipt photos and who had which item), table and takeaway orders, and invite links you share
- Phone contacts: only if you allow access. Numbers are scrambled (hashed) on your device and only the scrambled form is checked against Setld to show which contacts are already here. Your address book is not uploaded or stored
- People who are not on Setld yet: when you pay someone by phone number we store that number in scrambled form plus a masked version (such as 082 *** 4567) so only that person can collect the money; when someone pays a pay link by card, we store the name they type; when you add someone to a group by name before they join, we store that name
- Device: push notification endpoint (browser push subscription or device token); device type inferred from browser headers
- Communications: the content of support emails or messages you send us, and a short log of sign-in code deliveries (time, result and the last four digits of the number)
Why we use it & lawful basis
We process your personal information for the purposes set out in the table below. Each processing purpose is supported by a lawful basis under POPIA.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Providing the service (account, wallet, debts, settlements) | All account + financial data | Performance of contract |
| Processing top-ups | Payment reference, transaction record | Contract + legitimate interest |
| Processing withdrawals | Bank details, wallet balance | Performance of contract |
| Sending push notifications | Push notification endpoint | Consent (you opt in) |
| Security & fraud prevention | Transaction patterns, login data | Legitimate interest |
| Legal compliance (FICA, tax) | Identity, transaction history | Legal obligation |
| Confirming your age and identity, and the R500 limit | Legal name, date of birth, ID document photos | Legal obligation (FICA) + legitimate interest (fraud prevention) |
| Finding friends from your contacts | Scrambled phone numbers from your contacts | Consent (you allow contacts access) |
| Paying or requesting money from someone not on Setld | Their phone number (scrambled and masked), amount, your first name | Legitimate interest (delivering a payment or request you started) |
| Reading receipts and menus | Receipt and menu photos you choose to scan | Performance of contract |
| Marketing messages by WhatsApp or email | Name, mobile number or email | Consent, or you are an existing customer and did not opt out. Every message lets you opt out |
| Improving the service | Aggregated, anonymised usage patterns | Legitimate interest |
Third-party processors
We share your personal information only with the service providers listed below, each acting as a data processor under our instructions. They may not use your data for their own purposes.
| Provider | Purpose |
|---|---|
| Yoco (yoco.com) | Card payments: wallet top-ups, table and takeaway orders, and pay links (including payers who do not have a Setld account) |
| Supabase (supabase.com) | Database, authentication, file storage, edge functions (hosted in Stockholm, Sweden) |
| Vercel (vercel.com) | Web app hosting and edge delivery |
| Setld (Pty) Ltd (manual EFT) | Withdrawal processing via EFT |
| Anthropic (anthropic.com) | AI bill-splitting and menu reading: receipt and menu images are sent to Anthropic's Claude to read the items. Anthropic does not use them to train its models |
| Resend (resend.com) | Transactional email such as sign-in codes, receipts and withdrawal confirmations |
| W4B (Vodacom) and Meta WhatsApp Business | WhatsApp messages: sign-in codes, payment notices and payment requests (including to people not on Setld yet, at the request of a Setld user), and marketing messages to people who agreed to receive them |
| Apple (Apple Push Notification service) | Delivering push notifications to iPhones |
Each provider has their own privacy policy. We encourage you to review them.
Cross-border data transfers
Supabase stores your personal information on servers located in Stockholm, Sweden (European Union). Vercel's edge network may cache content in other regions, but primary data storage remains in the EU.
Under section 72 of POPIA, cross-border transfers of personal information are permitted where the recipient country provides an adequate level of protection. Sweden is subject to the General Data Protection Regulation (GDPR), which provides substantially similar protections to POPIA. We additionally rely on standard contractual clauses with each provider.
Receipt images processed by Anthropic for AI bill-splitting may be processed on servers outside the EU. Anthropic is subject to applicable US data protection law and their processing is governed by our data processing agreement with them.
Data retention
We retain your personal information only for as long as necessary:
- Account data: retained while your account is active, then for 12 months after account closure (to allow dispute resolution and regulatory enquiries)
- Transaction and financial records: retained for a minimum of 5 years from the date of the transaction, consistent with SARS record-keeping requirements
- Push notification endpoints: deleted automatically when the subscription is revoked or returns an error response (410 / 404)
- Support emails: retained for 60 days from the date of last correspondence
- Receipt photos: kept for 6 months so the people in that split can view the receipt, then deleted. They are not used to train AI models
- Identity verification documents: kept for 5 years after the account closes, as FICA requires
- Money sent to a phone number: if it is not collected within 7 days it goes back to the sender; the scrambled and masked number stays with the transaction record
- Invite and pay links: stop working after 7 days (pay links) or when they expire or are cancelled
- Sign-in code delivery log: kept for 30 days
After the applicable retention period, data is securely deleted or irreversibly anonymised.
Your POPIA rights
Under POPIA, you have the following rights in relation to your personal information:
- Access - request a copy of the personal information we hold about you
- Correction - ask us to correct inaccurate or out-of-date information
- Deletion - request that we delete your personal information (subject to our legal retention obligations)
- Objection - object to processing of your personal information based on legitimate interest
- Marketing - stop marketing messages at any time with the opt-out in the message, or by emailing us
- Lodge a complaint - with us first, and then with the Information Regulator of South Africa
To exercise any of these rights: email support@setld.co.za with the subject line "POPIA Request". We will acknowledge your request within 5 business days and respond fully within 30 days.
Information Regulator of South Africa:
Website: inforegulator.org.za
Email: complaints.IR@justice.gov.za
Tel: 012 406 4818
Data breaches
In the event of a security breach that affects your personal information, we will:
- Notify the Information Regulator of South Africa as soon as reasonably possible
- Notify affected users as soon as reasonably possible
- Where feasible, complete both notifications within 72 hours of becoming aware of the breach
This is consistent with our obligations under section 22 of POPIA.
Children's data
Setld is not intended for use by anyone under the age of 16. We do not knowingly collect personal information from anyone under 16.
If you believe that someone under 16 has registered an account or provided personal information through our service, please contact us at support@setld.co.za and we will promptly delete the information.
Contact & changes
For any privacy-related questions, requests, or complaints, contact us at: support@setld.co.za
We will notify you of any material changes to this Privacy Policy via in-app notice before the changes take effect. Minor or administrative changes may be made at any time and will be reflected in the "Last updated" date above.
Your continued use of Setld after any changes constitutes acceptance of the updated policy.
Summary
In plain terms: we collect only what we need to run the app. We don't sell your data. We don't run ads. Your card details never touch our servers (Yoco handles that). Your face and fingerprint never leave your device. Your contacts are checked in scrambled form and never stored. Receipt photos are deleted after 6 months and are never used to train AI. We only send marketing if you agreed, and you can stop it any time. You can ask us to delete your data any time. If something goes wrong, we'll tell you.
Questions? support@setld.co.za · Terms & Conditions