Privacy Policy

Last updated: 18 July 2026

This policy explains how Kinara Consulting (Pty) Ltd(registration number 2025/871359/07, "Kinara," "we," "us"), operating Qlaim, collects, uses, and protects personal information in connection with the Qlaim platform (qlaim.co.za and white-labeled deployments of it), in line with the Protection of Personal Information Act, 4 of 2013 ("POPIA").

Kinara's other products (Nahshon SPLT, Iddan PFT) and the Kinara Consulting corporate website each have their own privacy policy.

Who is responsible for your information

What we collect

What we collect depends on how you use Qlaim:

• Merchant, organiser, and rental operator accounts — name, email, phone (where provided), business/company name, password (via Supabase Auth), PayFast merchant ID and merchant key for payment processing, and a supervisor PIN for sensitive actions.
• Customers buying tokens or making rental bookings — name, email, and phone number; for rental items requiring a fit (e.g. graduation gowns), measurements such as height or head circumference where you choose to provide them.
• Transaction records — purchase and redemption timestamps, QR token identifiers, and payment references. Qlaim does not directly collect or store your card details — payment is processed by PayFast, a third-party payment gateway.
• AI Business Summary (optional, merchant/operator-only) — if a merchant or rental operator explicitly consents, aggregated business analytics may be sent to Anthropic (the provider of Claude) to generate a written summary. This never includes individual customers' personal information, and consent can be withdrawn at any time.

Why we collect it

To process token purchases and rental bookings, verify and reconcile payments, operate merchant/organiser/operator dashboards and analytics, respond to support enquiries, and, only with consent, generate optional AI-assisted business summaries.

How we share it

We share personal information only with the processors needed to run Qlaim:

• PayFast — to process payments. PayFast handles your card details directly; Qlaim never sees or stores them.
• Resend — to deliver transactional emails (booking confirmations, notifications).
• Anthropic — only when a merchant/operator has consented to the AI Business Summary feature, and only aggregated business data, never individual customer records.

We do not sell or rent personal information to third parties.

International data transfers

Our database infrastructure (Supabase) stores data in Ireland, within the European Union, where it is protected under the EU General Data Protection Regulation (GDPR) — a data protection framework substantially similar to POPIA. Some other processors we use (including Resend and, where the AI Business Summary feature is used, Anthropic) are also based outside South Africa. Where personal information is transferred outside South Africa, we only do so where the recipient is subject to a law, binding corporate rules, or a binding agreement that provides an adequate level of protection substantially similar to POPIA, or another ground permitted under section 72 of POPIA (for example, where the transfer is necessary for the performance of a contract between you and us, such as processing your booking or payment).

How long we keep it

We retain transaction and account records for as long as your account is active, and afterward for as long as required by applicable tax and financial record-keeping legislation. Enquiry-only data not tied to a transaction is retained only as long as reasonably necessary to respond to you.

Your rights under POPIA

• Confirm what personal information we hold about you and request a copy of it
• Ask us to correct inaccurate information, or delete it where there's no lawful reason for us to keep it
• Object to processing, or withdraw consent (e.g. for the AI Business Summary feature) at any time
• Lodge a complaint with the Information Regulator if you believe we have not handled your information properly

To exercise any of these rights, use the request form below.

Submit a request

Security

We take reasonable technical and organisational measures to protect personal information, including row-level access controls in our database, service-role-only data writes, encrypted transmission, and rate-limited access to sensitive operations such as PIN checks.

Complaints to the Information Regulator

Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of this page reflects the most recent revision.