Need Help? Email: hello@petguru.co.za | Support Chat: Open Chat

Privacy Policy

Privacy Policy

Last updated: July 2026

RealTeasy (Pty) Ltd ("PetGuru", "we", "us", or "our") is committed to protecting the privacy and personal information of our users in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and all applicable South African data protection legislation. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our website, mobile application, and related services (collectively, the "Platform").

By registering an account or using the PetGuru Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of our Platform.

1. Information We Collect

We collect personal information that you voluntarily provide to us, as well as information gathered automatically through your use of the Platform.

1.1 Information You Provide Directly

  • Account Registration: Full name, email address, password, and profile photo.
  • Pet Profiles: Pet name, species, breed, age, gender, photographs, and health notes.
  • Breeder / Business Listings: Business name, physical address, contact number, KUSA or relevant registration numbers, and kennel / cattery details.
  • Marketplace Transactions: Billing address, delivery address, and payment information (processed securely through our third-party payment gateway, PetGuru does not store full card details).
  • Communications: Messages sent through our in-platform messaging system, support enquiries, and feedback submissions.
  • AI Companion Conversations & Memories: If you chat with your pet's AI companion, we store the conversation, and an AI process automatically extracts durable facts you share ("scared of thunder", "we're moving house") as the companion's long-term "memories" so it can remember them later. You can view and delete these memories from your pet's Digital Twin page at any time, they are included in your data export, and they are erased with your account. Authorised PetGuru staff can read companion and support conversations for support, safety and moderation purposes.
  • Verification Information: Your South African ID number (stored only as a hash), professional registration numbers (KUSA, SABBS, SAVC, CIPC, NPO and similar), and proof that you control the business, such as a DNS record on your own domain, a one-time code briefly published on a public social page you control, or a confirmation from your nominated veterinarian. Identity documents and selfie photographs are not required for most professions; see section 1.4 below and our AI Disclaimer for when and how they are used.

1.2 Information Collected Automatically

  • Usage Data: Pages visited, search queries, listings viewed, time spent on the Platform, and click-through behaviour.
  • Device & Technical Data: IP address, browser type and version, operating system, device identifiers, and referring URLs.
  • Location Data: General location derived from your IP address, or precise location if you grant permission through your device settings.
  • Cookies & Tracking Technologies: We use cookies, pixel tags, and similar technologies as described in our Cookie Policy.

1.3 Information from Third Parties

  • Social login providers (Facebook, Google) if you choose to register via a social account.
  • Payment processors for transaction verification.
  • Public registries, where relevant for breeder or veterinary verification purposes.
  • Identity bureaux, where one becomes available to us, to confirm that an ID number you supply belongs to the name and date of birth you gave us. This check is not currently enabled; if it runs, we send the number and receive only a match result.
  • Publicly available online sources, to confirm that a business you have told us about trades publicly and to check for fraud signals about its seller. An AI agent performs this search; every finding is recorded with the web address it came from, results are reviewed by a human, adverse findings are never published automatically, and you can contest them (see section 5A). This is processed under our legitimate interest in fraud prevention (Section 11(1)(f) of POPIA).
  • Your nominated veterinarian, where you ask us to seek their confirmation that you are a client of their practice.

1.4 Identity and Biometric Verification Information

To protect our community from pet scams and to operate our Verified programme, professional applicants (breeders, shelters, vets, groomers, trainers, and other service providers) go through verification. This is deliberately built to collect as little identity information as possible: most applicants are never asked for an identity document or a photograph of themselves at all.

Your South African ID number and any facial image are "special personal information" under POPIA and are processed only with your explicit consent, which we request separately at the point of submission (as a distinct, specific consent, not as part of your general acceptance of our Terms). You may decline, and choose a non-biometric route where one is available.

  • South African ID Number: We do not store your ID number in plain text. It is converted into an irreversible, one-way cryptographic hash used only to validate the number and to detect the same ID being used across multiple accounts. Where an identity bureau becomes available to us, the number could additionally be checked once against the population register to confirm it belongs to the name and date of birth you gave; that check is not currently enabled, and if it runs we receive only a match result. We separately retain your date of birth, gender, and citizenship status (mathematically derived from the number) and a masked display value (for example, 800101*******).
  • Identity Document Images: Not required for most professions. An ID document image is mandatory only for veterinarians and emergency clinics, whose trade is legally regulated. We may also request one from any account where a specific event raises the risk, a large payout being released, a high-value listing from a very new account, or a report against the account, and we tell you the reason at the time. Where provided, images are analysed by automated optical character recognition (OCR) to confirm they appear genuine and match what you provided.
  • Selfie / Facial Image: Requested only in the same limited circumstances as an identity document. It is compared once against the photograph on your ID document using facial-recognition technology to confirm you are the document holder. Our facial-comparison provider performs a one-to-one comparison only and does not retain or index your face.
  • Registration Numbers: Professional registration numbers may be checked against public registers where one exists (the NPO directory for shelters, CIPC company registrations for businesses, and the SAVC's monthly published roll of active members and facilities, against which we match a veterinarian's name). The published SAVC roll carries no registration numbers, and the kennel unions publish no register at all, so those numbers are confirmed from your certificate by a reviewer instead.
  • Proof of Control: To confirm the account belongs to the business, we may use a DNS record you publish on a domain you own, a one-time code we issue that you briefly publish on a public social page you control, or the contact number an official register publishes for your business. These are business facts rather than special personal information.
  • Veterinarian Confirmation: Where you nominate your vet, we confirm their name against the SAVC's monthly published roll of active members, confirm their SAVC number from their certificate and by manual review (the published roll carries no registration numbers), and send them a one-click request to confirm you are a client of their practice and, optionally, the microchip of an animal you are selling. We share only your name or trading name with them for that purpose, and we do not create an account for them or add them to any mailing list.
  • Microchip Numbers: A chip number supplied on a listing is not checked against any registry (South African chip registries offer no public lookup, and keeper data is protected under POPIA). Instead, we check it for collisions with chip numbers on other PetGuru accounts and listings (the same animal appearing twice is flagged for human review), your nominated vet can confirm the chip while vouching for you, and our AI traces the number across the open web as a stolen- or cloned-listing signal.
  • Business Address: Business addresses may be validated against mapping data to confirm they correspond to a real, physical premises.

Providing this information is voluntary; however, if you decline, you may be unable to obtain a Verified badge or to list pets for sale or adoption. Any verification documents and selfies are stored on access-controlled private storage and are visible only to authorised PetGuru reviewers — they are never shown on your public profile or to other users. You may withdraw your consent and request deletion of this information at any time (see section 6).

2. How We Use Your Information

We process your personal information only for lawful purposes as permitted under POPIA. These include:

  • Account Management: Creating, maintaining, and securing your PetGuru account.
  • Platform Services: Facilitating pet listings, marketplace transactions, breeder directory searches, and community features.
  • Verification: Verifying the identity and credentials of breeders, rescues, and pet care professionals to protect our community.
  • Communications: Sending transactional emails (order confirmations, delivery updates) and service notifications. We send electronic marketing (email or SMS) only where you have opted in, or where you are an existing customer and we are marketing our own similar offerings, and every marketing message includes a free, easy opt-out — in line with Section 69 of POPIA.
  • Personalisation: Tailoring search results, recommendations, and content to your pets and preferences.
  • Safety & Security: Detecting and preventing fraud, abuse, and other prohibited activities on the Platform.
  • Legal Compliance: Meeting our obligations under POPIA, the Consumer Protection Act, and other applicable South African laws.
  • Analytics & Improvement: Understanding how users interact with the Platform to improve features, performance, and user experience.

3. Data Sharing

PetGuru does not sell your personal information to third parties. We may share your information only in the following circumstances:

3.1 With Your Consent

When you contact a breeder, rescue, or seller through the Platform, your name and contact details may be shared with that party to facilitate the enquiry. You consent to this sharing by initiating the contact.

3.2 Service Providers (Operators)

We engage trusted third-party service providers who process personal information on our behalf and under our instruction, as "operators" under POPIA. These include:

  • Cloud hosting and infrastructure providers
  • Payment gateway providers
  • Email and SMS communication platforms
  • Analytics and performance monitoring tools
  • Courier and logistics partners (for Marketplace orders)
  • Verification providers: AI document-analysis and risk-assessment providers (which read and assess uploaded verification documents), a facial-recognition provider (which performs the one-to-one selfie-to-ID comparison), and a mapping / geocoding provider (which validates business addresses).
  • AI assistant provider: the large-language-model provider that powers our chat assistant and pet companion processes the messages you send them (and the pet context needed to answer) on servers located outside South Africa (see section 5). It is not permitted to use your conversations to train its models under our agreement with it.

All operators are contractually required to comply with POPIA and to protect your information to the same standard we apply. Some verification providers process data on servers located outside South Africa (see section 5).

3.3 Legal Requirements

We may disclose personal information if required to do so by law, court order, or regulatory authority, or if we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of PetGuru, our users, or the public.

3.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business, personal information may be transferred as part of that transaction. We will notify affected users and ensure any successor entity honours this Privacy Policy.

3.5 Advertising and Conversion Measurement

If you have accepted Marketing cookies, we share a limited set of information with our advertising partners, Google (Google Ads) and Meta (Facebook and Instagram), so that we can measure which of our adverts led to a sign-up or other action, and improve how we advertise. We share only:

  • a one-way hashed (irreversible) version of your email address and, where available, your mobile number — never your actual email address or number in readable form; and
  • the advertising click identifier attached to the link you arrived from (Google's "GCLID" or Meta's click ID), which identifies the ad click, not you personally.

This is used solely to match your action back to an advert we paid for (known as "conversion measurement" or "offline conversions"), and to help these platforms show our adverts to people similar to our existing members. Google and Meta process this information on servers located outside South Africa (see section 5).

Your choice: we do this only with your consent, given by accepting Marketing cookies. You may withdraw that consent at any time by declining Marketing cookies or by opting out of marketing in your account settings, and we will stop sharing this information; withdrawal does not affect sharing that has already taken place. As this is processing for direct-marketing measurement, you also have the right to object to it under Section 69 of POPIA, as described in section 6.

4. Data Retention

We retain your personal information for as long as your account remains active, or as long as is necessary to fulfil the purposes outlined in this policy, and to comply with our legal and regulatory obligations. When you delete your account, we will remove or anonymise your personal information within 30 days, except where retention is required by law.

Indicative retention periods for specific categories of information:

  • Account & profile data: for the life of your account; removed or anonymised within 30 days of account deletion.
  • Verification documents (ID, certificates): for the duration of your Verified status and up to 12 months after it lapses or your account closes, then deleted.
  • Verification selfie / facial image: deleted immediately after the one-to-one comparison completes; never retained or indexed by the comparison provider.
  • Order & transaction records: retained for 5 years to meet tax and company-law obligations.
  • Support correspondence: up to 3 years after the query is resolved.
  • Server & security logs: up to 12 months for security and fraud prevention.

5. International Transfers

Where we transfer personal information outside South Africa (for example, to cloud infrastructure hosted in other jurisdictions), we ensure that adequate protections are in place as required by Section 72 of POPIA, including binding contractual agreements that meet the standard of POPIA. This includes the analysis of verification documents and the one-to-one comparison of facial images by specialist providers located outside South Africa (for example, in the United States and the European Union), performed under contractual data-protection terms. It also includes the hashed identifiers and advertising click identifiers shared with Google and Meta for conversion measurement, as described in section 3.5.

5A. Automated Decision-Making

As permitted under Section 71 of POPIA, our verification system may make an automated assessment of a professional application (for example, auto-approving a low-risk application or declining one with clear fraud indicators) based on the document, identity, biometric, registration, and address checks described above. You are not subject to a decision based solely on automated processing that has a legal or similarly significant effect without recourse: any applicant whose verification is declined may submit representations and updated information through our resubmission process, and a member of our team will review the matter. See our AI Disclaimer for more detail.

6. Your Rights Under POPIA

As a data subject under POPIA, you have the following rights:

  • Right to Access: Request a description of the personal information we hold about you and details of how it has been used.
  • Right to Correction: Request correction of inaccurate, incomplete, or misleading personal information.
  • Right to Deletion: Request the deletion of your personal information where it is no longer necessary for the purpose it was collected, subject to legal retention requirements.
  • Right to Object: Object to the processing of your personal information, including for direct marketing purposes.
  • Right to Withdraw Consent: Where processing is based on your consent, withdraw that consent at any time without affecting the lawfulness of prior processing.
  • Right to Complain: Lodge a complaint with the Information Regulator of South Africa if you believe your rights have been infringed.

To exercise any of these rights, please submit a request to our Information Officer using the contact details below. We will respond within 30 days as required by POPIA.

7. Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, and destruction. These measures include SSL/TLS encryption, hashed password storage, access controls, and regular security assessments. However, no method of transmission over the internet is entirely secure, and we cannot guarantee absolute security.

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the Information Regulator and affected data subjects as required under Section 22 of POPIA.

8. Children's Privacy

The PetGuru Platform is not directed at children under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us immediately and we will take steps to remove that information.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will notify you by email or through a prominent notice on the Platform at least 30 days before the changes take effect. Continued use of the Platform after that date constitutes acceptance of the updated policy.

10. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal information, please contact our Information Officer: