Privacy Policy

Last updated 25 September 2026

BookVia (built by Scratch Solid Solutions) is a WhatsApp-native booking and commerce platform for South African small businesses. This page explains what we collect, why, and what you can do about it - for both the business owners ("vendors") who run their storefront on BookVia and the customers who book through one.

What we collect

From a vendor signing up: business name, category, WhatsApp number, and anything they choose to add to their storefront (logo, photos, hours, offerings and prices, VAT number if they invoice). On Pro and Unlimited plans, a card is verified via Paystack for billing and platform-fee collection.

From a customer booking through a vendor's page: name, WhatsApp number, and the details of what was booked or ordered. Customer card details are entered on Paystack’s hosted payment page and are not stored by BookVia. Vendors who request payouts provide bank-account details to BookVia; those values are encrypted before storage and are used only to configure and operate payouts.

Automatically: standard web request metadata (IP address, timestamps) used for rate-limiting and abuse prevention, and a session cookie that keeps a vendor logged into their own dashboard.

How we use it

To operate the booking itself - holding a slot, confirming it, sending WhatsApp reminders, and recording the transaction in the vendor's own ledger.
To send WhatsApp messages a person has asked for: a one-time login code, a booking confirmation or reminder, a no-show rebook offer, or (only with explicit marketing consent) a broadcast from a vendor to past customers.
To detect and prevent abuse - rate limits on OTP codes, booking attempts, and broadcasts all exist specifically so BookVia's WhatsApp number and vendors' own numbers aren't used to spam anyone.
To generate a vendor's own financial records - income/expense ledger, VAT-ready invoices, and (Unlimited plan) a Verified Revenue Report a vendor can bring to a bank or lender.
Platform-wide, in aggregate, to run BookVia itself - signup and revenue trends, feature adoption - never sold to anyone.

Who we share it with

We share what's necessary to actually deliver the service, and nothing beyond that:

Meta (WhatsApp Business Platform) - to send and receive the WhatsApp messages that make BookVia work.
Paystack - to process card payments, refunds and configured payouts. Ozow code remains disabled/test-only and is not represented as a live payment rail.
Resend - to deliver transactional email and report delivery, bounce and complaint events.
Cloudflare - our hosting/infrastructure provider (servers, database, file storage, email/AI calls proxied through their network). They process data on our behalf; they don't use it for their own purposes.
Anthropic - only for BookVia's own promotional content generation (writing/scoring marketing posts about BookVia itself). No vendor or customer data is sent here.

We never sell personal data, and a vendor's customer list is never shared with another vendor or used to advertise anything other than that vendor's own business.

How long we keep it

Account and booking data is kept while an account is active. Verified deletion requests are tracked against a 30-day completion target. Identifying customer and vendor profile data is then removed or irreversibly anonymised, while transaction and tax records may be retained for the period required by South African law. Bounce and complaint suppressions are retained to prevent unwanted repeat email.

International processing

BookVia uses service providers that may process information outside South Africa, including in the European Union and United States. Scratch Solid Solutions requires appropriate contractual and security safeguards from those processors and limits each transfer to what is necessary to provide the service.

Your choices

A vendor can edit or remove most of their own information directly from their dashboard.
A customer's marketing consent (for broadcast messages) is opt-in and can be withdrawn at any time by replying to the vendor or contacting us below.
To request a copy of your data, or to have it deleted, email support@bookvia.org from the WhatsApp number or email tied to your account. We'll act on a deletion request within 30 days, except for records we're legally required to keep.

Security

Session tokens are signed and stored as HttpOnly cookies; passwords aren't used for vendor login (WhatsApp OTP is used). Administrator access uses named identities, a second verification factor, revocable sessions and an audit trail. Customer card numbers are handled by Paystack. Vendor payout bank-account values stored by BookVia are encrypted at rest and access is restricted.

Responsible party and contact

Scratch Solid Solutions is the responsible party for the BookVia platform. Privacy requests and Information Officer queries can be sent to privacy@bookvia.org. You may also complain to South Africa’s Information Regulator using the contact details published at inforegulator.org.za.