What we collect, and what we do with it.

What we collect

Directly from you: your name, email address, and password when you sign up; a company name, website, and logo if you sign up as a Poster; a bio, skills, experience, availability, rate, and profile photo if you sign up as a Doer; the content of any gig you post or application you submit, including any portfolio links or messages; and any star rating or written review left about a completed gig.

Automatically: a session cookie set by our authentication provider (Supabase) to keep you logged in. We don't run third-party analytics or advertising trackers on the Platform.

Why we process it

Mainly to run the marketplace itself: creating your account, showing your gig or profile to the other side of a match, running the admin approval step that keeps the gig board free of spam, calculating a Doer's average rating, and emailing you when something needs your attention (a gig you posted was approved, for instance). We also use it to enforce these terms — for example, checking whether an email is already registered before creating a duplicate account.

Who we share it with

Other users, by design: a Poster's identity becomes visible on a gig's page once that gig is filled; a Doer's profile is visible to a Poster once that Doer has applied to one of their gigs. We don't sell personal information to anyone.

We use a small number of service providers to actually run the Platform, each of whom processes data on our behalf rather than for their own purposes: Supabase (database, authentication, and file storage — hosted outside South Africa) and Resend (transactional email — approval notices, and eventually account-verification email). When self-serve payment launches, PayFast will process that on the same basis.

Where it's stored

Our infrastructure providers (Supabase, Resend) operate outside South Africa. POPIA allows this where the recipient is subject to similar data-protection obligations, or has agreed to be — which is the basis we rely on for these transfers. We haven't independently audited either provider's certifications beyond what they publish themselves.

How long we keep it

For as long as your account is active, plus a reasonable period after in case you come back or a dispute needs resolving. If you ask us to delete your account, we'll delete or anonymize your personal information, except where we're required to keep something (like a record needed for a tax or legal obligation) or where it's embedded in another user's data (a review a Poster left about you generally stays visible to that Poster, even if you close your account).

How we protect it

Access to your data is restricted by database-level row security rules — for example, a Poster can only read applications submitted to their own gigs, not anyone else's. Connections to the Platform are encrypted in transit. No security measure is perfect, and we can't guarantee absolute security, but we treat this as an ongoing responsibility, not a one-time setup.

Your rights

Under POPIA, you can ask us to: confirm what personal information we hold about you and give you a copy of it; correct or delete information that's inaccurate, irrelevant, or excessive; and object to processing you have reasonable grounds to object to. Reach out at jaredlee.exe@gmail.com for any of these — most of it (your profile, gig posts, applications) is also editable directly from your account today.

If you're not satisfied with how we've handled a request or a concern, you can complain to South Africa's Information Regulator: 27 Stiemens Street, Braamfontein, Johannesburg, or POPIAComplaints@inforegulator.org.za.

Children

LekkerGig isn't intended for anyone under 18, and we don't knowingly collect personal information from children.

Changes to this policy

We may update this policy as the Platform changes — we'll update the date at the top when we do, and post noticeable changes somewhere you'll actually see them rather than burying them here.