Privacy Policy

Who is responsible

What The Truck is operated by a South African sole proprietor, who is the responsible party (as defined in POPIA) for your personal information.

Privacy questions and POPIA requests can be raised through the platform, and are handled by the operator's Information Officer.

What we collect

Account details: your name, email address, and — if you sell — your business name, location, WhatsApp number, website, and profile description.

Content you post: vehicle/equipment listings, photos, and "wanted" requests (what you are looking to buy).

Messages: the content of in-app messages you send other members.

Technical data: a signed session cookie to keep you logged in, and basic request data (such as IP address) used only for security and rate limiting.

Why we use it, and our lawful basis

To operate the marketplace — show your listings, let buyers contact you, and run your profile and messages. This is necessary to perform our agreement with you.

To keep the platform safe — prevent abuse, fraud, and scraping of contact numbers (our legitimate interest and legal duty to secure personal information).

To manage seller subscriptions and billing where applicable (to perform our agreement).

We do not sell your personal information, and we do not use it for advertising profiling.

Who we share it with

Other members: your public profile, listings, and (for sellers) your business contact details are visible so buyers can reach you. When you tap a WhatsApp link you leave our platform and WhatsApp's own terms and privacy policy apply.

Service providers who process data on our behalf under contract: Google Firebase (authentication), Google Cloud (hosting and image storage), and our payment provider (Paystack) for seller subscriptions. They may process data outside South Africa.

Authorities where required by law, or to protect our rights and users' safety.

Cross-border processing

Some providers above process data on servers outside South Africa. We only use providers that are subject to laws or binding agreements that protect your information to a standard comparable to POPIA (POPIA section 72).

How long we keep it

We keep account and listing data while your account is active. "Wanted" requests auto-expire after six weeks. When you delete your account we delete or anonymise your personal information, except where we must retain records to meet a legal obligation.

How we protect it

We use HTTPS everywhere, delegate passwords entirely to Firebase (we never see them), sign session cookies so they cannot be forged, enforce server-side authorization on every action, re-encode uploaded images, and rate-limit access to protect contact numbers from harvesting.

Your rights

Under POPIA you may ask us to access, correct, or delete your personal information, and object to certain processing. Much of this you can do yourself in your profile; for the rest, contact us via the route in "Who is responsible" above.

You also have the right to complain to the Information Regulator (South Africa): inforeg@justice.gov.za.

Children

The platform is for users aged 18 and over. We do not knowingly collect data from children.

Changes

We may update this policy; the date above shows the latest version. Material changes will be notified in-app.