Privacy policy

This policy applies to Routekeepers (Pty) Ltd, registration number 2026/707131/07, a private company incorporated in South Africa and trading as Routekeepers (the “Platform”, “we”). We are the responsible party for your personal information under POPIA. Our Information Officer is reachable at legal@routekeepers.co.za.

Riders who create accounts, farmers who list their land, farm owners a rider introduces to us (§14), route authors who publish route guides, people who refer farmers to us, and visitors to our website.

From riders: your name and the identity document (and a selfie) you submit for verification; your email; the make, model, licence disc and number plate of any registered vehicle you ride, or front, rear and side photos of an unregistered one; your bookings; a payment reference (we never store full card numbers); your incident history; and security logs such as login and device data.

From farmers: contact details, farm details, and banking details for payouts. From referrers: contact details, banking details when a fee is due, and a short note about the introduction.

From route authors: the route guide you publish — the GPS track, your photos and your written notes — and a count of how many riders have downloaded it. Guides are free, so there are no sales or earnings to record. A GPS track can show where you started, which is why the publish flow asks you to trim it if it begins at your home rather than in town.

Why we ask. Farmers open their gates to people they have never met. We verify every permit holder so a farm knows exactly who is on its land and what they are riding — that is the purpose, and the only one. We don’t use your documents for marketing, profiling, or anything else. You don’t need to verify to browse, download or publish a route guide, or join a group; you verify before your first permit.

What we take from them. Your name, which the farm you book sees on its list for the day. From a licence disc, the registration, to check it matches the plate. We don’t record your ID number, date of birth, gender or address, and we never make a template of your face or compare it with anyone else’s.

Who handles them. Our team, and an automated check by Anthropic that reads each submission once (§6, §12). It can clear a straightforward submission; anything it isn’t sure of goes to a person on our team; the only thing it can turn down on its own is an image it can’t read, which you can re-take. Our internal alerts tool (Slack) receives your name, email, the kind of document and — for vehicles — the make, model and plate, never an image.

What the farm sees. Your name as it is on your ID, your mobile number, and your vehicle’s make, model and plate (make and model only for an unregistered vehicle). Never the document or the photos.

How long. Your documents are what keep you verified, so they stay on file while your account is open and you only verify once. A vehicle’s photos are erased when you remove the vehicle; an earlier submission that was replaced or not approved is erased once a newer one is approved; everything is erased when you delete your account. We keep the record of our decision — approved or not, the date, and the check that was run — for up to 7 years (§8).

Lawful basis. Performing our contract with you, and the farm’s and our legitimate interest in knowing who is on private land (POPIA s11(1)(b) and (f)).

To deliver the service, keep riders and farms safe, meet legal obligations, resolve disputes, and send you transactional email. We do not sell, rent, or trade your personal information, and we do not use it for advertising.

We share the minimum necessary with our processors — Paystack for payments (South Africa), a cloud provider for email and storage (data hosted in South Africa), Slack for our internal alerts (United States), and an analytics provider — each under its own agreement. Paystack gets your email address and the amount; the card or banking details you type on their checkout go to them and never reach us.

One of them sees your identity document. When you verify, your ID photo and your selfie — and, when you add a registered vehicle, photos of its licence disc and number plate — are sent once to Anthropic (the Claude API, United States) for an automated first look: is this a genuine document, does the selfie plausibly show the same person, what name is on it, and does the registration on the disc match the plate — which identifies the vehicle; we don’t judge whether the disc is current. No template or measurement of your face is made or kept, nothing is ever compared against another person, and your images are not used to train any model. It can clear a straightforward submission; the only thing it can turn down on its own is an image we can’t read, which you can simply re-take. Anything it isn’t sure of goes to a person on our team.

We share the rider manifest with the farm whose land you’ve booked: your verified name, your mobile number, and your vehicle’s make, model and plate — never a document or photo. We disclose data to authorities only when legally compelled.

One thing we publish rather than share: if you publish a route guide, your name appears on it publicly, together with your guide and how many you have published. Authorship is credited under your real name by design — it is what a rider is trusting, and it is what you get for writing the guide — so publishing one is a deliberate act of putting your name on the open web. You can withdraw a guide at any time.

When you sign in we set one session cookie so the site can keep you signed in. POPIA exempts strictly-necessary cookies from consent, so it loads either way.

If you accept the cookie banner, we load analytics to understand how the site is used. Your IP is truncated before storage, and we never send your name or email to the analytics provider. Reject the banner and no analytics cookies are set.

When you submit a form (waitlist, listing request or referral), we also record how you reached us — the link, post or ad you arrived from — so we can see which channels work. This is stored alongside your submission, never shared, and only sent when you choose to submit.

We do run a Meta (Facebook) advertising pixel, and have since June 2026. Like the analytics, it is consent-gated — it loads only if you accept the banner — and it runs only on our open public pages: the home page, farm pages, the farmer pages and our legal pages. It is never present once you sign in, and never on a private link we email you, such as your permit card or a listing you’ve been asked to approve.

You can withdraw consent at any time by clearing this site’s data in your browser — the banner will reappear — or by emailing legal@routekeepers.co.za.

Separately, we keep our own first-party record of how Routekeepers is used — a permit bought, a listing step finished — which is why we don’t need to send your signed-in activity to anyone else. It stays in our database in South Africa, reaches no advertising platform, and never records what you typed or what’s in a document. We keep it for 24 months. If you’d rather we didn’t, tick “Don’t record what I do here” under Settings — that stops our security records too.

We keep personal information only as long as needed for the purpose it was collected, or as the law requires — financial records, and our record of an identity decision — approved or not, on what date — for up to 7 years (SARS and POPIA). Your ID and selfie images stay on file while your account is open (§4); they, and anything the automated check wrote about them, are erased when you delete your account: a description of your face does not outlive the photograph it describes. Erased information leaves our rolling backups within 8 weeks. Security records of consequential actions — sign-in, identity verification, payment — keep their full detail for six months; after that we keep only the country and the network you were on, with the link back to you severed. Our first-party record of how the site is used (§7) is kept for 24 months and then deleted. We delete or anonymise data when it’s no longer needed.

You can ask us to give you a copy of the information we hold about you, correct it, delete it (subject to the retention periods above), object to specific processing such as analytics, or provide it in a portable format. If you have an account, you can download your data or delete your account yourself under Settings → Your data & privacy, and object to our own measurement under Settings → Measurement. You can also email legal@routekeepers.co.za and we’ll respond within 30 days, free of charge.

When you delete your account we erase your identity and vehicle documents and mask your contact details. We keep a minimal, de-identified record of past permits and payments for the retention periods above, as the law requires.

If you believe we’ve mishandled your data, you can complain to the Information Regulator of South Africa at inforegulator.org.za.

You receive marketing email only if you opt in, and you can opt out at any time. Transactional email — booking confirmations, gate codes, account events — is required for the service and is not direct marketing.

The Platform is not for anyone under 18, and we don’t knowingly collect their personal information.

Our analytics provider and Slack process some data outside South Africa, protected by contractual safeguards and encryption. POPIA permits such transfers where the recipient is bound by substantially equivalent protections.

The owner's chat in §14 also uses Anthropic in the United States, to suggest replies to David: the owner's messages go there with any numbers removed first, under the same agreement, and are not used to train any model.

The one worth naming on its own is the identity check in §4 and §6: your ID image and selfie, and your licence disc and plate photos, go to Anthropic in the United States, once, when you submit them. That transfer is covered by a binding agreement holding them to protections substantially similar to POPIA’s — confidentiality, security, and no training on what we send. Nothing is kept there for our purposes, and no copy of your face is retained anywhere in a form that could be matched against anyone.

We apply appropriate technical and organisational safeguards to protect your personal information, and we make the breach notifications POPIA requires if an incident occurs.

What a rider tells us. When a rider tells us about a farm we don’t list, we keep what they know first-hand: the farm’s name, the town and a pin if they drop one, how they know it, what they rode there, and whether they can message the owner themselves. If they choose, they can add the route in their own words or a GPS track, which we use only if the owner agrees to list. We look up the property under the pin in the public land records, so that we recognise the farm if it is introduced again.

We never contact the owner. We never ask a rider for the owner’s name, number or email. The rider sends our card from their own phone, to whoever they choose, and we learn only that they pressed Share — never who received it. The card, and the farm’s page if it lists, show the rider’s name only if the rider agrees.

The owner decides. The link on the card opens a page that shows exactly what we have and where it came from, with two choices. Yes: the owner gives us their name and number, and David starts a chat with them on our site. Not interested: we stop, let the riders who asked know kindly, and keep a record that the farm said no — tied to the property and, if a number was given, to a one-way coded form of it — so the farm is never put to its owner again. A note on what held the owner back, if they leave one, is deleted after 12 months.

The chat. Every message in it is typed or recorded by David. Photos sent in it have their location data removed and are used for the listing. Voice notes are turned into text so they can be read. To help David reply, the owner’s messages — with numbers such as gate codes removed first — go to Anthropic (§12), which suggests an answer that only David sees. If the owner adds an email address or allows notifications, we use it only to say that David has replied, never what he wrote; a notification passes through the phone’s own push service (Apple or Google). If the owner answers on WhatsApp instead, David may keep a picture of that reply with the chat, and it is deleted with the chat.

How long. If the farm lists, the chat is kept while it is listed and for three years after. If it doesn’t, the chat is kept only if the owner agreed to that; otherwise we delete the owner’s number and the chat 12 months after the last message. The owner can stop, or delete the chat, at any time under “About this chat”.

Lawful basis. Our legitimate interest, and the rider’s, in letting a farm’s owner decide whether we may talk to them — and nothing more until they do (POPIA s11(1)(f)). After a yes, the owner’s consent (s11(1)(a)).

We may update this policy; material changes require your renewed acceptance. For any privacy question or to exercise a POPIA right, email legal@routekeepers.co.za.