Last updated: 27 July 2026

This explains what personal information OnlyPaws collects, why, who else sees it, and what you can do about it. It is written to comply with the Protection of Personal Information Act 4 of 2013 (POPIA).

1. Who is responsible

ONLYPAWS (PTY) LTD (2026/592019/07), trading as OnlyPaws, is the responsible party for your personal information.

Information Officer	Sean Arenson
Email	support@onlypaws.co.za
Address	16 Hall Road, Sea Point, Cape Town, Western Cape, 8005

Our Information Officer is registered with the Information Regulator of South Africa under registration number 2026-063107.

2. What we collect

Everyone

• Account: name, email address, phone number, profile photograph, and whether you use OnlyPaws as an owner, a walker or both.
• Technical: device push notification token, and the usual server logs.

Dog owners

• About your dogs: name, breed, sex, size, weight, date of birth, temperament, energy level, how they behave with other dogs, people and children, whether they pull on the lead, whether they are neutered and vaccinated, medical notes and medications, free-text notes, and photographs.
• Walk requests: the suburb and the approximate pickup location of the walk, when, and for how long.

Walkers

• Verification: your South African identity document, a live selfie, and the results of the identity, liveness and face-match checks.
• Proof of residence: the document you upload, such as a utility bill or bank statement.
• References: the names and phone numbers of two people you nominate.
• Availability and location: whether you are online, and your device's location while you are online so that nearby requests can reach you.
• Bio and service areas.

During a walk

• A detailed GPS trail. While a walk is running we record the walker's location repeatedly and keep the full route afterwards. This is precise location data about a real person's movements, and we treat it accordingly.
• Messages between the owner and the walker.
• Photos and short videos the walker chooses to send during the walk. These are taken outdoors and may incidentally show streets, houses or passers-by. They are stored privately and are visible only to the owner, the walker, and an administrator investigating a reported problem — never publicly, and never to anyone else using OnlyPaws.
• The walk summary, including distance, duration, whether the dog urinated or defecated, and any note the walker leaves.

Afterwards

• Ratings and reviews, including tags, comments and any tip you record.
• Problem reports and the message thread with our support team.

Waitlist

If you sign up on onlypaws.co.za we store your email address, whether you are an owner or a walker, optionally your suburb, and anything you write in the message box.

3. Biometric information — walkers, please read

The liveness check and face match involve processing your biometric information, which POPIA treats as special personal information subject to stricter rules.

We process it only with your explicit consent, given when you start verification, and only to confirm that you are a real person and that you are the person on the identity document you submitted. We do not use it for any other purpose and we do not share it for any other purpose.

You can refuse. If you do, we cannot verify you and you cannot be activated as a walker.

We deliberately store as little as possible. Our verification provider extracts your identity number, date of birth and address from your document, but we store only three pass/fail results — identity verified, liveness passed, face matched. The extracted personal details are not saved to our systems.

4. Why we use it, and our legal grounds

What we do	Why	POPIA ground
Create and run your account	To provide the service you asked for	Performance of a contract
Match owners with nearby walkers	Core function	Performance of a contract
Verify walker identity, address and references	Safety of owners, dogs and the public	Legitimate interest; consent for biometrics
Live location during a walk	So an owner can follow their dog	Performance of a contract; consent
Messaging and support	Communication and dispute resolution	Performance of a contract
Ratings and reviews	Trust and safety on both sides	Legitimate interest
Push notifications about your walks	Core function	Performance of a contract
Suspending accounts, investigating reports	Protecting people and animals	Legitimate interest; legal obligation

We do not sell your personal information, and we do not use it for advertising.

5. Who else sees it

Other users

• Owners see a walker's name, photograph, bio, service areas, rating, and anonymised excerpts of reviews others have left. Reviews shown on a walker's profile are not attributed to the person who wrote them.
• Walkers see the owner's name and rating, the dog's profile including medical notes, the suburb, and — once a walk is assigned — enough contact and location detail to carry it out.
• Neither side sees the other's email address or identity documents.

Service providers

Provider	What they receive	Where
Supabase	Everything — database, file storage, authentication	Ireland (eu-west-1)
Didit	Walker identity document and selfie, for verification	Contracting entity in the United States (Didit Identity, Inc., Delaware). Processing by default in the European Union, and it may take place in the United States
Expo	Push tokens and the text of notifications, including dog names, suburbs and message previews	United States
Google (Firebase Cloud Messaging)	Delivery of push notifications to Android devices	United States / global
Mapbox	Map tile requests while a map is displayed, and a single coordinate when we look up which suburb you are in to fill in a walk request	United States

We do not currently process payments. When we do, a payment provider will be added here and we will tell you before it goes live.

Others

We may disclose information where the law requires it, to establish or defend a legal claim, or where there is a serious and immediate risk to a person or an animal.

6. Your information leaves South Africa

It is stored in Ireland, not in South Africa. Our database, file storage — including walker identity documents and proof of residence — and all authentication run on Supabase infrastructure in the eu-west-1 region.

POPIA section 72 permits this where the destination has substantially similar protection. Ireland is subject to the EU General Data Protection Regulation, which meets that standard.

Some information reaches the United States. Push notification content passes through infrastructure there, as set out above. More significantly for walkers: because OnlyPaws is a South African company, our contract for identity verification is with Didit Identity, Inc. in the United States, not its European entity. Didit processes in the European Union by default, but processing may take place in the United States.

The United States does not have a general data protection law that POPIA treats as substantially similar. That transfer therefore relies on the explicit consent you give before verification starts, and on our contractual arrangements with the provider — which is why the consent in section 3 is asked for separately rather than folded into accepting these terms.

We would rather set this out than let you assume everything stays in one place.

7. How long we keep it

Account information	While your account is open, then 12 months after closure
Walk history, routes, reviews	3 years (dispute and claim window)
Messages	12 months
Walker identity and proof of residence documents	12 months after the account closes
Verification results (the three pass/fail flags)	While the walker is active, then 3 years
Problem reports and support threads	3 years
Waitlist entries	Until we launch in your area or you ask us to remove you

These are enforced automatically, not just stated. A scheduled job runs every night and removes anything past its period, including deleting the actual files from storage rather than only the database records pointing at them.

Two things are deleted sooner than the table above suggests, because they do not need to be kept:

• The detailed GPS trail of a walk is removed 30 days after it ends. The route you see on a completed walk is a summary saved separately, so your walk history keeps its map — but the underlying minute-by-minute location record does not survive.
• Diagnostic location logs are removed after 7 days.

8. Your rights

Under POPIA you may:

• Ask what we hold about you and get a copy
• Correct or delete information that is wrong, misleading or no longer needed
• Object to processing based on legitimate interest
• Withdraw consent where we rely on it, including for biometric processing — though this means we can no longer verify you as a walker
• Complain to the Information Regulator

To exercise any of these, contact support@onlypaws.co.za. We will respond within a reasonable time and may need to confirm your identity first.

Some information survives a deletion request where we must keep it by law, or need it to resolve a dispute or defend a claim. Where a review you wrote is removed, the rating may remain in aggregate form so that other people's history is not distorted.

Information Regulator of South Africa JD House, 27 Stiemens Street, Braamfontein, Johannesburg 2001 complaints.IR@justice.gov.za · https://inforegulator.org.za

9. Security

Access to data is restricted at the database level so that you can only read your own records and those of walks you are part of. Identity documents and proof of residence are held in private storage that is not publicly reachable, and administrators access them through short-lived signed links rather than public URLs.

No system is perfectly secure. If a breach affects your personal information we will notify you and the Information Regulator as POPIA requires.

10. Children

OnlyPaws is for adults. We do not knowingly collect information about anyone under 18. If you believe we have, contact us and we will delete it.

11. Changes

We will post any update here and, for material changes, give notice in the app or by email.