Privacy policy (draft)

1. Who we are

This Wi-Fi service ("HeyWiFi", "we", "us") is operated by Vibrolytics, registration number 2026/186147/07, of [PLACEHOLDER: registered address] ("we", "our company"). We are the "responsible party" under the Protection of Personal Information Act 4 of 2013 (POPIA) for the personal information described in this policy.

Our Information Officer can be contacted at privacy@vibrolytics.co.za for any question, request, or complaint about how your information is handled.

2. Scope

This policy applies to anyone who connects to guest Wi-Fi on a bus running HeyWiFi and completes registration or login on this landing page. It does not cover the bus operator's own ticketing, telematics, or driver-communication systems, which run on entirely separate devices and are not part of this service.

3. Personal information we collect

We collect:

• Information you give us at registration: name, surname, gender, date of birth, and whichever of email address or cell phone number you choose to provide as your identity method.
• Consent choices: whether you agreed to data processing (required) and whether you opted in to marketing from brand partners (optional).
• Device and network data: your device's MAC address, the identifier of the bus/access point you connected through, and network session information (session start/end time, data used, bandwidth cap and session-timeout applied to you).
• Ad interaction data: which ad campaigns were shown to you and when, tied to your login event and the bus/route you were on at the time.
• Survey answers: some campaigns ask a short survey instead of, or after, an ad. We record your answers (or that you skipped it, where skipping is allowed), tied to your login event and the bus/route you were on. Please don't include personal details in written answers.
• Verification data: the one-time PIN or magic link sent to confirm the email or phone number you provided.

We do not collect payment details, government ID numbers, health information, biometric data, or precise GPS location of your device. (The vehicle itself reports its own GPS position for route/ETA purposes — see section 4 — this is location data about the bus, not a location reading taken from your personal device.)

We do not currently use analytics or advertising cookies/trackers beyond what is strictly necessary to run your Wi-Fi session and show you the ad interstitial described in section 4.

4. How and why we use your information

• To create and maintain your guest account, recognise you as a returning user, and grant you Wi-Fi access on the bus network (contractual necessity / performance of the service you requested).
• To verify the email or phone number you provide, via a one-time PIN or magic link (necessary to prevent fraudulent registrations and to be able to reach you if required).
• To enforce fair usage of the network, such as per-user bandwidth caps and session time limits.
• To select, display, and measure the performance of ad campaigns shown to you during login (impressions and clicks), and to show you real-time next-stop/ETA information for your route alongside those ads.
• To produce aggregated, de-identified reports for brand partners (e.g. total impressions/clicks by route) and, if enabled, higher-level reports broken down by age range or gender for campaign targeting and performance analysis.
• To send you marketing communications from brand partners, but only if you separately ticked the optional marketing opt-in — see section 8.
• To meet legal, safety, and security obligations (for example, responding to a lawful request from a regulator or law enforcement, or investigating misuse of the network).

Ad campaign selection is based on rules set by advertisers (route, time of day, campaign budget) and is not a form of automated decision-making that produces legal or similarly significant effects on you.

5. Our legal basis for processing

Under POPIA, we rely on: your consent (the data-processing consent you give at registration, and separately for marketing); the fact that processing is necessary to provide the Wi-Fi service you asked for; and our legitimate interests in keeping the network secure, fairly allocated, and operating correctly, balanced against your rights. Where GDPR applies to you (see section 12), the same activities are carried out under Article 6(1)(a) consent, 6(1)(b) contract, and 6(1)(f) legitimate interests respectively.

6. Who we share it with

We share personal information with:

• Brand partners whose ad campaigns run on this service: they receive aggregated, route/campaign-level reporting (impressions, registration counts, and survey results as totals — never your individual answers), and only receive your individual contact details (email or phone) if you separately opted in to marketing from brand partners. This opt-in is a single, account-wide choice made at registration — it is not set separately for each brand or campaign.
• Service providers who process data on our behalf (operators, in POPIA terms), under contract and only to deliver this service — currently: our database/authentication provider (Supabase), our web hosting provider (Google Firebase App Hosting), and the RADIUS authentication provider that authorises your network session. These providers may not use your information for their own purposes.
• The bus operator, limited to what is necessary to identify which vehicle/route a session relates to (not your full registration details).
• Regulators, law enforcement, or other third parties where we are legally required to disclose information, or to protect the rights, safety, or property of HeyWiFi, riders, or the public.

We do not sell your personal information.

If your contact details are shared with a brand partner because you opted in to marketing, that brand becomes responsible for how it uses your details for that purpose, and its own privacy notice will apply to those communications — you can opt out directly with them at any time, or by withdrawing your opt-in with us (section 8).

7. Cross-border transfers

Our database and authentication provider (Supabase) currently stores your information in the EU (Ireland). Where personal information is processed outside South Africa, we take steps required by POPIA section 72 to ensure it continues to receive an adequate level of protection — for example, by relying on the provider's contractual data-protection commitments, or on your consent. [PLACEHOLDER: confirm the hosting region for every other service provider in section 6 (Firebase App Hosting, RADIUS provider) once infrastructure is finalised, and attach the relevant data processing agreements.]

8. Your choices

Data processing consent is required to use this service — without it we cannot create your account or authorise your Wi-Fi session. Marketing opt-in is entirely optional, is unticked by default, and is completely separate from the consent above: declining it does not affect your Wi-Fi access.

Marketing opt-in is a single, account-wide setting, not a choice you make separately for each brand partner or campaign: ticking it tells us you're open to being contacted by brand partners whose campaigns run on the service generally.

You can withdraw marketing consent at any time by using the unsubscribe/opt-out option in any marketing message you receive, or by contacting us at privacy@vibrolytics.co.za. Withdrawing consent does not affect the lawfulness of anything already done before the withdrawal.

9. How long we keep your information

We keep your registration information for as long as you have an active account, and for 24 months after your last recorded visit, after which it is automatically anonymised (your name, contact details, and device ID are permanently cleared, and any written survey answers deleted) unless we are required to keep it longer — for example, to meet a legal, tax, or dispute-resolution obligation. Network-session logs and ad-interaction records (including survey answers) tied to a campaign that has finished running are automatically deleted after 12 months; records for a campaign still running stay in place until it ends, since brand reporting and campaign budgets are calculated from them. These are automated processes, not a manual, best-effort cleanup.

10. How we protect your information

We use appropriate technical and organisational measures to protect your personal information against loss, unauthorised access, alteration, or disclosure, including access controls that restrict brand partners to only their own campaign data, encryption of data in transit, and restricting who on our team can access registration records. No system is perfectly secure, and we cannot guarantee absolute security.

11. Your rights

Subject to POPIA, you have the right to:

• Ask us to confirm what personal information we hold about you and access a copy of it;
• Ask us to correct information that is inaccurate, incomplete, or out of date;
• Ask us to delete or destroy personal information we no longer have authority to hold;
• Object, on reasonable grounds, to our processing of your personal information;
• Object to your information being used for direct marketing at any time;
• Withdraw any consent you previously gave, without this affecting processing that already took place;
• Complain to us directly, or lodge a complaint with the Information Regulator (South Africa) if you believe we have not complied with POPIA.

To exercise any of these rights — including asking us to delete your data — email us at privacy@vibrolytics.co.za. We may need to verify your identity before actioning a request; once verified, a deletion request permanently clears your name, contact details, and device ID (your past Wi-Fi session and ad-view history is kept only in a form no longer linked to your identity, so brand reporting already delivered stays accurate). The Information Regulator can be contacted at complaints.IR@justice.gov.za or via www.justice.gov.za/inforeg.

12. If you are in the European Economic Area (GDPR)

If you are located in the EEA when you use this service, the General Data Protection Regulation (GDPR) also applies. In addition to the rights in section 11, you have the right to data portability and to restrict processing in certain circumstances, and you may lodge a complaint with your local data protection supervisory authority. [PLACEHOLDER: if EEA guests are expected in practice, confirm whether an EU representative under GDPR Article 27 is required and name them here.]

13. Minimum age

This service is only for people aged 18 or over. Registration is blocked if the date of birth you provide indicates you are under 18. We do not knowingly collect personal information from children, and if we become aware that we have done so, we will delete it.

14. Cookies and similar technologies

We use only the strictly necessary session identifiers needed to keep you logged in during your Wi-Fi session and to complete the network login handoff with the bus's hotspot. We do not currently use third-party advertising or analytics cookies. If that changes, we will update this policy and, where required, ask for your consent first.

15. Changes to this policy

We may update this policy from time to time, for example to reflect a change in our service or the law. We will update the "last updated" date at the top of this page, and where a change is material we will take reasonable steps to bring it to your attention (e.g. at your next registration or login).

16. Contact us

Questions, requests, or complaints about this policy or your personal information can be sent to our Information Officer at privacy@vibrolytics.co.za.