Privacy Policy

Companions Fintech (Pty) Ltd (“we”, “us”) runs CompanionsFintech, a platform that connects South African small businesses that need working capital with the investors and funding partners who provide it.

For the personal information described here we are the “responsible party” under POPIA: we decide why and how it is used.

• Company: Companions Fintech (Pty) Ltd, trading as CompanionsFintech
• Email: support@companionsfintech.com
• Website: companionsfintech.com

Only what we need to run the platform. What that is depends on how you use it.

• Everyone: your email address, a password (kept only as a one-way hash), when you agreed to our legal documents, sign-in and security records such as your last sign-in, and anything you send us.
• Businesses: your name and phone number; your business’s name, type, registration number, industry, start date, website, VAT details, monthly revenue, annual turnover and number of employees; a description of the business; your answers to our business-health questions; bank details, documents and images if you add them; your loan applications, repayments and transactions; and the Trust Score we calculate. When you register we also record your IP address and browser details, to help prevent fraud.
• Investors: your username, name, country and city; whether you invest as an individual or a company, and the company’s details; your investment preferences (amount per business in US dollars, loan term, risk, experience, sectors and causes); profile images; the address of the wallet we create for you and its encrypted key; and your investments, returns and transactions.
• Funding partners: your name, role and work email; your organisation’s details and lending criteria; and the contact details of its representatives.
• If you sign in with Google: your name, your email address and whether Google has verified it. We never see your Google password.
• Newsletter, waiting list and contact forms: your email address and whatever name or message you choose to give.

We do not ask for special personal information (such as health, religion, race or biometric data) or for information about children. Please do not put any in documents or messages.

• To create and secure your account and confirm your email address.
• To run the marketplace: list businesses, show investors what they need to judge a listing, and process investments, repayments and wallet activity.
• To assess businesses, including calculating a Trust Score that sets credit limits.
• To contact you about your account, loans, investments and security.
• To prevent fraud, abuse and misuse, and keep the platform secure.
• To meet our legal duties, including record-keeping, tax and — where they apply to us — identity-verification and anti-money-laundering requirements.
• To improve the platform while it is in beta.
• To send news and offers, only if you have opted in.

POPIA needs a lawful ground for each of these. We rely on your consent (given when you agree to the Data & Information Consent), on what is needed to give you the service you asked for, on our legal obligations, and on our legitimate interest in keeping the platform safe and working. You can object to that last one.

A business’s Trust Score is worked out by our systems from what the business tells us and its history on the platform. It affects the credit limit a business is offered and what investors see. If a score or decision affects you and you think it is wrong, ask us for a person to review it and to hear your side (POPIA section 71).

We do not sell personal information. We share it only in these ways:

• On the marketplace. A business with a listing can be seen by investors and by visitors without an account: its name, description, industry, start date, website, city and country, images, verification status, Trust Score, whether it is VAT-registered, how long it has been on the platform, and the loan’s purpose, amount, rate, term and how much has been funded. We do not publish its contact details, bank details, uploaded documents or full address.
• With the other side of a deal. We share a person’s or organisation’s details with the business, investor or funding partner involved only where needed to make, administer or repay funding, or where you have agreed.
• With our service providers, who process it for us under contract and may use it only to serve us: cloud hosting (Vercel), our database (MongoDB Atlas), email delivery, image storage (Cloudinary), Google sign-in, and wallet and blockchain infrastructure (ZeroDev and the Scroll network).
• With regulators, courts, law enforcement and other authorities, where the law requires or allows it.
• With a buyer or successor, if the business is sold or restructured, on the terms of this policy.

Investments are settled in USDC on a public blockchain. Wallet addresses, amounts and transaction identifiers recorded there are visible to anyone, and cannot be changed or erased by us or anyone else. We do not write your name, email address or other contact details to the blockchain.

That means a request to delete your information can remove your details from our systems, but not a transaction already recorded on the blockchain.

Some of our providers store or process information outside South Africa. Where they do, we use only providers bound by law, binding rules or contract to protect it in a way that is substantially similar to POPIA — or we ask for your consent first (POPIA section 72).

• Information is held in a managed cloud database, and access is limited to the people and systems that need it.
• Passwords are never stored in readable form; they are hashed with bcrypt.
• Wallet private keys are encrypted at rest with authenticated encryption (AES-256-GCM), and the encryption key is kept apart from the database.
• Sign-in sessions use secure, HTTP-only cookies, sent over HTTPS in production.
• Sign-up and sign-in attempts are rate-limited, and new email addresses are confirmed with a PIN.

No system is perfectly secure, and CompanionsFintech is a beta. If we believe your information has been accessed by someone without authority, we will tell you and the Information Regulator, as POPIA requires (section 22).

Only as long as we need it for the reason we collected it, and as the law requires. Account information is kept while your account is open and afterwards for as long as we need to deal with disputes. Financial and transaction records are kept for the period the law requires — commonly five years or more. When we no longer need information we delete it or de-identify it. During the beta, test data may be corrected or cleared.

• Ask what we hold about you and get a copy (POPIA section 23).
• Ask us to correct or delete information that is inaccurate, out of date, incomplete, misleading or unlawfully obtained, or that we no longer need (section 24).
• Object to processing that rests on our legitimate interests, and to direct marketing (sections 11(3) and 69).
• Withdraw your consent at any time. That does not undo what we lawfully did before you withdrew.
• Ask for a person to review a decision made only by automated means (section 71).
• Complain to the Information Regulator.

Email support@companionsfintech.com. We may need to confirm who you are first, and we aim to reply within 30 days. Requests under the Promotion of Access to Information Act (PAIA) go to the same address.

Complaints: The Information Regulator (South Africa) — https://inforegulator.org.za — complaints.IR@justice.gov.za.

We send news and offers only if you subscribe or opt in. Signing up to our newsletter is separate from creating an account, and creating an account does not subscribe you. Every marketing message carries an unsubscribe link. Service messages about your account, loans, investments and security are not marketing and are not optional.

We use only the cookies the platform needs to work: session cookies that keep you signed in, and a short-lived cookie that protects Google sign-in against forgery. Your light or dark theme is remembered in your browser. We do not use advertising cookies and, at the time of writing, no analytics trackers. Blocking the essential cookies will stop sign-in from working.

CompanionsFintech is for people aged 18 or over and for businesses. We do not knowingly collect information about children; if you think we have, tell us and we will delete it.

When this policy changes we update this page and its date. If a change affects what you have agreed to, we will ask you again.