Last updated: 25 October 2026
1. Who we are
Responsible party (POPIA terminology):- Alchemy Digital Cloud (Pty) Ltd
- Registration number
2025/028829/07 - D-U-N-S
567455153 - Republic of South Africa
- Contact: hello@loosh.app
2. What information we collect
To provide the Service we collect the following categories of personal information:- Identity information — full name, date of birth, identity number, proof of identity, proof of address, and selfie verification image. This is required by the Financial Intelligence Centre Act (“FICA”) to verify the people who use the Service.
- Contact information — your phone number and email address.
- Financial information — your wallet balance, transaction history, top-up sources (last four digits of payment card; we do not store full card numbers), and bank account details you provide for withdrawals.
- Location information — your approximate position, if you choose to turn it on. We use it in search and discovery to show workers and services near you first. It is read only while you are using the app, we do not build a history of where you have been, and search and discovery work without it.
- Device and usage information — device type, operating system, app version, IP address (used for fraud prevention), and basic interaction data.
- Customer support information — any details you share when you contact us.
3. Why we collect it
We process personal information for the following purposes:- To verify your identity in compliance with FICA.
- To enable you to send, receive, top up, and withdraw funds.
- To prevent fraud, money laundering, and other illegal activity.
- To comply with reporting obligations to the South African Reserve Bank, the Financial Intelligence Centre, and other regulators.
- To respond to your support enquiries.
- To improve the Service and develop new features.
4. How we use third-party processors
We share personal information with carefully selected service providers (“operators” under POPIA) who help us deliver the Service:- Supabase — for our database and authentication infrastructure.
- Sumsub (or equivalent) — for KYC verification of identity documents and selfies.
- Card payment processing — our card payment processor is still to be appointed. We will name them here before card top-ups become available.
- First National Bank — for executing withdrawals to your bank account.
- Clickatell — for SMS one-time passwords. Clickatell is a South African company; we may use additional or alternative SMS providers in future, in which case we’ll update this list.
- Resend (or equivalent) — for transactional email.
- Apple Push Notification Service / Firebase Cloud Messaging — for mobile push notifications.
- Sentry — for application error monitoring (with personal identifiers scrubbed from error reports).
- Google Maps Platform (Places) — to look up workplace and business addresses. When you have location turned on, your approximate position is sent with the lookup so that nearby results come back first.
5. Where we store information
Personal information is stored on infrastructure operated by Supabase in a data centre region as close to South Africa as Supabase offers (currently the European Union). We do not transfer your personal information outside these locations except as required to operate the Service or to comply with the law.6. How long we keep it
We keep different kinds of information for different lengths of time.
Each period runs from your last interaction with the Service, the conclusion of
the relevant transaction, or the filing of a report where one is required.
What happens at the five-year mark matters, so we want to be plain about it.
Loosh records money movement in a ledger that can only be added to, never edited
or erased — that is what makes a balance something you can rely on rather than
something we assert. We cannot delete those entries. What we do instead is
remove, at five years, the personal information that connects them to you. From
that point the remaining records are amounts and dates that identify nobody, and
they are deleted in full at seven years.
Information that is not subject to a retention obligation is deleted when it is
no longer needed.
7. Your rights under POPIA
You have the right to:- Be told what personal information we hold about you.
- Request a copy of that information.
- Ask us to correct information that is inaccurate.
- Ask us to delete information that we are no longer required to keep. See how to request account deletion.
- Object to processing in certain circumstances.
- Lodge a complaint with the Information Regulator of South Africa.
8. How we protect your information
We use industry-standard measures to protect your personal information, including:- Encryption in transit (TLS) and at rest.
- Strict access controls and least-privilege permissions.
- Daily integrity checks against our financial records.
- Regular security reviews and incident-response procedures.
- Two-factor authentication on every administrative account.