Privacy Policy — VarsityPlug

1 What We Collect

Account info: Email address, display name, profile photo.

Listing data: Photos, prices, descriptions, and WhatsApp contact you provide.

Email verification: One-time link sent to your university email address to confirm student status.

Payment proof: EFT proof of payment screenshots submitted for Pro plan activation.

Usage data: Browser type, pages visited, and session info for security and debugging.

2 How We Use Your Data

Your data is used exclusively to:

Authenticate and secure your account
Display your listings in the marketplace
Automate student status verification via email
Send transactional emails (verification outcomes, payment confirmations)
Detect and prevent fraud, scams, and platform abuse

We do not use your data for targeted advertising or profiling.

3 Who We Share Data With

We never sell your personal data. We only share data with trusted infrastructure providers:

Google Firebase

Authentication, database (Firestore), file storage, and serverless functions. Governed by Google's Privacy Policy.

Payment Processors

We use secure third-party processors for instant payments. We never store your full payment details on our servers.

4 Data Retention

Account data is retained while your account is active.
Deleted listings are removed from the public marketplace immediately and from our database within 24 hours.
Email verification status is retained permanently as a flag on your account profile.
Payment proof (EFT) is retained for a maximum of 30 days for record-keeping, then deleted.

5 Cookies

We use session cookies only for authentication — to keep you logged in securely as you browse.

We do not use third-party advertising cookies, tracking pixels, or analytics tools that profile your behaviour.

6 POPIA Compliance & Your Rights

As a South African platform, we are committed to the **Protection of Personal Information Act (POPIA)**. You have the following rights as a Data Subject:

Right of Access — request a copy of all data we hold on you
Right to Rectification — update inaccurate profile information at any time
Right to Erasure — request full deletion of your account (Right to be Forgotten)
Right to Object — withdraw consent for data processing

VarsityPlug acts as the **Responsible Party** for your data. We ensure all **Operators** (like Firebase) maintain strict security standards.

To exercise any rights, email our Information Officer at privacy@varsityplug.pro.

7 Security

All data is transmitted over HTTPS (TLS encryption). Firebase infrastructure applies industry-standard security measures including at-rest encryption.

We strongly encourage you to use a strong, unique password and never share your account credentials.

8 Contact

For any privacy-related questions or requests, contact us at:
contact@varsityplug.pro