Privacy policy

Last updated: 18 October 2026

Who we are

Phasa is operated by Ridgeback Digital (Pty) Ltd, registration number 2026/812340/07, 6 Jasmin Street, Bethal, Mpumalanga, 2309 ("we", "us"). We are the responsible party for your personal information under the Protection of Personal Information Act, 2013 (POPIA). Our Information Officer is Riyad Hassan, reachable at [email protected], and is registered with the Information Regulator.

What we collect, where it comes from, and why

• Your practice progress (answers, scores, streaks) is stored only on your own device so the app works offline. We do not receive it.
• Your email address, which you give us when you sign in or pay, so we can send you a one-time sign-in code, link your purchase to you on any device, and send your receipt.
• Purchase records (plan, amount, date, payment reference, access period, and any gift or friend codes), which come from you and from Paystack when it confirms your payment, so we can give you the access you paid for, handle refunds and keep the tax records the law requires.
• Anonymous usage events (for example "started the free test", "reported a question" or an error message), linked only to a random code created on your device, so we can fix problems and improve the app. These never include your name, email, phone number or payment details, and nothing is sent if your browser's Do Not Track setting is on.
• Survey answers, if you choose to complete our pricing survey. These are anonymous.

We do not collect your ID number, and we never see or store your card or bank details.

Is it compulsory? No. You can use the free test without giving us anything. Giving your email is voluntary, but without it we can't sign you in, confirm a purchase or restore your access on another phone.

Learners under 18

You can get a learner's licence from 16 (motorcycle) or 17 (car), so many of our users are under 18. POPIA treats anyone under 18 as a child, so we only process a child's email and purchase details with the consent of a parent or guardian. If you are under 18, please ask a parent or guardian before you sign in or pay. They can also pay for you using "Ask a parent to pay" or buy Phasa as a gift. If we learn that we hold a child's information without that consent, we will delete it.

Who we share it with

• Paystack processes your payment. Your card or bank details go directly to Paystack, not to us. See Paystack's privacy policy.
• Supabase hosts our database and sign-in service on our behalf, under a written agreement that requires it to keep your information secure and confidential.
• We do not sell your personal information or share it for advertising.

Supabase stores our data in [region], outside South Africa. We only use operators who are bound by law or agreement to protect your information to a standard comparable to POPIA (section 72).

Cookies and storage on your device

Phasa does not use cookies, advertising tags or tracking pixels (such as Meta, Google or TikTok pixels), so you won't see a cookie banner. If we ever add one, it will only load after you agree to it. To work offline, the app saves your progress, settings and a random device code in your browser's storage on your own phone or computer. If you sign in, the sign-in service keeps you logged in the same way. You can clear all of this at any time by clearing your browser's site data for getphasa.co.za; you will lose your saved progress.

Other services the site loads

Everything you see when you open Phasa (pages, lettering and photos) comes from our own website, hosted by Cloudflare. Other services are only contacted when you use them: Supabase (and jsDelivr, which delivers its sign-in code) when you sign in, and Paystack when you pay. They receive technical information such as your IP address and browser type. Each has its own privacy policy.

Marketing

We will not send you marketing emails or messages unless you have asked to receive them, and you can stop them at any time.

How long we keep it

We keep purchase records for five years because tax law requires it. Account emails are kept while your account is active and deleted when you ask. Anonymous usage events are deleted after 12 months.

Your rights

You may ask us what personal information we hold about you, ask us to correct or delete it, withdraw a consent you gave, or object to how we use it, by emailing [email protected]. We will reply within 30 days. If you are not happy with our answer, you may complain to the Information Regulator: inforegulator.org.za.

Security

We use encrypted connections (HTTPS), access controls on our database, and we keep personal information out of our logs. If a security compromise affects your personal information, we will tell you and the Information Regulator as soon as reasonably possible, as POPIA requires.

Changes

If we change this policy, we will update the date at the top. If a change affects how we use information you have already given us, we will tell you first.