1. Why we publish this
Section 6 of the Privacy policy says we share information with service providers who process on our instructions. That is true of every company on earth and tells you nothing. This page names them.
A provider appears here if it can see personal information about you in the ordinary course of doing its job for us. A provider that only ever sees aggregated or de-identified numbers does not.
2. The providers
Google Firebase
Operated by Google LLC, United States.
What Signing you in with a one-time code, delivering push notifications to your device, reporting crashes, and remote configuration of the app. Analytics only where you have consented under [Cookies and tracking](doc:cookies).
Sees Your email address or mobile number, a device token, the device model and operating system, crash diagnostics, and, with consent, which screens you use.
Where Google's infrastructure, which may be outside South Africa. Covered by Google's data processing terms.
MongoDB Atlas
Operated by MongoDB, Inc., United States.
What The database ToolBox runs on. Everything in section 3 of the Privacy policy is stored here, including verification evidence, which is encrypted before it is written.
Sees All personal information the app holds, in encrypted storage.
Where TO BE CONFIRMED — the cluster region. We will state the country here once confirmed.
SMSPortal
Operated by SMSPortal (Pty) Ltd, South Africa.
What Sending the one-time code that verifies your mobile number.
Sees Your mobile number and the code.
Where South Africa.
Resend
Operated by Resend, Inc., United States.
What Sending the emails we send you: sign-in codes, and the service messages the Privacy policy describes.
Sees Your email address and the content of the email.
Where United States.
Google Maps Platform
Operated by Google LLC, United States.
What Suggesting addresses as you type one, so you do not have to spell out a street. Requests go through our own server, so Google does not receive your account details, only the partial address you are typing.
Sees The address text you type, and an approximate location if you have allowed it.
Where Google's infrastructure.
Paystack
Operated by Paystack Payments South Africa (Pty) Ltd, a Stripe company.
What Processing card and bank payments: a homeowner paying a tradesperson through ToolBox, and a tradesperson paying for the ToolBox Pro subscription. Paystack holds the card details; we never see a card number.
Sees The payer's email address and name, the amount, and the card or bank account used to pay. For a tradesperson paid through ToolBox, the bank, account holder and account number their payments settle to.
Where TO BE CONFIRMED: South Africa, and possibly other countries as part of Stripe. We will state where it is processed here, and the safeguards for any transfer abroad, before billing starts. Paystack's own privacy policy applies to the card details it holds.
Google Play and the Apple App Store
Operated by Google LLC and Apple Inc.
What Distributing the app. They take no payments for ToolBox.
Sees Your store account, which is theirs.
Where Their infrastructure. Their own privacy policies apply to your store account.
Google Cloud Vision
Operated by Google LLC, United States.
What Checking photographs for explicit or violent content as they are uploaded, and reading any text in a photo sent in a message so contact details in it can be held back until a hire.
Sees The photograph, for the time it takes to check it. Not kept by Google and not used to train its models.
Where Google's servers in the European Union.
Google Gemini API
Operated by Google LLC, United States.
What Reading the text of a proof of address document, and checking message text for threats, harassment, hate and scams that our own word filter misses.
Sees The document, or the message with contact details already taken out and a few earlier messages from the thread for context. Not your name or account details. Not used to improve Google's products.
Where Google's infrastructure, which may be outside South Africa.
Speech-to-text
Operated by TO BE CONFIRMED.
What Turning a voice note into text.
Sees The voice note, for the time it takes to process it. Not used to train the provider's models.
Where TO BE CONFIRMED.
Server hosting
Operated by TO BE CONFIRMED.
What Running the ToolBox backend.
Sees Everything that passes through the app, in transit and in memory.
Where TO BE CONFIRMED.
3. The ones outside South Africa
Section 72 of POPIA permits personal information to leave South Africa only on defined grounds. For every provider above that is outside the country, we rely on a written agreement that binds the provider to conditions substantially similar to POPIA's, including the eight conditions for lawful processing and a prohibition on onward transfer without the same protection. Where a provider publishes standard data processing terms, those terms are the agreement; where it does not, we have a signed one.
You may ask us for the relevant terms at privacy@toolbox.africa.
4. Independent responsible parties
Some organisations receive your information and then decide for themselves what to do with it. They are not processing on our instructions, so they are not on the list above, and their own privacy notices govern what they do:
- The tradesperson you hire, for your name, number and address. See section 11 of the Terms for tradespeople.
- Registration bodies we confirm a tradesperson's number with: PIRB, SAQCC Gas, the ECB, PSIRA, the NHBRC and the CIDB.
- The SAPS, the Information Regulator, the National Consumer Commission and trade regulators, where we report a matter or answer a lawful request.
5. Changes
We add a provider here before it processes anything, and we give notice under section 17 of the Privacy policy where a new provider materially changes where your information goes. Removed providers are listed for 12 months afterwards with the date they stopped, so that the history is visible.