Privacy Notice

1. Who we are

Bahayas is an education and development platform operated by Yamkela Mbuthuma ("Bahayas", "we", "us"). Yamkela Mbuthuma is the data controller responsible for the personal information described in this notice and decides how and why it is processed. Questions about privacy can be sent through our contact page.

2. Personal information we collect

• Account data — name, email address and login credentials (passwords are stored hashed) or the basic profile returned when you sign in with Google.
• Membership data — subscription status, plan, renewal date and payment history records returned to us by our payment provider. We never receive or store your full card details.
• Learning activity — programmes you open, progress, saved items and community enquiries you submit.
• Support and enquiry messages — the content of messages you send us.
• Technical data — IP address, device and browser information, and basic usage telemetry and error logs generated when you use the platform.

3. Why we use it and our legal basis

• Providing the platform — creating your account, authenticating you, delivering member programmes and resources. Legal basis: performance of our contract with you.
• Membership administration — activating, renewing, pausing or ending access, and responding to billing questions. Legal basis: performance of our contract.
• Security and fraud prevention — protecting accounts, preventing abuse of member content. Legal basis: legitimate interests.
• Support and communication — answering enquiries and sending service messages. Legal basis: contract and legitimate interests.
• Improving the product — understanding which content is useful. Legal basis: legitimate interests.
• Marketing emails — only where you have opted in. Legal basis: consent, which you can withdraw at any time.
• Legal and accounting obligations — keeping records we are required to keep. Legal basis: legal obligation.

4. Who we share it with

• Merchant of Record — Paddle.com. Paddle acts as the reseller and Merchant of Record for all orders and receives the information needed for the sale of our membership, subscription management, payments, invoicing, tax compliance, refunds and related customer service.
• Service providers and subprocessors — hosting, database, authentication, email delivery and error-monitoring providers who process data on our instructions only.
• Professional advisers — legal and accounting advisers where necessary.
• Authorities — where we are required to disclose information by law.

We do not sell your personal information.

5. International transfers

Some of our providers process data outside South Africa, including in the European Union, the United Kingdom and the United States. Where information is transferred across borders we rely on appropriate safeguards such as standard contractual clauses or an equivalent lawful transfer mechanism.

6. How long we keep it

Account and membership data is kept for as long as your account is active and for up to 24 months after it is closed, so that we can handle disputes and reinstatement requests. Payment and tax records are kept for the period required by law (generally five years). Enquiry messages are kept for up to 24 months. When information is no longer needed it is deleted or anonymised.

7. Your rights

Subject to applicable law you may request access to your personal information, correction of inaccurate information, deletion, restriction of processing, portability of data you provided to us, and you may object to processing based on legitimate interests or withdraw consent to marketing at any time. You may also lodge a complaint with the Information Regulator of South Africa or, if you are in the UK or EEA, your local supervisory authority. We respond to requests within one month.

8. Security

We use appropriate technical and organisational measures to protect your information, including encrypted connections, hashed credentials, row-level access controls on our database, private storage for member files delivered through short-lived signed links, and restricted administrative access.

9. Cookies and similar technologies

We use essential cookies and local storage to keep you signed in, remember saved items and secure the platform; these are required for the service to work. Any analytics or marketing cookies are only used where you have agreed to them, and you can clear or block cookies in your browser settings at any time.

10. Changes to this notice

We may update this notice as the platform develops. Material changes will be communicated on this page with a new "last updated" date.