Privacy Policy

Effective 29 October 2026

This policy covers two groups. Business owners (people who sign up for NgeNkani): NgeNkani decides why and how your information is used, so NgeNkani is the "responsible party" under the Protection of Personal Information Act (POPIA). Customers of a business that uses NgeNkani: the business decides why and how your information is used, and NgeNkani handles it on the business's behalf as its "operator".

1. Who is responsible

Catalyze Now PTY (LTD), Johannesburg, Gauteng, South Africa. Phone: +27 69 851 8810. Email: support@catalyzenow.co.

2. What we collect

From business owners

• Name, email and password (the password is stored only as a hash, by our sign-in provider).
• Business details: name, location, description, logo and images, contact details, theme choices, what you sell, prices.
• Your plan and billing status, and the Paystack customer and subscription codes needed to manage your subscription. We never see or store your card number.
• Your payment settings: bank account holder, bank, account number, account type and branch code if you add them for bank transfers, and your choice to show them or not.
• Your actions that matter for trust: when you confirm or cancel an order's payment, and when you change payment settings (not the account number itself).

From a business's customers, through its storefront

• Name, email and phone number given when ordering, requesting or booking; what was ordered; the amount; the payment method chosen; the order reference; status and dates.
• If the customer chooses bank transfer: whether they pressed "I have made the payment". NgeNkani does not collect proof of payment: the customer may choose to open WhatsApp from the order page and send proof straight to the seller. The prefilled WhatsApp message contains only the business name, the order reference and the amount. NgeNkani does not see, receive or verify anything sent on WhatsApp, and does not know whether the customer sent it.
• Emails we send about the order.

Automatically

• Strictly necessary cookies and storage, only what is needed to keep you signed in and protect the service. No advertising or analytics cookies.
• Technical logs (time, address, errors) kept by our hosting and database providers.

3. Why we use it, and the basis

• Run your account, storefront, subscription and emails about them (owners): needed to perform our contract with you (POPIA s11(1)(b)).
• Process an order, booking or request for a business (customers): the business's lawful basis; we act on its instructions as operator.
• Show a seller their customer's bank-transfer claim, and keep a record of who confirmed payment (customers and owners): performance of the sale and the seller's and our legitimate interest in an accurate record (s11(1)(b), (f)).
• Keep the service secure, prevent abuse, fix faults (both): legitimate interest (s11(1)(f)).
• Keep records the law requires (both): legal obligation (s11(1)(c)).

We do not sell personal information and do not use it for advertising.

4. Who else handles it

• Our database, sign-in and file-storage provider.
• Our website hosting provider.
• Our email delivery provider, which sends emails to owners and customers.
• Paystack: subscription card payments only (owners paying NgeNkani).

Some of these providers store or process information outside South Africa. For example, our database is hosted in Ireland and our website hosting runs in the United States.

A business sees the information of its own customers. It does not see another business's.

5. How long we keep it

Information is kept no longer than needed for the purpose, unless a law requires longer, the responsible party reasonably needs it, a contract requires it, or the person agrees (POPIA s14).

• Owner account and business information: while the account exists. A paused account is kept while paused, with a reminder at 90 days, and nothing is deleted automatically.
• Orders, customers and payment records: kept while the business's account exists, and for any period the law requires after.
• Payment audit log: kept with the order it belongs to. NgeNkani holds no proof-of-payment files.
• After deletion is agreed: removed, or made so that it no longer identifies anyone, as soon as reasonably practicable, except what must be kept by law (we tell you which).

6. Your rights

You may ask us to tell you what we hold about you, correct it, delete it, or stop using it for a purpose, and you may complain to the Information Regulator. Email support@catalyzenow.co and we will respond as soon as reasonably possible. If you are a customer of a business, ask that business first, because it decides what it collects; we will help it respond.

7. Security

We use encrypted connections, access controls so a business can see only its own data, signed requests for scheduled work, private storage for uploaded files, and security headers on every page. No system is perfectly secure. If we have reasonable grounds to believe someone unauthorised accessed personal information, we tell the Information Regulator and the people affected as the law requires. We have not had an independent security test. We say so because it is true.

8. Cookies

Only what is strictly needed to keep you signed in and protect the service.

9. Changes

If we change this policy in a way that matters, we will tell you by email before it applies.