Privacy Policy

The responsible party for personal information processed by this site is Just Like That Productions (Pty) Ltd, trading as JLT IT. Information Officer: Dietmar Gerber. Contact: corrections@scamsa.org.

Newsletter email address — to send the confirmation email and, once you confirm, the monthly award email.

Flag-a-case submissions — the person's name, the party, your description, the source link and optional contact details, so an editor can check the tip and, if needed, ask you a question.

Right-of-reply responses — your name, organisation, role, contact email, response text and optional link, so an editor can verify that you are entitled to respond before publishing the response next to the case. The email is never published.

Hashed IP address — a one-way hashed value derived from your IP address, used only to limit how many submissions one connection can send per hour. We do not store your raw IP address, and the hash cannot be reversed into one.

Published case data — the dashboard records information about public figures in their public capacity (names, roles, the nature of a reported allegation, its procedural status and its source), processed in the public interest for journalism and civic accountability.

We do not run advertising trackers or third-party analytics profiling.

Anonymous usage statistics — we use PostHog (EU region) to count page views and a few actions, such as a donation being started or a tip being sent. These statistics are anonymous and cookie-free: nothing is stored on your device, there is no session recording, IP addresses are not stored, and no form contents, names or email addresses are sent. Addresses are recorded without query strings. The admin area is never measured.

Donations — card and online donations are processed by PayFast on PayFast's own payment page. We never see or store card details, names or email addresses; we receive only the amount, date, payment status and a payment reference. EFT donations go directly from your bank to ours; we see only what appears on the bank statement.

Acknowledgement emails — if you give an email address with a tip or a right-of-reply response, we use it to send one acknowledgement with a reference code. The email does not repeat what you submitted.

We do not use email open or click tracking. Links in our emails go directly to scamsa.org.

The site processes information about alleged criminal behaviour of public figures, in their public capacity, solely for journalistic purposes. We rely on the journalism exclusion in section 7 of POPIA and follow the Press Code of South Africa, including offering a right of reply to anyone named before or alongside publication.

AI tools help draft case summaries and analyse news articles that an editor pastes in. When it is switched on, an automated weekly news search files headlines into a private review queue. A monthly verification check lists every case and checks that its source links still work. None of these can publish or change anything: an editor checks and approves every item against its source first.

We log technical errors so we can keep the site working. These logs contain no names, email addresses, IP addresses or form contents, can only be seen by the site editor, and are deleted automatically after 90 days. We do not use advertising trackers, analytics cookies or session recording.

We also use Sentry (EU region, Germany) for error reports only. Reports contain the error message, the page path and basic browser details, with emails, tokens and query strings removed. No names, IP addresses, cookies, form contents or other personal details are collected, and there is no session recording.

Every submission goes into a private review queue that only the site administrator can read. Nothing is published automatically. If a submission checks out against its source, the resulting case entry reflects the underlying public source — not you as the submitter. Contact details are never published, never included in the open data export and never attached to a case entry.

Contact details on submissions and responses are removed as soon as the item has been reviewed (approved, rejected or deleted); a nightly clean-up also clears any remaining contact details on items reviewed more than 30 days ago. Unconfirmed newsletter sign-ups are deleted after 30 days. Confirmed newsletter addresses are kept until you unsubscribe, using the link in every email. The hashed IP value is kept with a submission record only to enforce the hourly limit. Administrative activity is recorded in an internal log, which never stores credential values.

We never sell your personal information or share it for marketing. It is shared only with these service providers (operators), each of which receives only what it needs:

• Lovable Cloud / Supabase — hosting and the database that stores submissions, newsletter addresses and donation records.
• Resend — delivers the newsletter confirmation, monthly award and acknowledgement emails. It receives your email address and the email content. Its servers are in the European Union, so this is an international transfer of personal information.
• Cloudflare — DNS, network security, the optional anti-spam check, and forwarding mail sent to @scamsa.org addresses to the operator's mailbox.
• PostHog — anonymous, cookie-free usage statistics, stored in the EU. No session recording, no cookies, and IP addresses are not stored.
• Sentry — error reports only, stored in the EU (Germany). No personal details are sent.
• PayFast — payment processing on PayFast's own page. We receive only the amount, date, status and a reference — never card details, names or email addresses.

You may ask what personal information of yours we hold, ask us to correct it, or ask us to delete information you submitted. Public figures and parties may also dispute the accuracy of a case entry — see the corrections page, which also covers the right of reply we publish alongside a case.

Requests go to corrections@scamsa.org. We aim to respond within 30 days. If you are unsatisfied with our handling of a request, you may lodge a complaint with the Information Regulator of South Africa (inforegulator.org.za).

Submissions are stored in a managed cloud database, with access restricted to the site's authorised administrator. Text and links are checked and cleaned before being stored and before being displayed. Our hosting provider and our email delivery provider (Resend, in the European Union) process data outside South Africa. We take reasonable measures to ensure any such processing meets an adequate level of protection consistent with POPIA.

The site also relies on a small number of external services — an optional anti-spam check, an optional news search service, and the social platforms the monthly award is posted to. Each receives only what it needs to perform its function, and none of your submission's contact details are shared with them.

The site is not directed at children, and we do not knowingly collect personal information from anyone under the age of 18. If you believe a person under 18 has submitted information to us, contact us at corrections@scamsa.org and we will delete it.

This policy will be updated as the project develops or as legal review requires. Material changes will be reflected here.