Privacy policy

1Information we collect

Account information

• Name, email address and password (stored as a secure hash)
• For providers: business name, description, contact details and address

Booking and loyalty information

• Bookings you make or receive: service, date, time, amount, notes you add, and the staff member the booking is with
• Loyalty points, rewards and voucher usage

Billing information

• Subscription plan, invoices and payment references. Payments are processed by Paystack. We never see or store your full card number, only a payment reference and the card's last four digits.

Technical information

• Log data needed to run and secure the service (such as IP address, browser type and timestamps), and cookies required for sign-in and session management. We do not use third-party advertising cookies.

2How we use your information

• To operate bookings, loyalty programmes and vouchers
• To send transactional email (confirmation links, booking confirmations, payment receipts, team invitations)
• To bill provider subscriptions and prevent fraud
• To provide support and improve the service
• To meet legal obligations

We do not sell personal information, and we do not use it for third-party advertising.

3Sharing between customers and providers

When you book with a provider, that provider can see your name, your contact details and your booking and loyalty history with them. This is necessary for them to deliver the service. Providers may only use this information to manage their relationship with you.

4Service providers we rely on

• Supabase: database, authentication and hosting of application data
• Paystack: payment processing
• Resend: transactional email delivery
• Vercel: application hosting

These operators process personal information on our instructions under their own security and confidentiality obligations. Some operate outside South Africa; where information is transferred across borders we rely on the safeguards in section 72 of POPIA.

5How long we keep information

We keep your information while your account is active. If you close your account we delete or de-identify personal information within a reasonable period, except records we must keep for legal, tax or fraud-prevention purposes (such as invoices).

6Security

We protect personal information with appropriate technical and organisational measures, including encryption in transit, hashed passwords, row-level access controls in our database, and restricted administrative access. No system is perfectly secure; if a breach affecting your information occurs we will notify you and the Information Regulator as required by POPIA.

7Your rights

Under POPIA you may:

• ask what personal information we hold about you;
• ask us to correct or delete it;
• object to processing, or withdraw consent where relied on;
• complain to the Information Regulator (South Africa) at inforegulator.org.za.

To exercise any of these rights, email support@nelo.co.za. We respond within a reasonable time and at most within the periods POPIA prescribes.

8Children

The service is not directed at children. We do not knowingly process a child's personal information without the consent of a competent person.

9Changes to this policy

We may update this policy as the service evolves. Material changes will be announced in the app or by email before they take effect. The “Last updated” date above shows the current version.

See also our Terms of Service.