Privacy Policy
Effective 4 November 2026. This policy explains how we handle personal information under the Protection of Personal Information Act, 2013 (POPIA).
1. Who is responsible for your information
The responsible party is Crypto Guru, which operates www.cryptoguru.co.za. You can reach our Information Officer at [email protected] about anything in this policy.
2. What we collect
You can read the news without giving us any personal information. We collect information only as described below.
| Information | When | Why |
|---|---|---|
| Your email address | When you sign in or create an account | To send your sign-in links, identify your account and contact you about your subscription |
| Subscription details: plan, price, status, dates, PayFast subscription and payment references | When you subscribe, renew or cancel | To give you access, manage renewals and cancellations, and process refunds |
| Payment notifications from PayFast, which can include the name and email you entered at PayFast and the amounts paid | Each time PayFast confirms a payment, failure or cancellation | To confirm payments, prevent fraud, handle disputes and keep financial records |
| Technical information: IP address, browser type, pages requested, date and time | Whenever you visit | To deliver the website, keep it secure, prevent abuse and fix problems |
| Messages you send us | When you email us | To reply and resolve your query |
Giving us your email address is voluntary, but we can't create an account, sign you in or provide a subscription without it. Payment details are needed only if you subscribe.
We never receive or store your card or bank details. You enter them on PayFast's secure payment page, and PayFast handles them under its own privacy policy.
3. Our legal grounds
Under section 11 of POPIA, we process your information because it is needed to provide the service you asked for (your account and subscription), to comply with the law (for example tax record-keeping), or for our legitimate interests in running a secure, working website. We don't send marketing emails unless you have opted in, and you can opt out at any time.
4. Cookies and browser storage
- Sign-in cookie: one strictly necessary cookie (
__Host-cg_session) keeps you signed in for up to 30 days. Without it, sign-in can't work. - Preferences: your browser stores your chosen news filter and price currency (rand or dollar) on your own device. This never reaches us.
- We don't use advertising or analytics cookies. If we add advertising in future, we will update this policy and ask for your consent where the law requires it.
5. Who we share information with
We don't sell your personal information. We share it only with service providers ("operators") who process it for us under written terms that require them to keep it secure and confidential, as section 21 of POPIA requires:
- Cloudflare: website hosting, security, and the database that stores accounts and subscriptions.
- Resend: sends our sign-in emails.
- PayFast: processes payments and subscriptions.
We may also disclose information where the law requires it, for example to SARS or under a court order.
Services your browser connects to directly. To show live prices, fonts and market data, pages on our website make your browser connect to Google Fonts, CoinGecko and open.er-api.com (prices and exchange rates) and, in Whale Watch, Binance's public market data feed. These services receive your IP address and browser details in the normal way when your browser connects to them. We don't send them any account information.
6. Information sent outside South Africa
Cloudflare and Resend process information on servers outside South Africa, including in the United States, and the services in section 5 that your browser connects to directly are also based outside South Africa. Under section 72 of POPIA, we only transfer personal information to operators that are bound by data-protection terms or laws giving protection substantially similar to POPIA.
7. How long we keep it
- Account details: while your account exists. You can ask us to delete your account at any time.
- Payment and subscription records: 5 years after the transaction, as the Tax Administration Act requires, even if you delete your account.
- Sign-in links: deleted within a day. Sign-in sessions expire after 30 days or when you sign out.
- Technical logs: kept for a short period by our hosting provider for security and troubleshooting.
8. How we protect it
- All connections to our website are encrypted (HTTPS).
- We don't use passwords. Sign-in links work once and expire after 15 minutes, and we store only scrambled (hashed) versions of sign-in links and session cookies.
- Card details never pass through our systems.
- Access to our systems is limited to people who need it to run the service.
If we become aware of a security compromise affecting your information, we will notify you and the Information Regulator as section 22 of POPIA requires.
9. Your rights
Under POPIA you have the right to:
- ask whether we hold information about you and get a copy of it (section 23);
- ask us to correct or delete information that is inaccurate, out of date, incomplete or that we're no longer allowed to keep (section 24);
- object to processing based on our legitimate interests (section 11(3));
- refuse or opt out of marketing at any time (section 69);
- complain to the Information Regulator (section 74).
To use these rights, email [email protected] from the email address on your account. We will respond within a reasonable time and won't charge you for a reasonable request.
We don't make decisions about you based solely on automated processing (section 71).
10. Complaints to the Information Regulator
If you're unhappy with how we handle your information, please contact us first so we can try to fix it. You can also complain to the Information Regulator (South Africa) through its website, inforegulator.org.za.
11. Children
Crypto Guru accounts and subscriptions are for people aged 18 and older. We don't knowingly collect personal information from children. If you believe a child has given us their information, contact us and we will delete it.
12. Changes to this policy
We will update this policy when our practices change. The effective date at the top shows the current version. If we make a significant change, we will email account holders before it takes effect.