Who we are
SK Exotics ("we", "us") is operated by Saijil Singh, trading as SK Exotics, a sole proprietor based in South Africa.
- Contact: info@sk-exotics.com
- Information Officer: Saijil Singh
- Information Officer contact: info@sk-exotics.com
- Address: 1183 Muirfield Drive, Eagle Canyon Golf Estate, Honeydew, Johannesburg, 2040, South Africa
This notice explains what personal information we collect, why, and what rights you have. It is written to meet our obligations under the Protection of Personal Information Act 4 of 2013 (POPIA).
What we collect
Information you give us
| What | Why we need it |
|---|---|
| Email address | To create your account, sign you in, and send account emails |
| Password | To secure your account. Stored only as a cryptographic hash — we cannot see it |
| First and last name (optional) | To address you properly in the app and in emails |
| Collection or business name (optional) | Shown in your own app |
| Phone number (optional) | Only if you give it |
| Country and region (optional) | To show dates, weights and currency in your local format |
| Keeper type (optional) | Hobbyist or breeder — shapes what the app shows you |
| Business name, registration number, VAT number, website (optional) | For keepers who run a registered breeding business |
Information you create by using the app
Records about your animals: names, sex, hatch dates, weights, genetics, photos, feeding records, cleaning records, health and behaviour events, breeding pairings and clutches, purchase and sale prices, expenses, the enclosure or rack each animal is kept in, and quarantine dates.
Some of this indirectly says something about you — your feeding records show when you were active, your expenses and sale prices say something about your finances. We treat all of it as your personal information.
Information collected automatically
| What | Why |
|---|---|
| Session token | Keeps you signed in. Strictly necessary for the service to work |
| Date you signed up, and the date and time you last signed in | Account security, and so we can see whether the service is being used |
| Technical logs | Our hosting, database and email providers keep standard security and error logs |
Advertising measurement — only if you allow it
We advertise SK Exotics on Facebook and Instagram. To see which of those ads actually bring keepers here, we use Meta's Pixel and its Conversions API. Both are switched off until you press "Allow" on the banner. If you decline it, or simply ignore it, no Meta script is loaded, no advertising cookie is written, and nothing whatsoever is sent to Meta.
If you do allow it, this is the complete list of what is shared:
| What goes to Meta | When |
|---|---|
| The address of the page you are looking at | Each page you open |
| That a signup form was completed | When you submit the signup form |
| That an account was activated | When you confirm your email address and sign in for the first time |
| A one-way hash of your email address — never the address itself | With the two events above only |
| Your IP address, your browser's user-agent string, and Meta's own advertising cookies | With each of the above |
Your email address is never sent to Meta in readable form. Our server converts it into a SHA-256 hash — a fingerprint that cannot be turned back into the address — and only the fingerprint is transmitted. That lets Meta recognise somebody it already knows without us handing over who you are.
Nothing about your animals is ever sent to Meta. Not your records, photographs, weights, feeding logs, pairings, genetics, prices or expenses. The events above carry a page address, a fingerprinted email and standard connection details, and nothing else.
Our lawful basis for this is your consent, and you may withdraw it at any time — it takes one click and stops all further sharing immediately:
The only other cookie-equivalent storage is the session token that keeps you signed in. That one is strictly necessary for the service to work and has nothing to do with advertising.
Payment information
We never see your card details. Payments are handled by Creem (see below), who act as the seller of record. We receive only the fact that a subscription is active, which plan it is, and when the paid period ends.
Why we process your information — and our lawful basis
| Purpose | Lawful basis under POPIA |
|---|---|
| Creating and securing your account | Necessary to perform our agreement with you |
| Storing and displaying your collection records | Necessary to perform our agreement with you |
| Sending account emails — confirmation, password reset, billing | Necessary to perform our agreement with you |
| Taking payment and maintaining your subscription | Necessary to perform our agreement with you |
| Keeping the service secure and preventing abuse | Our legitimate interest |
| Meeting legal obligations, including tax records | Compliance with law |
| Measuring which of our adverts bring keepers to the site | Your consent — and only if you give it |
We do not sell your personal information, and we do not share your collection records with anybody for their own purposes. The one exception to the rest is advertising measurement, described above: if — and only if — you allow it, Meta receives the events listed there. You can withdraw that at any time.
Who can see your information
Other users cannot see your collection
Each account's records are stored in its own database row protected by database-level access rules that check your account identity on every read and write. This is enforced by the database itself, not by the app running in your browser, so it cannot be bypassed by modifying the page.
We can see some of it
We operate an internal administration page. Through it, we can see, for every account: the email address, name, collection name and country given at signup, the subscription tier and status, the date of signup, the date of the last sign-in, whether the email was confirmed, and how many animals and pairings the account holds.
We cannot browse the contents of your records — individual animals, feeding logs, photographs, prices — through that page. Those remain protected by the same database rules that keep them from other users. We may write an internal note against an account, for example to record that a payment was received by bank transfer.
We may also need to look directly at stored data when investigating a fault you have reported to us, or where the law requires it.
Our service providers
These providers ("operators" under POPIA) process data on our instructions only:
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, authentication, file storage | West Europe (London), United Kingdom |
| Cloudflare Pages | Serves the website | Global content network |
| Resend | Sends account emails | European Union (eu-west-1) |
| Creem (Armitage Labs OÜ, Tallinn, Estonia) | Payment processing, as seller of record | Estonia / European Union |
| Meta Platforms Ireland Ltd | Advertising measurement — only with your consent | Ireland, and the United States |
Cross-border transfers
Your information may be stored or processed outside South Africa by the providers above. POPIA permits this where the recipient is subject to laws or binding agreements providing comparable protection. We rely on our providers' contractual data protection terms.
Payments
Subscriptions are sold and processed by Creem, who act as the merchant of record — meaning Creem, not us, is the seller for the transaction, and Creem is responsible for collecting and remitting any applicable sales tax or VAT.
When you subscribe:
- Your card details go to Creem and their payment partners. They never reach us and we never store them.
- Creem collects the billing information they need, which may include your name, email, billing address and country, under their own privacy policy.
- We receive back only your subscription tier, its status, and the date your paid period ends.
- Refunds are processed by Creem, not by us. See our Refund and Cancellation Policy.
Creem's privacy policy governs what they do with the information you give them at checkout: https://www.creem.io/privacy
Photographs
Photographs you upload are stored in a cloud storage bucket. Anyone who has the direct file link can view that file — the links are long and effectively impossible to guess, and they are not listed or published anywhere, but they are not individually access-controlled.
Please bear this in mind before uploading anything you would not want seen if the link were shared. Do not upload photographs of other people without their consent.
How long we keep it
- While your account is open: for as long as you keep using the service.
- When you delete your account: your collection records, uploaded photos and login are deleted through the in-app deletion tool.
- If we suspend your account: your records are retained, not deleted, and are restored if the account is reactivated. You may still ask us to delete them.
- Billing records: kept for as long as tax law requires us to keep them, which in South Africa is generally five years.
- Backups and provider logs: may persist for up to 90 days before being overwritten.
Your rights under POPIA
You have the right to:
- Access the personal information we hold about you
- Correct anything inaccurate
- Delete your information
- Object to processing based on legitimate interest
- Complain to the Information Regulator
In the app: Account → Export Data downloads everything we hold about you. Account → Delete account removes it permanently. You can edit any record directly at any time.
You may also contact us at info@sk-exotics.com. We will respond within 30 days. There is no charge.
Complaining to the regulator
The Information Regulator (South Africa) - Website: https://inforegulator.org.za - Complaints: complaints are lodged through the Regulator's eServices Portal at https://eservices.inforegulator.org.za — you register a profile first. General enquiries: enquiries@inforegulator.org.za, 010 023 5200
Security
- Passwords are hashed by our authentication provider; we never see them
- All traffic is encrypted in transit (HTTPS)
- Database access rules prevent any account reading another's data, enforced by the database rather than by the browser
- Only the account owner can write into their own photo storage folder
- Administrative actions on accounts are recorded in an audit log
No system is perfectly secure, and we cannot guarantee absolute security.
If there is a breach
If personal information is accessed by an unauthorised person, we will notify the Information Regulator through their eServices portal and notify affected users as soon as reasonably possible, as POPIA requires.
Children
This service is not intended for anyone under 18. We do not knowingly collect information from children. If you believe a child has created an account, contact us at info@sk-exotics.com and we will delete it.
Changes
If we change this notice materially we will notify you by email or by a notice in the app before the change takes effect. The "last updated" date above always reflects the current version.
Contact
Questions about this notice or your information: info@sk-exotics.com