Privacy Policy

Who is responsible

RHOYI LOGISTICS (Pty) Ltd (registration number 2022/624245/07), 55 Boeing Drive, Helderkruin, Roodepoort, Gauteng, 1724, South Africa, is the responsible party for your personal information. You can reach our Information Officer at hello@moji.africa.

What we collect

• Account: name, email address, mobile number if you add one, password (stored hashed), country, and profile details you add.
• Purchases: orders, delivery address and phone for physical items, the last 4 digits of voucher PINs (never the full PIN), moji credit.
• Sellers: identity details and documents for verification (KYC), payout details, earnings and withdrawals.
• Content and activity: posts, comments, likes, follows, votes, competition entries, game scores, watch time, and reports you make.
• Recordings: videos, photos and sounds you record in moji. We use your camera and microphone only while you're recording, with your device's permission.
• Messages: chats are end-to-end encrypted, so we store your messages, photos, videos, voice notes and files only in encrypted form and can't read them. To deliver them we process who you message and when, group names, photos, descriptions and members, delivery and read status, and your chats' public encryption keys. We also store an encrypted backup of your chat keys that only your recovery code can open.
• Notifications: if you turn them on, the push address of your browser or phone. Notifications say who wrote, never what they wrote.
• Device and usage: IP address, device and browser type, pages viewed and approximate location (country) to show prices and content for your country.

Why we use it

To run your account and deliver what you buy (contract); to pay sellers and meet tax, anti-fraud and FICA duties (legal obligation); to keep moji safe, rank the feed and improve the service (legitimate interest); and to send marketing emails only if you opt in (consent). You can opt out of marketing at any time in Account → Email or with the link in every email.

Who we share it with

We don't sell your personal information. We share it only with service providers who process it for us under contract:

• Supabase (database and file storage), Vercel (hosting), Resend (email), Sentry (error monitoring, without personal data);
• Reload (voucher payments), Airalo (eSIMs), couriers (deliveries);
• Google, Apple, Mozilla or Microsoft, only to deliver notifications to your device (they see that a notification was sent, not your messages);
• moji's moderators see messages only when someone in the chat reports them;
• professional advisers and authorities where the law requires.

Our database and files are hosted in the European Union (Ireland), and some other providers also store data outside South Africa. We only use providers bound by data protection laws or agreements that give protection similar to POPIA (section 72).

What other people can see

Your public profile, posts, comments, competition wins and XP rank are public. Your orders, credit, contact details and identity documents are private. In chats, the people you message can see when you were last online and whether you've read their messages, unless you turn this off in Account → Privacy.

How long we keep it

While your account is open, and afterwards only as long as needed: financial and transaction records for at least 5 years (tax and FICA), seller verification records for 5 years after the relationship ends, and backups for up to 30 days.

Encrypted messages stay on our servers so you and the people you message can read them on any device, until they're deleted for everyone. When you delete your account, we delete your chat keys, key backup and notification addresses and remove you from your groups. Messages you already sent stay with the people you sent them to, as in any messaging app.

Your rights

You can access, correct or delete your personal information, object to processing, and withdraw consent. Download your data or delete your account in Account → Your data, or email hello@moji.africa. If you're unhappy with how we handle your information, you can complain to the Information Regulator (inforegulator.org.za).

Children

moji is not intended for children under 13. Users aged 13–17 need a parent's or guardian's permission, and can't enter paid competitions, sell or withdraw money.

Cookies

moji uses only essential and functional cookies: to keep you signed in, remember your cart, country and theme, and count video views once per device. We don't use advertising or third-party tracking cookies. moji also keeps your chat keys and messages in your browser's storage so chats open quickly and stay private; signing out deletes them from that device.

Security

Data is encrypted in transit, chats are end-to-end encrypted, sensitive secrets are encrypted at rest, access is limited to staff who need it, and payments use one-time voucher PINs. If a breach affects you, we'll tell you and the Information Regulator as POPIA requires.