Last updated: 10 September 2026
Stallspace is a product of Flow4 (Pty) Ltd (“Flow4,” “we,” “us”). This policy explains what personal information we collect, why, who it goes to, how long we keep it, and what rights you have over it — in line with South Africa's Protection of Personal Information Act (POPIA). It goes with our Terms of Service, version 2026-09-10.
When you create an account: your name, surname, email address, WhatsApp number, the area you select, whether you registered as a buyer or a vendor, your confirmation that you meet the age requirement, and a password (stored securely — see clause 5).
When you use Stallspace: the bookings and orders you make or receive, including what was booked, for how much, when, and the delivery or visit address if you give one; the reviews you leave; the reports you file; and a profile photo if you upload one.
If you set up a stall: your stall name, description, category, area, operating hours, photos, your listings, and the payment details you choose to publish — which may include your bank name, account holder name, account number, branch code and account type. You decide whether to add these. They are shown to people you are transacting with so they can pay you; see clause 3.
Automatically: a security and moderation log of significant events — registrations, stall creation, bookings and orders, status changes, suspensions, reports, admin actions and changes to published banking details — together with your IP address when you register, verify your email or reset your password, which we use to limit abuse.
We do not collect card details and never process payments. Stallspace never handles money. See clause 6.
Our lawful basis is performing the agreement between us (POPIA s11(1)(b)), our legitimate interest in running a safe platform (s11(1)(f)), and your consent where you give it — for example when you allow location access. We use it only to show you stalls near you: it is rounded to about a kilometre, kept in a cookie on your own device for up to seven days, never saved to our database, and never sent to anyone else.
We do not collect more than we need for these purposes.
Reviews are public and show the reviewer's first name, or their full name if they choose. Anyone can read them.
Reports are not public. The person you report is not told who reported them. Admins at Flow4 can see the report, who filed it and what it says; we'll tell you when yours has been reviewed, but we can't tell you what happened to the other person's account.
Passwords are never stored in readable form — they are securely hashed by our authentication provider. Access to production data is limited to what's needed to operate Stallspace, and administrative access is granted manually outside the application and recorded in our log.
Our database enforces who can read what at the row level, not just in the app: your bookings, contact number and published banking details are only readable by the specific people entitled to see them. Connections are encrypted in transit.
No system is perfectly secure, and we are actively improving ours.
Stallspace does not process, store on your behalf, or have access to any payment. Payment for a booking or order happens directly between you and the other party, using whatever method they publish. We do not verify banking details, do not confirm that a payment was made, and are not responsible for these transactions.
The banking details a vendor publishes are theirs, entered by them and shown as entered. Only ever pay the account shown in the app — Stallspace will never ask you to pay a different one.
Where we are required by law to keep something longer, we will, and only for as long as required.
Our database, file storage and email provider are hosted outside South Africa, in the European Union and the United States. This means your personal information is transferred across borders.
POPIA section 72 permits this where the receiving country has comparable data protection law, or where our contract with the provider requires an equivalent standard. The EU's GDPR provides comparable protection, and our providers are bound by data processing agreements on standard contractual terms. By using Stallspace you acknowledge this transfer.
If we have reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we will notify you and South Africa's Information Regulator as soon as reasonably possible after discovering it, as POPIA section 22 requires. We'll tell you what we know, what we're doing about it, and what you can do to protect yourself.
Under POPIA, you have the right to:
To exercise any of these, email info@flow4.co.za from the address on your account. We'll respond within 30 days.
The Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg — complaints.IR@justice.gov.za
POPIA requires every organisation to have an Information Officer, registered with the Information Regulator, who is responsible for how we handle personal information.
Ours can be reached at info@flow4.co.za.
Write to them about anything in this policy: a request to see, correct or delete what we hold about you, a concern about how we've handled your information, or a complaint before you take it to the Regulator.
We use a small number of strictly necessary cookies to keep you signed in and to make password resets work. We store your light or dark mode preference in your own browser. We do not use advertising or analytics cookies and we do not track you across other websites.
We may update this policy as Stallspace grows. Material changes will be reflected here with an updated date, and we'll tell you in the app or by email where the change affects your rights.
Questions about this policy or your data: info@flow4.co.za
Flow4 (Pty) Ltd — info@flow4.co.za