Privacy Policy
1. Who we are
Malini lets your business accept instant payments over PayShap and keep a simple record of your sales. We are a South African company and we handle your information under the Protection of Personal Information Act (POPIA) and the Financial Intelligence Centre Act (FICA).
2. What we collect
Only what the service needs:
| Information | Why we need it |
|---|---|
| Business name and phone number | Your account and signing in |
| Your full legal name and SA ID number | The law (FICA) requires us to verify who you are before you can accept payments |
| Your ShapID / settlement details | So payments reach your bank account — money never passes through ours |
| Your sales records (amounts, dates, payment status) | Your dashboard, ledger and receipts |
| A push-notification token (if you allow notifications) | The “payment received” alert |
Your ID number is never stored in full. We keep only a masked version (like 800101•••••87) and a scrambled fingerprint (hash) used to prevent duplicate accounts.
We do not collect your location, your contacts, or anything else from your phone beyond the list above. Your customers are never registered with us at all — they pay through their own bank.
3. How we use it
- To provide the service: accepting payments, your dashboard, receipts.
- To meet legal duties: identity verification, record-keeping and reporting under FICA.
- To keep the platform safe: fraud and abuse prevention.
- Only with your explicit opt-in consent (a separate future choice, never automatic): sharing your sales history with a registered lender so you can apply for a cash advance. Saying no never affects your payment service.
We do not sell your information, and we do not use it for advertising.
4. Who we share it with
Only service providers needed to run the platform, under written agreements:
- Our payment service provider (to process PayShap payments and, with them, parts of identity verification);
- Our identity-verification provider (to verify your ID, as FICA requires);
- Our hosting provider (where the system runs — see section 7);
- A partner lender — only if you opt in to the advances product.
We share information with authorities when the law requires it (for example, reports under the Financial Intelligence Centre Act).
5. How long we keep it
FICA requires us to keep identity and transaction records for five years after your account closes — this is a legal duty that overrides deletion requests for those records. Anything not covered by that duty is deleted when it is no longer needed.
6. Your rights
You can ask us at sipho@malinipay.co.za to: see the information we hold about you; correct it; delete what the law does not require us to keep; or object to processing. We respond within a reasonable time and never charge for a first request.
If you are unhappy with our answer, you can complain to the Information Regulator of South Africa: inforeg.org.za · complaints.IR@inforeg.org.za.
7. Security and where your data lives
Passwords and credentials are stored hashed, never in plain text. ID numbers are masked and hashed as described above. Access is limited to people who need it.
Our servers are hosted with Google Cloud Platform, in the africa-south1 (Johannesburg) region. Where this involves processing outside South Africa, it happens under POPIA's cross-border rules (section 72), with providers bound to equivalent protection.
8. Changes
If this policy changes in a way that matters, we tell you in the app before the change takes effect. The current version always lives on this page.