Privacy Policy

Talent Bridge is the responsible party for the personal information described here — POPIA's term for the organisation that decides why and how your information is processed.

Before going live: POPIA requires a named Information Officer who is registered with the Information Regulator. By default this is the head of the organisation until someone else is formally designated. Appoint and register a real person, put their name here, and make sure the address above reaches them. An unnamed Information Officer is a compliance failure, not a formality.

• Account details — your name, email address, and the city and province you work in.
• Profile content — your headline, bio, skills, rate, portfolio pieces, avatar or company logo. All of this is public by design; that is the point of a marketplace profile.
• Work records — job posts, proposals, contracts, deliveries, reviews and the messages between you and the people you work with.
• Payment information — for freelancers, the bank account details needed to pay you. Card details are never seen by us: the client is redirected to our payment provider, who handles the card and tells us only whether it worked.
• Identity documents — only if you choose to get verified. See section 5.
• Technical data — your session cookie, and the ordinary server logs a web application produces. We do not run advertising or analytics trackers.

POPIA requires a lawful justification for each purpose. Ours are:

• Performance of a contract — running your account, showing your profile, delivering messages, holding and releasing money. We cannot operate a marketplace without this and it is not optional.
• Legal obligation — keeping financial records, and responding to a lawful request from a court or regulator.
• Legitimate interest — fraud prevention, moderation, and keeping the platform safe. This includes automatically flagging content that appears to solicit payment outside the platform.
• Consent — identity verification, and any non-essential cookie. You can withdraw either at any time.

• The public — your profile, portfolio, published reviews and any job you post. Not your email address, your bank details, your messages or your identity document.
• The person you are working with — your messages, files and contract details on that contract only.
• Our staff — only what a task requires. An administrator can read the messages on a contract only while it is in dispute, or a specific message that has been reported. That access is enforced by the database, not by policy, and it ends when the dispute is resolved.
• Our processors — Supabase (hosting and database), Paystack (payments), Resend (transactional email) and Netlify (application hosting). Each processes only what it needs.

We do not sell your personal information. We do not share it for anyone else's marketing.

Verification is optional. If you choose it, your document is stored in private storage that no other user can reach at all. A reviewer sees it through a link that expires after five minutes, and we record only the decision, the reviewer and the reason — never the identity number itself.

You can delete your document at any time from Privacy & data. Deleting it does not remove a verification already granted, but you can ask us to withdraw that too.

Our database and file storage are hosted by Supabase, and the application by Netlify. Depending on the region a service is provisioned in, your information may be processed outside South Africa.

POPIA section 72 permits this where the recipient is subject to laws or binding agreements providing an adequate level of protection. Our processors are contractually bound to protect your information and to process it only on our instructions.

Before going live: confirm which region each service is actually provisioned in and state it here. “May be processed outside South Africa” is honest but vague; a data subject is entitled to a straight answer.

• Your account — until you delete it.
• Financial records — retained after account deletion where South African tax and companies legislation requires it. These records are kept for compliance, not for marketing, and are not linked back to a deleted profile.
• Identity documents — deleted when you delete them, or when you close your account.
• Moderation records — a record that an account was suspended, and why, is retained so that a suspended person cannot simply start again.

Under POPIA you may:

• ask what we hold about you, and get a copy;
• correct anything wrong — most of it you can edit yourself;
• delete your account and personal information, from Privacy & data;
• object to processing based on legitimate interest;
• withdraw consent you have given;
• complain to the Information Regulator if you think we have got it wrong.

Deleting your account removes your profile, your portfolio, your messages, your identity document and your bank details. It cascades through the database — there is no hidden copy of your profile left behind.

Two things survive, and it would be misleading not to say so. Financial records of completed contracts are retained where the law requires. Reviews you wrote about other people remain on their profiles, anonymised — otherwise anyone could erase criticism of themselves by deleting the account that wrote it.

You cannot delete an account with money in escrow. Settle or dispute those contracts first.

Access is enforced in the database itself through row-level security, not only in the application. Bank details are not readable through our API by any user at all, including you — you see the last four digits and nothing more. Identity documents and message attachments live in private storage reachable only through short-lived signed links.

If we suffer a breach affecting your personal information, POPIA section 22 requires us to notify you and the Information Regulator, and we will.

Privacy questions go to the Information Officer at privacy@talentbridge.co.za, or through our contact page.