Privacy Policy

Last updated: 30 September 2026

1. About this policy and how to contact us

This policy covers the SheMovesIt website at www.shemovesit.co.za and the SheMovesIt moving and delivery app. It explains the personal information used by these services and your rights under South Africa's Protection of Personal Information Act 4 of 2013 (POPIA).

For privacy questions or requests for access, correction or deletion, contact admin@shemovesit.co.za. Please use “Privacy request” in the subject and explain what you need. Do not send your password or unnecessary identity documents.

2. Information used by the app

• Account information: Google sign-in, or Apple sign-in on iPhone, provides authentication information to Firebase Authentication. Your account identifier, name, email address and available profile photo URL support your account. Your name and email can prefill contact details, and your name and available photo can appear in trip chat. An Apple private-relay address is not used to prefill the trip contact email.
• Contact and move details: your name, telephone number, email address, service and vehicle selection, pickup and delivery addresses and additional stops, map place identifiers and coordinates, pickup date and time, helpers, floors, vehicle-body preference, items to move, box quantities, dimensions, weight and notes. Your latest submitted contact details are saved for later enquiries.
• Trip and quotation records: enquiry references, account links, route-distance and estimate information, trip status, quotation files and your responses, staff decisions and reasons, schedule changes and timestamps. Earlier versions of edited trip details remain in the trip's change history.
• Messages and attachments: trip-chat text, selected images and documents, filenames, file types and sizes, file integrity identifiers, sender identifiers, roles, names, available profile photo URLs and timestamps. Chat entry and message-read information are also recorded. Files may contain personal information or embedded metadata. Staff can save an intended email recipient for an attachment as a draft; this feature does not itself send an email.
• Location and map requests: address searches, selected places, route stops and, if you allow device location, a foreground location fix used to suggest a pickup address. These requests pass through our backend to Google mapping services.
• Notifications and technical information: push-registration tokens linked to your account, registration timestamps, customer push preferences, trip activity and read records, and account-linked request counters used to limit misuse. Firebase Cloud Messaging also uses installation identifiers. Service providers process technical information needed to operate their services, such as IP addresses, device and application information, authentication records and service logs.

This information comes from you, your selected sign-in provider, your device, Google map results and the SheMovesIt team when handling your enquiry. If you provide another person's information in an address, note, message or file, only share information you are entitled to provide and make this policy available to them.

3. Why information is used

Account and enquiry information is used to identify you, respond to your request, prepare and review quotations, arrange and administer moves or deliveries, show trip history and communicate about your trip. Location and route information supports address selection and trip planning. Technical records support authentication, access control, service delivery and misuse prevention.

Staff review enquiries and make final trip decisions. The app calculates route and estimate information and records quotation responses; submitting an enquiry or accepting a quotation does not automatically confirm a trip.

This policy explains processing and is not blanket consent to unrelated uses of your information. Where processing relies on consent, you may withdraw it without undoing processing that was lawful before withdrawal. Contact us if you need more information about the purpose or legal basis for a particular use of your information.

4. Required information and optional choices

A signed-in account and the required contact, address, schedule and move-detail fields are needed to submit and manage an enquiry in the app. An incomplete enquiry cannot be submitted. These are requirements for using the service, not a statement that POPIA requires you to provide them.

Device location is optional. You can decline access and search for an address manually. When you enter the location step, the app can request a foreground location fix to suggest a pickup address. It does not continuously track your location or track it in the background. Manually selected addresses still go to Google mapping services and are stored with your submitted trip.

You choose whether to share images or documents through photo or file selection. The app does not upload your whole photo library. Avoid sharing identity documents, health information, children's information or other sensitive content unless it is necessary and a lawful arrangement has been made with SheMovesIt.

Location, photo access and notification permissions can be managed in your device settings. Customers can also switch individual push categories on or off in the app's notification settings. Turning off push does not delete inbox updates or trip messages; open the app to check them. Administrators do not have the same in-app push-category switches.

5. Access and service providers

Authorised SheMovesIt administrators can access enquiries, trip messages, files and activity to handle the service. Customers can access their own trips and conversations. The app and website use the following providers:

• Google Firebase and Google Cloud: authentication, the Firestore database, backend functions, attachment storage, operational services and Firebase Cloud Messaging for push delivery. Firebase Hosting serves the website. See Firebase's privacy and security information for provider processing and retention information.
• Google Maps Platform: map display, address suggestions, place resolution, reverse geocoding and driving-route calculation. Google receives relevant search text, place identifiers or coordinates, including when an address is entered manually.
• Google or Apple sign-in: the selected provider authenticates you. Apple Push Notification service is also involved in delivering notifications to Apple devices.
• Apps and destinations you choose: opening a downloaded document in another viewer or saving it to a device or file destination allows that app or destination to handle the copy under its own arrangements.

Email sent to SheMovesIt is handled separately from app enquiries and passes through email services. Contact us if you need details of the recipients involved in a particular enquiry, move or privacy request.

6. Where information is processed

The app is configured to use the Johannesburg region, africa-south1, for its database and backend functions. This does not mean all information stays in South Africa. Authentication, mapping, push delivery, website delivery and other provider operations may involve processing in other countries.

International transfers are subject to POPIA's requirements, including section 72. Contact us for information about the locations and transfer arrangements relevant to your information. This policy does not guarantee that every provider stores or processes information only in South Africa.

7. Retention, cancellation and account deletion

Trip and account records are not automatically erased when a trip is completed, you sign out or you uninstall the app. The app does not apply a general scheduled age-based deletion of enquiry, chat or attachment records. You can contact us about information that is no longer needed or to make a deletion request. POPIA limits how long personal information may be retained; retention and deletion requests depend on the purpose and any applicable legal requirements.

Where cancellation is available in the app, cancelling a trip deletes its enquiry, change history, chat and server-stored attachments. Separate activity records can remain, including a cancellation alert containing contact details for staff follow-up. Cancelling one trip is not the same as deleting an account.

To delete your account, use Settings → Privacy → Delete account and verify your sign-in again. On successful completion, the deletion service removes your authentication account, profile and saved contact details, owned enquiries and associated chats, change history and attachments, owned quote and trip-event records, registered-device records and the account-linked request-counter records it manages.

This process cannot recall files already downloaded, documents opened in another app, delivered notifications or separate email correspondence. It does not provide a purge of every local cache or copies in provider logs or backups. Provider retention and deletion processes are separate. Contact us if you cannot use account deletion or want to ask about information outside its scope.

8. Security

The app uses authenticated backend requests, access checks for trip ownership and administrator actions, recent sign-in verification for account deletion and server-side validation. Attachments are retrieved through access-checked backend functions. These measures reduce risk but cannot guarantee absolute security. Trip chat is not represented as end-to-end encrypted.

POPIA requires appropriate safeguards. Where section 22 applies, it requires notification of the Information Regulator and affected people as soon as reasonably possible after discovering a security compromise, subject to the Act's exceptions and permitted delays.

9. Website, analytics, payments and communications

This website has no enquiry form, advertising tracker or added analytics integration. Its animation script does not send tracking events. Firebase Hosting processes IP addresses for delivery, abuse prevention and usage analysis. Emailing the contact address shares your email address and the content you send with the business and its email service.

The app has no dedicated analytics, advertising or crash-reporting integration. Its service providers may still process technical or diagnostic information. The app has no payment gateway or card-entry form; documents you choose to upload may nevertheless contain financial information.

App notifications concern trip activity and messages. The app has no promotional subscription or automated email/SMS marketing feature. Submitting an enquiry is not, by itself, consent to unrelated electronic direct marketing. You may contact us about unwanted communications.

10. Your rights and complaints

Subject to POPIA and the applicable access procedures, you may ask whether we hold your personal information, request access and information about relevant recipients, and ask for correction or deletion of information that is inaccurate, excessive, outdated, misleading, unlawfully obtained or no longer authorised to be retained. You may object on the grounds allowed by POPIA and withdraw consent where consent is the basis for processing. These rights do not create an unconditional right to erase information that must lawfully be retained.

Send a request to admin@shemovesit.co.za, with enough detail to identify the information and explain what you want done. Appropriate identity verification may be needed to protect your information. The Information Regulator provides POPIA objection and correction/deletion forms.

You can complain to South Africa's Information Regulator without first obtaining our permission. See its complaint procedure and eServices portal. The Regulator also lists POPIAComplaints@inforegulator.org.za for POPIA complaints, telephone 010 023 5200, and Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. Check its contact page for updates.

11. Policy updates

The date at the top identifies the latest update to this policy. Please refer to this page for the current description of the app and website's data practices.