Privacy Policy

Effective and last updated: 4 September 2026

This policy explains how SandSpace Corporation ("SandSpace", "we", "us") processes personal information when you use sandspace.co.za and the Design and Share services. SandSpace is the responsible party for this processing under the Protection of Personal Information Act 4 of 2013 (POPIA).

1. Information we process

• Account and identity details, including name, surname, username, email address and profile picture. Optional Share profile details may include birthday month and day, gender and timezone if you choose to provide them.
• Content and collaboration data, including designs, uploaded files, messages, group membership, reactions and sharing permissions.
• GIF interaction data, including GIPHY search terms and the GIFs you view, select or send when you use that feature.
• Technical and security data, including session identifiers, sign-in time, last activity time, sign-out time or last-seen time, session duration, browser/device information, error records and essential service activity. Authorised SandSpace administrators can view this login history for account support and security.
• Subscription and transaction status if paid services are enabled. A payment provider will process full payment-card details; SandSpace should not store them.
• Support communications and privacy requests you send us.

Please do not place unnecessary identity numbers, health data, financial records or other special personal information in shared content. Content you choose to create may nevertheless contain such information, and you control who receives it.

2. Why and on what basis we process it

We process information to create and secure accounts; provide, save and synchronise work; enable sharing and messaging; respond to support; prevent abuse; meet legal duties; and improve reliability. Depending on the activity, processing is necessary to perform our agreement with you, comply with law, pursue legitimate interests that do not override your rights, or act on your consent. Required account fields are marked in the interface; without them we may not be able to create or secure an account.

3. Children

SandSpace is not directed to children under 18 acting without a competent person's consent. If a user is under 18, a parent or legal guardian must authorise account creation and the processing of that child's personal information. Contact us if you believe a child supplied information without valid consent.

4. Sharing and operators

We share information only as needed with people you choose, group members, and service providers acting as operators—for example Supabase for authentication/database/storage and Cloudflare for hosting, delivery and security. When you open GIF search or display a GIPHY GIF in Share, your browser connects directly to GIPHY. GIPHY may receive the search terms and interaction information described above, together with technical information such as your IP address, device information and cookies, under the GIPHY Privacy Policy. We may also disclose information where law requires it, to protect rights and service security, or during a lawful business reorganisation. We do not sell personal information.

5. International transfers

Cloud providers may process information outside South Africa. Before doing so, we require an adequate legal basis under POPIA section 72, such as an enforceable agreement that provides protection substantially similar to POPIA, applicable law, consent, or another permitted ground.

6. Retention

We keep account and workspace information while your account is active and for only as long afterwards as needed for legal, security, backup and dispute purposes. Message and file retention follows the relevant workspace and sharing controls. Backup copies may remain for a limited recovery cycle before deletion. We will document and apply specific retention schedules as the service matures.

7. Security and incidents

We use reasonable technical and organisational safeguards, including encrypted transport, access controls, authentication, row-level data permissions, secret separation and service monitoring. No online service can promise absolute security. Where there are reasonable grounds to believe personal information was accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected people as required by POPIA section 22.

8. Your rights

Subject to POPIA and PAIA, you may ask whether we hold your information; request access, correction or deletion; object to certain processing; withdraw consent; request restriction where applicable; and complain about our handling of your information. We may need to verify your identity and may retain information where law permits or requires it. Account settings provide some controls; other requests can be sent to support.

9. Cookies and local storage

SandSpace uses essential browser storage for authentication, security, preferences and recovery of work. We will request appropriate consent before introducing non-essential advertising or cross-site analytics technologies.

10. Direct marketing and automated decisions

We will send direct electronic marketing only where POPIA permits it and will provide a free way to opt out. SandSpace does not currently make decisions with legal or similarly significant effects based solely on automated processing.

11. Contact and complaints

Privacy and Information Officer requests: support@sandspace.co.za. Please use the subject “Privacy request”.

If we do not resolve your concern, you may complain to the Information Regulator (South Africa) using its eServices portal or POPIAComplaints@inforegulator.org.za; general enquiries: 010 023 5200.

12. Changes

We will update this policy when our processing changes and display the new effective date. We will give prominent notice where a change materially affects your rights.