Privacy Policy & POPIA Notice

Explovie is a digital greeting-card platform operated by T Next Pty Ltd, a company registered in the Republic of South Africa. We believe in bringing people closer through thoughtful words, music and meaningful connections, and protecting the privacy of those who use our services is an important part of that commitment.

This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you visit our website, create or purchase a digital card, contribute to a group card or contact us.

Our privacy practices are governed primarily by South Africa's Protection of Personal Information Act 4 of 2013 (POPIA). Where applicable, we also recognise the requirements of international data-protection legislation, including the EU General Data Protection Regulation (GDPR), the UK GDPR and other relevant privacy laws.

This policy applies to website visitors, purchasers, card organisers, group-card contributors and individuals whose personal information is included in cards.

T Next Pty Ltd, trading as Explovie, is the responsible party under POPIA and, where applicable, the data controller under relevant international privacy legislation. We determine the purposes and means of processing personal information in connection with the operation of Explovie.

• Responsible party: T Next Pty Ltd
• Trading name: Explovie
• Country of registration: South Africa
• Information Officer: The head of T Next Pty Ltd
• Privacy contact: hello@explovie.online

Our Information Officer is responsible for overseeing applicable data-protection obligations and responding to privacy-related enquiries.

Paddle, our authorised reseller and Merchant of Record, separately determines the processing of personal information required for its payment, invoicing, tax and related transaction services.

Depending on how you interact with Explovie, we may collect the following categories of information.

Customer and purchasing information

• Name and email address.
• Purchase details and order references.
• Transaction confirmations and payment status.
• Refund or chargeback information received from Paddle.

Digital-card information

• Sender names and signatures.
• Recipient names voluntarily provided by purchasers.
• Personalised messages and wishes.
• Card design, font, music and presentation preferences.
• Private card-link identifiers.
• Information necessary to create and retrieve purchased cards.

Group-card information

• Names of organisers and contributors.
• Personalised messages submitted by contributors.
• Group-card invitation and access information.
• Other information voluntarily included in contributions.

Account and support information

• Optional account identifiers and email addresses.
• Authentication and session information.
• Customer service correspondence.
• Information voluntarily submitted when requesting assistance.

Technical information

• IP addresses.
• Browser and device information.
• Website request logs.
• Security and diagnostic information.
• Essential cookies and browser-storage information.

AI-assisted writing information

Where a customer requests optional AI writing assistance, we may process the prompts and relevant message context submitted to generate or improve suggested text.

We do not require customers to upload personal photographs or voice recordings as part of our current digital-card products.

We collect information directly from customers when they visit or interact with our website, create or purchase digital greeting cards, submit messages or group-card contributions, use optional AI-assisted writing, sign in to an account or contact customer support.

We may also receive information indirectly through Paddle transaction confirmations, group-card organisers and contributors, customers including another person's name or message in a card, and authentication and technical service providers.

When information about a recipient or contributor is supplied by another person, the individual concerned may not have interacted directly with Explovie. We seek to process such information only where there is an appropriate lawful basis and to provide relevant privacy information as required by applicable legislation.

We process personal information for legitimate business purposes, including:

• Creating, personalising and delivering digital greeting cards.
• Managing group-card participation.
• Providing purchased digital-card access.
• Confirming transactions and assisting customers.
• Providing optional AI writing assistance.
• Maintaining website functionality and security.
• Preventing fraudulent or unauthorised activity.
• Administering optional customer accounts.
• Responding to privacy and customer service requests.
• Complying with applicable legal, accounting and regulatory obligations.
• Providing marketing communications where permitted by law.

Depending on the processing activity and applicable legislation, we rely on contractual necessity, legitimate interests, compliance with legal obligations, consent or another permitted lawful ground. Our legitimate interests include providing reliable digital services, protecting our platform, preventing misuse and responding to customer enquiries. We process information relating to recipients and contributors only where a suitable lawful justification exists.

Required and optional information. Certain information is necessary to complete a purchase or deliver a product; for example, a valid purchaser email address is required to deliver the completed card. Without it, we may be unable to provide the requested service. Personalised messages, recipient names and other card details are provided voluntarily, although certain choices may be necessary to complete a particular card. Customers are not required to create an account for ordinary one-time purchases.

Completed cards are delivered to the purchaser, not directly to the intended recipient. The purchaser is responsible for forwarding or sharing the completed card with its intended recipient. Explovie does not require the recipient's email address for card delivery.

Customers may voluntarily include names, messages and other personal details within their cards. Group-card contributors may submit messages using a shared invitation link; these contributions may become visible to the purchaser and others who receive or have permitted access to the completed card.

Cards use private access links intended to be difficult to guess and excluded from public search indexing. However, possession of a valid private link may allow someone to view the associated card. A private link does not provide the same protection as password-restricted access. Customers are responsible for sharing card links appropriately.

We encourage users not to disclose another person's sensitive or confidential information without appropriate permission or another lawful justification.

Explovie offers optional AI-assisted writing tools to help customers prepare thoughtful messages. When this feature is used, the submitted prompts and relevant message content may be processed by an external AI service provider to provide the requested writing assistance.

Customers remain responsible for reviewing and approving messages before finalising their cards. We recommend avoiding confidential information, sensitive personal details and unnecessary information about third parties when using AI-assisted writing.

Explovie does not use customers' private card messages for its own advertising without an appropriate lawful basis. Processing by our AI service provider is subject to the relevant service arrangements, privacy requirements and applicable data-protection safeguards.

Explovie uses Paddle as its authorised online reseller and Merchant of Record. Paddle is responsible for the sale transaction, including payment processing, applicable taxes, invoicing, refunds and related transaction administration. Explovie currently offers digital greeting cards through one-time purchases without recurring subscriptions.

Paddle may share limited transaction information with Explovie, such as the buyer email address, transaction reference, payment confirmation, purchase status and refund or chargeback status. This enables Explovie to provide the purchased digital product and relevant support.

Explovie does not store customers' full payment-card numbers or banking credentials. Paddle independently processes relevant personal information under its own privacy notice; please read Paddle's Privacy Policy. For payment and billing enquiries, contact Paddle Buyer Support.

We may disclose personal information to service providers where reasonably necessary to operate Explovie, including providers responsible for website hosting and cloud infrastructure, database storage, authentication services, transactional email delivery, AI-assisted writing functionality, website security and technical support, and payment and transaction administration.

We may also disclose information to professional advisers, regulatory authorities or law-enforcement bodies where required or permitted by law. Where providers process personal information on our behalf, we seek appropriate contractual, confidentiality and security arrangements.

We do not sell customer personal information to data brokers. We do not disclose private card messages to unrelated third parties for their independent advertising purposes without an appropriate lawful basis.

Explovie is operated by a South African company and provides services to customers internationally. Some of our technology and service providers may process or store personal information outside South Africa, including in countries with data-protection standards different from those in South Africa.

We assess international transfers in accordance with applicable legislation, including section 72 of POPIA. Where EU or UK data-protection legislation applies, we also consider the relevant international-transfer requirements. Depending on the circumstances, lawful transfers may rely on adequate protection, appropriate contractual safeguards, contractual necessity or another legally permitted mechanism.

You may request further information about relevant international data-processing arrangements by contacting hello@explovie.online.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected or as required or permitted by law.

Unpaid digital-card drafts are scheduled for deletion after seven days.

Purchased digital cards and related delivery information are retained for the period reasonably necessary to provide the purchased private-link service. Retention may end when the applicable card-access period expires or where a valid deletion request is accepted and no legal reason requires continued retention. Explovie does not guarantee indefinite availability of purchased card links.

Customer accounts are retained while active and afterwards only where justified by legal, security or dispute-resolution requirements.

Customer support records are retained as reasonably necessary to resolve enquiries and associated disputes.

Technical and security logs are retained only for periods justified by security, diagnostic and operational needs.

Transaction records may be retained for longer periods where required by applicable accounting, taxation and legal obligations.

When information is no longer required, we take steps to delete, destroy or appropriately de-identify it. Information in restricted backups may remain until those backups are replaced or deleted in accordance with applicable retention procedures. You may request deletion of eligible personal information by contacting hello@explovie.online.

We take reasonable technical and organisational measures intended to protect personal information against unauthorised access, loss, alteration, disclosure and misuse. These include, where applicable:

• Secure HTTPS website connections.
• Restricted administrative access.
• Account and authentication controls.
• Private card-link identifiers.
• Payment-confirmation checks before granting purchased-card access.
• Website security and operational monitoring.
• Appropriate technical safeguards within our hosting and database environment.

We periodically assess relevant security risks and aim to maintain safeguards proportionate to the information processed. No internet-based service can guarantee complete security. If a security compromise occurs, we will assess its impact and notify the Information Regulator and affected individuals where required by applicable legislation.

Explovie may use cookies and similar browser-storage technologies to provide essential website functionality, supporting authentication, security, session management and the preservation of necessary website preferences.

Optional analytics, advertising or marketing technologies, where introduced, will be disclosed and managed according to applicable legal requirements. Where consent is required, optional tracking technologies will not be activated before the necessary consent has been obtained. You may manage applicable cookie preferences through available website controls and browser settings.

Please refer to our separate Cookie Policy for further information.

Explovie may occasionally communicate with customers about new designs, seasonal collections or services. Promotional communications will only be sent where permitted under applicable legislation, and where consent is required, customers will be given an opportunity to provide it voluntarily.

We do not automatically subscribe customers to marketing communications solely because they purchase a digital card. Where an existing-customer marketing exception applies, we will observe its legal conditions, including relevant opt-out requirements. You may unsubscribe from promotional communications at any time. Purchase confirmations and essential service communications are separate from optional marketing communications.

Explovie is intended primarily for adult purchasers. Individuals under 18 should not independently purchase products without appropriate parental or guardian authorisation.

Card messages may occasionally contain sensitive information, including details relating to health, family circumstances or children. We do not require such information to provide our standard services, and customers are encouraged to avoid submitting sensitive personal information about others without an appropriate lawful basis. Additional protections apply where special personal information or children's personal information is processed under relevant legislation.

If you believe sensitive or children's personal information has been submitted unlawfully, please contact hello@explovie.online.

Under South Africa's Protection of Personal Information Act, you may have rights to:

• Request confirmation that we hold your personal information.
• Request access to personal information held about you.
• Request correction of inaccurate, incomplete or outdated information.
• Request deletion or destruction where legally appropriate.
• Object to certain processing activities.
• Object to direct marketing.
• Withdraw consent where processing depends on consent.
• Lodge a complaint with the South African Information Regulator.

To exercise these rights, email hello@explovie.online with the subject "Privacy Request". We may require reasonable identity verification before disclosing or modifying personal information. Certain requests may be subject to applicable legal limitations, including mandatory record-retention obligations.

Explovie welcomes customers from South Africa and internationally. Where legislation such as the EU GDPR or UK GDPR applies, you may have additional rights, including access, correction, erasure where applicable, restriction of processing, data portability, objection to certain processing, withdrawal of consent, rights relating to certain automated decisions, and the right to lodge a complaint with an appropriate supervisory authority.

Requests falling under the GDPR will generally be answered within one month, subject to permitted extensions. Nothing in this policy is intended to limit mandatory rights available under applicable privacy legislation. Where legally required, we will provide additional information concerning relevant representatives or privacy contacts.

If you believe that your personal information has been processed unlawfully or your privacy rights have been infringed, you may contact Explovie using the details in this policy. You also have the right to approach the Information Regulator of South Africa:

• Website: inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za
• POPIA complaints: POPIAComplaints@inforegulator.org.za
• Telephone: +27 10 023 5200 · Toll-free: 0800 017 160

Where applicable international data-protection legislation provides additional complaint mechanisms, you may also approach your relevant supervisory authority.

We may update this Privacy Policy to reflect changes in our services, operational practices, technology or legal obligations. The latest version will be published on our website together with its effective date. Where material changes require additional notice or consent under applicable legislation, we will take the necessary steps.

For any questions regarding privacy, personal information or data protection, contact T Next Pty Ltd, trading as Explovie, at 9 Bedford Road, Bedfordview, Johannesburg, 2007, South Africa; telephone +27 66 5476037; email hello@explovie.online. For enquiries under POPIA, please contact our Information Officer at the email address above.