§ Privacy

How we handle your data

Last updated: 2026-11-09

Bond Club is an educational planning tool for South African retail investors. We are not a financial services provider, do not handle money, and do not transact bonds on your behalf. RSA Retail Savings Bonds are bought directly from National Treasury — we just help you keep track of what you hold and what it's worth.

What we store

Your email address (so you can sign in).
An optional display name (so we know how to greet you in emails).
The bonds you've added, with the amount, settlement date, and product type.
Your notification preferences.
Sign-in audit logs (when, from which IP) for fraud-detection.
A log of requests to our API — when, which endpoint, the response code, your IP address and browser user-agent, and your account if you're signed in — for security monitoring and to count visitors. We work out which country a request came from on our own server, using an offline database; your IP address isn't sent to anyone to do it.

What we don't store

Bank account numbers, ID numbers, tax numbers — none of these are needed.
Payment data — we don't take payments.
The cleartext of your password (we hash it with argon2id).

Email

We send transactional emails (sign-in verification, password reset) and — only if you've opted in — engagement emails (monthly rate digests, restart-eligibility alerts, maturity countdowns). You can turn each one off independently from your account page.

Cookies & analytics

We use Google Analytics and Google Ads conversion measurement to understand how the site is found and used. These set cookies and send usage data to Google (a transfer outside South Africa). They are off by default — the cookie banner asks first, and no analytics or advertising cookies are set until you press Accept. If you Decline, or never choose, no analytics or advertising identifiers are stored on your device; Google's tag still loads and sends Google cookieless signals, such as a page view or a sign-up, with no identifier attached. Essential cookies (your sign-in session, CSRF protection) are not affected by this choice and have no analytics purpose. To change your mind later, clear this site's storage in your browser and the banner returns.

Lawful basis for processing

Under POPIA s11 we process your data on two grounds: performance of contract (you signed up for the planning tool — we have to store your holdings to render them) and legitimate interest(security audit logs, fraud detection). Marketing-style engagement emails (rate digests, restart alerts) ride on your explicit consent via the toggles on your account page; you can revoke consent any time and the messages stop on the next nightly cron.

Retention periods

Profile + holdings: held while your account is active. Deleted on request (see below).
Sign-in audit logs: 365 days, then automatically pruned by a nightly job (`bondclub-prune-audit-events.timer`).
Request log (endpoint, time, response code, IP address, user-agent, account): 30 days, pruned nightly.
Email delivery webhooks (bounces, complaints): kept until the underlying user account is deleted.
Resend (our email provider) holds delivered messages per their own retention; we do not control their schedule.

Sharing

We don't sell your data. Two processors touch it: Resend (our email provider — sees your email address and message body to deliver mail), and, only if you accept the cookie banner, Google (Analytics + Ads conversion measurement — see "Cookies & analytics" above). Nobody else.

Your rights under POPIA

Right of access: download every piece of personal data we hold on you as a single JSON file at /api/me/export (sign-in required). Includes your profile, every holding + deposit ledger, and the last year of audit events.
Right of correction: edit your display name and notification preferences any time on /account; email security@bondclub.co.za to correct anything else.
Right of erasure: hit "Delete my account" on /account and your profile, holdings, and deposit ledger are permanently removed. Local-storage holdings on the device you're using remain there until you clear browser storage.
Right to lodge a complaint: with our Information Officer at security@bondclub.co.za or directly with the SA Information Regulator at inforegulator.org.za.

Information Officer + contact

Our Information Officer (POPIA s55–56) is reachable at security@bondclub.co.za. General questions go to hello@bondclub.co.za.