Thuso logo

Privacy Policy

Privacy Policy

Last updated: 2 September 2026

1. Who We Are

Thuso ("we," "us," "our") is operated by its founders and creators (the "Operators"), who act as the data controller under Botswana's Data Protection Act, 2024, until the Platform is operated by an incorporated legal entity.

Contact for privacy matters: thusosystems@gmail.com

2. What Personal Data We Collect

  • Account data: phone number and/or email address, first and last name, verification codes (stored as one-way hashes, not in plain text).
  • Business data: business name, description, logo, city/region/address, website and social media links, associated owner(s).
  • Service data: service names, prices, currencies, durations, images.
  • Usage data: login timestamps, feature usage, and similar analytics data used to understand how the Platform is used and to improve it.
  • Survey/feedback data: responses you provide if you participate in beta surveys or feedback requests, which are voluntary.
  • Technical data: IP address, device/browser information, collected automatically for security and operational purposes.

3. Why We Process Your Data (Lawful Basis)

We process personal data on the following bases under the Data Protection Act, 2024:

  • Consent — for optional activities such as survey participation.
  • Performance of a contract — to create and operate your account, business listing, and services.
  • Legitimate interest — to secure the Platform, prevent fraud, and improve our services through aggregated usage analytics, balanced against your right to privacy.

4. How We Use Your Data

  • To create and authenticate your account.
  • To operate business and service listings you create.
  • To send verification codes required for login and sensitive actions (such as deletion).
  • To analyze usage of the Platform in aggregate, including login frequency, sign-up trends, and business activity, in order to improve the product.
  • To respond to support requests and, where applicable, to conduct beta surveys.

5. Who We Share Data With

We do not sell personal data. We may share data with:

  • Service providers who process data on our behalf, such as our hosting/database provider (Supabase) and, where used, our email or SMS delivery provider for verification codes. These providers are contractually limited to processing data only as instructed.
  • Legal authorities, where required by Botswana law.

We do not currently transfer personal data outside Botswana as a routine matter. If this changes (for example, if a service provider's infrastructure is located outside Botswana), we will update this Policy and ensure appropriate safeguards are in place as required by the Data Protection Act, 2024.

6. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy, or as required by law. Verification codes are short-lived and are automatically deleted shortly after use or expiry. Account and business data is retained for as long as your account remains active, and for a reasonable period thereafter in case of a support or legal need, after which it will be deleted or anonymized.

7. Your Rights

Under the Data Protection Act, 2024, you have the right to:

  • Be informed about how your data is processed (this Policy).
  • Access the personal data we hold about you.
  • Correct inaccurate personal data.
  • Request erasure of your personal data, subject to legal or legitimate business retention needs.
  • Object to certain processing, including for profiling or automated decision-making.
  • Restrict processing in certain circumstances.

To exercise any of these rights, contact thusosystems@gmail.com. We will respond within a reasonable time as required by law.

8. Data Security

We take reasonable technical and organizational measures to protect your data, including hashing verification codes and sensitive tokens, and restricting access to production data. However, no system is completely secure, and we cannot guarantee absolute security.

9. Children's Data

The Platform is not directed at individuals under 18. We do not knowingly collect personal data from children. If we become aware that we have done so, we will take steps to delete it.

10. Changes to This Policy

We may update this Privacy Policy as the Platform develops, particularly regarding data storage location, third-party processors, and our legal status. We will note the date of the most recent update at the top of this document.

11. Contact and Complaints

For any questions or to exercise your rights: thusosystems@gmail.com. You also have the right to lodge a complaint with Botswana's Information and Data Protection Commission (IDPC) once established/operational for complaint handling.