Privacy Policy

1. Data We Collect

• Identity: Full name, employee code, hotel, department, and job title — provided at account creation.
• Profile photo: Optional image uploaded by the employee.
• Recognition activity: Peer recognition messages sent and received, reactions, and comments.
• Mood check-ins: Daily mood ratings (Awful / Bad / Okay / Good / Amazing).
• Reward activity: Points balance, wallet balance, and redemption history.
• Chat messages: Messages sent within in-app team chat.
• Push notification token: Device token used to deliver push notifications.
• Session token: A secure UUID stored in the device keychain to authenticate your session.

2. How We Use Your Data

• To operate peer recognition, rewards, leaderboards, mood tracking, and chat features.
• To send push notifications for recognitions, reactions, and reward updates.
• To provide hotel management with engagement analytics via the admin dashboard.
• To send voucher emails when a reward redemption is approved.

3. Data Sharing

We do not sell or share your personal data with advertisers or unaffiliated third parties. Data is processed by the following service providers solely to operate the platform:

• Supabase — cloud database and file storage (EU region).
• Expo / Apple Push Notification Service — delivery of push notifications to iOS devices.
• Resend — transactional email delivery for reward vouchers.

4. Data Security

• All data is transmitted over HTTPS. Plain-HTTP connections are rejected by the app.
• Session tokens are stored in the iOS Keychain (encrypted at rest on-device).
• Each employee's data is isolated to their hotel by row-level security policies — employees at one hotel cannot access data from another hotel.
• The admin dashboard is accessible only to authorised hotel administrators.

5. Data Retention

Your data is retained for as long as you are an active employee. When your account is deactivated, your session is revoked immediately. You may request deletion of your personal data by contacting your HR administrator or emailing us directly.

6. Your Rights

You have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate information.
• Request deletion of your account and associated data.

To exercise these rights, contact your HR department or email us at the address below.

7. Children

IndabaCares is intended for use by adults in an employment context. It is not directed at children under the age of 13.

8. Changes to This Policy

We may update this policy from time to time. The date at the top of this page reflects the most recent revision. Continued use of the app after changes constitutes acceptance of the updated policy.

9. Contact

For privacy-related questions or data requests, contact:
Indaba Hotel Group — Human Resources
hr@indabahotel.co.za