Privacy Policy
Effective date: 5 September 2026
This policy explains what personal information Orchard collects, why we collect it, who else sees it, and what you can do about it. It is written to meet our obligations under the Protection of Personal Information Act 4 of 2013 (POPIA).
We have tried to write it in plain language rather than legal boilerplate. If anything here is unclear, email us at hello@getorchard.co.za and we will explain it.
1. Who we are
Orchard is a dividend income tracking platform for South African investors, operated by OrchardSA ("we", "us", "our"). We are the responsible party for the personal information described in this policy.
Registered address: 4 Montrose Street, Newlands, 7700 Cape Town, South Africa
Contact for all privacy matters: hello@getorchard.co.za
2. What we collect
When you create an account:
- Your email address
- Your password, which is hashed before it is stored — we cannot read it, and neither can anyone working on Orchard
When you use Orchard:
- The shares you add: ticker, company name, number of shares, purchase price(s) and purchase date(s)
- Whether you have marked a holding as being held in a tax-free savings account, because this changes the tax we calculate
- Which dividends you have marked as received
- Your plan and subscription status
- Sign-in times, so we can tell whether an account is being used
When you visit our website:
- Which pages you viewed and when
- Your IP address, which indicates your approximate location — typically the city, not an exact address
- Your browser and device type
- The website that sent you to us — only its name, such as “google.com”, never the full address you came from — and any campaign tag in the link you followed. This is recorded once, when you create an account, so we can tell which of our efforts actually reach people. It is not tracked afterwards.
3. What we do not collect
This list matters as much as the one above, so we are being specific:
- No phone number. We do not ask for one and have nowhere to store one.
- No identity number. Orchard does not ask for nor does it collect your identification or passport number.
- No tax number. Orchard does not ask for nor does it collect your SARS tax number.
- No card or bank details. When you subscribe, you enter your payment details on PayFast's own secure page. They never pass through Orchard and we never see or store them.
- No connection to your broker or bank. Orchard has no link to any bank account or brokerage account you hold anywhere. Everything in your Orchard portfolio(s) is there because you typed it in. Orchard does not verify if the information you have typed in is accurate or inaccurate.
4. Why we collect it, and on what basis
We process your information on these grounds:
- To provide the service you asked for. Your email identifies your account; your shares holdings are the thing Orchard exists to track the dividends of. Without these, there is no service. This is processing necessary to perform our contract with you.
- To contact you about your account. Sign-up confirmation, password resets, dividend alerts and reminders you have switched on, and notices about billing or changes to the service.
- To keep Orchard working and secure. Diagnosing faults, preventing abuse, and knowing whether features are used.
- To understand how people find Orchard, so we do not waste resources advertising to the wrong people. This is a legitimate interest, and section 9 explains how to opt out of it.
Supplying your email address is mandatory — you cannot have an account without one. Everything else is voluntary. If you add no holdings, Orchard simply has nothing to show you.
5. Who else sees your information
We do not sell your personal information, and we never will. We do use other companies to run Orchard, and they see some of your information in order to do their job. Every one of them is bound to use it only on our instructions.
| Who | What they receive | Why | Where |
|---|---|---|---|
| Supabase | Your email, password hash, and everything in your portfolio | Database and sign-in | London, United Kingdom |
| Vercel | Your IP address and the pages you request | Hosting the website and app | Global network |
| Railway | Requests your browser makes to our servers | Running the Orchard backend | Europe & North America |
| DigitalOcean | Email addresses and holdings needed for scheduled emails | Sending dividend alerts and reports on schedule | Amsterdam, Netherlands |
| Brevo | Your email address and the contents of emails we send you | Delivering email | European Union |
| PayFast | Payment details you enter directly with them, and your subscription status | Taking payment | South Africa |
| Meta | That a browser visited a page, with its IP address. Not your email address. | Measuring whether our advertising works | United States, Ireland |
| That a browser visited a page, with its IP address. Not your email address. | Website analytics and advertising measurement | United States |
On advertising specifically. Meta and Google can see that a browser visited Orchard. They are not given your email address, your name, or anything in your portfolio.
Meta offers a feature called Automatic Advanced Matching, which would send them a scrambled version of the email address you type into our sign-up form. We have deliberately switched it off. If we ever turn it on, we will update this policy before we do, not afterwards.
We will also disclose personal information if the law requires it — a court order, or a lawful request from a regulator. If that happens we will tell you, unless we are legally prohibited from doing so.
6. Where your information is stored
Most of the companies listed above are outside South Africa, so your personal information is transferred out of the country. POPIA permits this where the recipient is subject to laws or binding agreements that protect your information to a comparable standard, and each of our providers is contractually bound to that standard.
The European providers are subject to the GDPR, which is generally accepted as offering protection comparable to POPIA. For providers in the United States we rely on the data processing terms in our agreements with them, which impose equivalent obligations.
PayFast, which handles the most sensitive information involved in Orchard, is South African and your payment details do not leave the country.
7. How long we keep it
- While your account is open: we keep your account and portfolio information for as long as you use Orchard.
- If you delete your account: we delete your personal information within 30 days. Copies inside routine backups are overwritten within a further 90 days.
- Billing records: we keep proof of payments for five years, because tax law requires it. This is limited to the fact and amount of a payment.
- Email delivery records: kept for 12 months, so we can investigate a message that did not arrive.
8. Your rights
Under POPIA you have the right to:
- Ask what we hold about you, and get a copy of it
- Correct anything that is wrong. You can edit your holdings yourself at any time in the app.
- Have your information deleted. Email us and we will delete your account and everything in it.
- Object to processing based on legitimate interest, including analytics and advertising measurement
- Complain to the Information Regulator, whose details are in section 12
Email hello@getorchard.co.za for any of these. We will respond within 30 days, and there is no charge.
9. Cookies and tracking
Orchard uses cookies and similar technology for two purposes:
- Keeping you signed in. Without this the app cannot work — you would be signed out on every page.
- Measuring visits, through Google Analytics and the Meta pixel, so we know which pages people read and whether our advertising reaches anyone.
You can block the second kind without breaking Orchard. Every major browser can block third-party cookies, and browser extensions that block trackers will stop Google and Meta receiving anything. Orchard will work normally.
We also store one small item in your browser: the name of the site that referred you, kept only until you create an account, so that information survives the step from our website to the app. It stays in your browser, is never sent anywhere else, and clearing your browser data removes it.
10. How we protect your information
- All traffic to and from Orchard is encrypted in transit
- Passwords are hashed, never stored in a readable form
- Our database enforces row-level security, so one user's query cannot return another user's holdings even if our own code has a bug
- Access to production systems is limited to those who need it
No system is perfectly secure. If a breach ever affects your personal information, POPIA requires us to notify both you and the Information Regulator, and we will.
11. Children
Orchard is not intended for anyone under 18. We do not knowingly collect information from children. If you believe a child has created an account, email us and we will delete it.
12. Complaints
If you are unhappy with how we have handled your personal information, please tell us first at hello@getorchard.co.za so we can put it right.
You also have the right to complain directly to the Information Regulator of South Africa at any time:
- Website: inforegulator.org.za
13. Changes to this policy
If we change how we use your personal information, we will update this page and change the effective date at the top. Where a change is significant — a new company receiving your information, or a new purpose — we will email you before it takes effect rather than relying on you to notice.
14. Contact
For anything in this policy, email hello@getorchard.co.za.
See also our Terms of Service and Refund & Cancellation Policy.