Privacy policy
Nice to Find You is a trading name of PassPath (Pty) Ltd (registration number 2026/517551/07). We are the "responsible party" under South Africa's Protection of Personal Information Act (POPIA). Our Information Officer is Brandon van Niekerk, hello@nicetofindyou.com.
This policy explains, in plain English, what information we hold, why, and what you can do about it.
1. What we do
We ask AI assistants (ChatGPT, Claude, Gemini, Perplexity) the questions travellers ask about where to stay in Southern Africa, record which businesses they name, and help independent places to stay and tour operators get named.
2. What we collect and why
| Who | What we hold | Why | Where it comes from |
|---|---|---|---|
| Businesses in the Index (lodges, guesthouses, hotels, tour operators) | Public business details: name, website, town, region, the phone number, email address and WhatsApp number the business publishes on its own website, and what AI assistants said about the business | To run the Index and show businesses their report card | Public websites, public listings, AI assistants' answers |
| People who look up a business on our site | The name typed and a one-way scrambled version of the IP address (not the address itself), with the date | To prevent abuse and to improve the Index | You |
| Owners who claim a report card | Business email address, business name, confirmation date | To verify you and send your deep check | You |
| Customers | Contact name, business email, phone, billing details (card payments are handled by PayFast; we never see or store card numbers), the facts and rates you confirm, and anything you connect (Google Analytics or Search Console viewer access) | To deliver the service, report results and bill you | You |
| Travellers who enquire through a form we provide on a business's site or our page | Name, email, phone (optional), travel dates, number of people, budget, message, and how you found the business | To deliver your enquiry to that business and count where enquiries come from | You |
| Visitors arriving at a customer's site from an AI assistant | Which assistant, which page and when. No name, no IP address, no cookies | To count visits from AI assistants | Automatic, from the page you came from |
| AI robots that read our pages | The robot's name and the page read | To show businesses how often AI reads their information | Automatic |
We do not sell personal information. We do not use it for advertising.
3. Cookies
This site uses only the cookies it needs to work, and no advertising or tracking cookies: a short-lived cookie (two hours) that lets you see the full result of a business you looked up, and a sign-in cookie if you sign in to your report card. Our robot check on forms (Cloudflare Turnstile) checks that you are a person. If we add analytics later we will update this policy and ask for consent where the law requires it.
4. Enquiries from travellers
When you send an enquiry through our form, we pass it to the business you chose. That business decides how to respond and becomes responsible for your information from then on. We keep a copy for up to 24 months to count enquiries and to resend if delivery fails, then delete it.
5. Contacting businesses
We contact a business that is not a customer at most once, using its published business contact, to ask whether it wants to hear from us. If it does not reply or says no, we do not contact it again.
6. Who we share information with
Only service providers that help us run the service, under contract, and only what they need:
- Vercel (website hosting), Supabase (database, hosted in the European Union), Google Workspace (email), Resend (sending emails), Cloudflare (the robot check on our forms), GitHub (runs our scheduled checks), PayFast (card payments).
- AI providers (OpenAI, Anthropic, Google, Perplexity) receive the traveller questions we ask and, when we check what AI says about a business, that business's name and public facts. We do not send travellers' or owners' personal information to AI providers except where needed to label an enquiry's source, and then only the "how did you find us" text.
Some of these providers store information outside South Africa (for example in the European Union and the United States). We use providers bound by data protection terms that give protection similar to POPIA.
7. Google data
If you connect Google services (for example by giving our viewer account access to your Google Analytics or Search Console), we only read the reports needed for your monthly report, we never change anything, we do not share that data, and we delete it within 30 days of you removing access or cancelling.
8. How long we keep information
- Index answers and public business details: as long as the Index runs, as a dated history.
- Lookups: 12 months.
- Claims and customer records: while you are a customer and 5 years after, for tax and legal records.
- Traveller enquiries: 24 months.
- AI visit counts: as totals, without personal information.
9. Security
Information is stored with access controls and encryption in transit; only the founder and the systems that need it can see non-public information. If a breach affects your information we will tell you and the Information Regulator as POPIA requires.
10. Your rights
You may ask what information we hold about you, ask us to correct or delete it, or object to how we use it. A business may ask us to stop showing it on the Index; because naming comes from public AI answers, we will stop showing it by name. Email hello@nicetofindyou.com and we will reply within 30 days.
If you are not happy with our answer you may complain to the Information Regulator (South Africa): inforegulator.org.za, POPIAComplaints@inforegulator.org.za, 010 023 5200. (Checked 16 October 2026.)
11. Changes
We will post any change here with its date. Last updated: 16 October 2026.