Privacy policy

Last updated 2 August 2026. This describes what Plaata collects about you, why, and what you can do about it. It is written to match what the product actually does - if the two ever disagree, the product is wrong and we want to know.

Who is responsible

Plaata (“we”) is the responsible party for your personal information under the Protection of Personal Information Act, 2013 (POPIA). You can reach our Information Officer at hello@plaata.co.za or +27 67 008 3283.

What we collect

Only what a given service needs, at the point it needs it.

Your account - e-mail address, and the name and phone number you choose to add.
Your vehicles - registration, make, model, year, colour, VIN, engine number and licence expiry date, for the cars you add.
Your designs - the plate designs you save.
Orders and deliveries - what you ordered, what it cost, and the delivery address you gave.
Renewals and personalised registration applications - what you asked us to lodge, and what the authority said.
Documents you upload - identity documents, proof of address and vehicle certificates, where a service requires them.
Availability checks - the registrations you check and the credits that were spent.

We do not collect card details. No payment method is stored by us; when payments go live, they will be handled by a licensed payment provider who never passes us the card number.

Special personal information

A copy of an identity document is sensitive, and we treat it that way. Uploaded documents are stored in private storage that is not readable without authentication, are visible only to you and to the staff processing your request, and are never included in the data export you can download yourself - precisely because a copy of your ID sitting in a downloads folder is a bigger risk than the one an export solves. Ask us if you need a copy and we will arrange it another way.

Why we hold it

To provide the service you asked for - that is the main one.
To lodge applications and renewals with a licensing authority on your behalf, where you have asked us to.
To remind you before a licence disc expires, unless you turn reminders off in your account.
To meet our own legal obligations - an invoice is a tax record and we are required to keep it.

We do not sell your information, and we do not send marketing unless you have ticked the box for it. Reminders about your own car are not marketing and are controlled separately.

Who else sees it

Only where the service cannot work otherwise. Each of these is an operator processing data on our instructions:

Supabase - our database, authentication and file storage. Hosted in the EU (Ireland).
Vercel - application hosting.
Resend - sending e-mail.
A vehicle-register lookup provider - when you check whether a registration is available, we send that registration to be looked up. We never send your name or account with it.
Licensing authorities, embossers and couriers - where fulfilling your order requires it.

Some of these are outside South Africa. POPIA permits that where the recipient is bound by comparable protection, which we require by contract.

How long we keep it

For as long as you have an account, and after that only what we are required to keep. Financial records such as orders and invoices are kept for the period tax law requires. Everything else is deleted when you close your account.

We are still finalising exact retention periods for each category. Until that is settled we err towards keeping less, and you can ask us at any time what we hold about you.

Your rights

Under POPIA you may:

See what we hold. Your account has a Download my data button under Details - no request needed, no waiting.
Correct it. Your details, cars and addresses are editable in your account.
Have it deleted. Also under Details. Where we hold nothing we are legally required to keep, this happens immediately and completely. Where you have placed an order or a renewal, we cannot delete the financial record, so the request goes to a person who will erase everything else and confirm by e-mail.
Object to processing, or withdraw consent to marketing, at any time.
Complain to the Information Regulator (South Africa) if you think we have got this wrong. We would rather you told us first, but it is your right either way.

Security

Access to your data is enforced at the database itself, not only in the application: every table carries row-level rules so one account cannot read another's rows even if the application asked it to. Documents sit in private storage. Staff access is limited to the people who need it and is logged.

No system is perfect. If personal information is ever compromised, POPIA requires us to notify both the Information Regulator and you, and we will.

Cookies

We use cookies to keep you signed in. That is the only thing they do - there is no advertising or cross-site tracking on this site.

Changes

If we change what we collect or who it goes to, we will update this page and change the date at the top. Material changes will be told to you directly rather than left here to be discovered.