Ikhadi privacy add-on
Ikhadi is run by Auxo Digital (Pty) Ltd, South Africa.
This adds to the Auxo Digital Privacy Notice (https://www.auxodigital.africa/privacy), which covers who we are, your rights and how to complain. Read that notice first. This page covers only what is specific to Ikhadi, and follows the Protection of Personal Information Act 4 of 2013 (POPIA).
1. Who is responsible
Ikhadi is a digital business card service run by Auxo Digital (Pty) Ltd ("Auxo Digital", "we", "us"), registration number 2024/374541/07, registered address: 6 Hoggs Bay Close, Kyalami, Johannesburg, 1684, South Africa. Auxo Digital is the responsible party for the platform.
Information Officer: Njabulo (Jabu) Mthombeni, Auxo Digital (Pty) Ltd. Email: jabu@auxo.digital. Phone: +27 78 239 6261. General enquiries: info@auxo.digital.
2. What Ikhadi collects
Card owners
- Your Auxo ID profile (name and email), because you sign in to Ikhadi with Auxo ID.
- What you put on your card: name, job title, company, a one-line description, phone number, email, website, LinkedIn and other links, booking link, city and country, and your photo.
- Simple counts for your card: how many times it was viewed, how many times the contact was saved, and how many people opened it from the QR code.
Your card is public once you publish it. Anyone with the link or the QR code can see everything on it and save it to their phone. Only publish what you are happy to share. You can unpublish or delete it at any time.
People who view a card
- We do not ask visitors for any information and do not set cookies on card pages.
- To keep the counts honest, we keep a scrambled (hashed) form of the visitor's IP address in memory until the end of the day, so repeat visits count once. We never store it.
- When you save a contact, it goes straight into your own phone. Ikhadi does not see your contacts.
Technical information
- Basic server logs kept by our hosting providers.
3. Why we use it, and on what basis
| Purpose | Legal basis (POPIA s11) |
|---|---|
| Show your card to the people you share it with, and let them save your contact. | Needed to provide the service you asked for. You choose what is on the card and whether it is published. |
| Show you how often your card was viewed, saved and scanned. | Needed to provide the service. |
| Sign you in and keep your account secure. | Needed to provide the service, and our legitimate interest in a safe service. |
| Stop abuse (for example cards that impersonate someone). | Our legitimate interest in a safe service. |
We do not sell personal information. We do not use it for advertising. We do not send marketing from Ikhadi.
4. Who we share it with: operators
Published cards are public by design. Apart from that, we share information only with these operators, who run Ikhadi for us. Each one processes information only on our instructions and under a written agreement.
| Operator | What they do | Where |
|---|---|---|
| Google Cloud (Firestore) | Main database for accounts and cards. | Johannesburg, South Africa (africa-south1) |
| Vercel | Hosts the website and runs the app. | United States company, with a global edge network (the Ikhadi app runs in the Cape Town region) |
| Cloudflare | Stores card photos (R2). | EU (Western Europe) |
You sign in through Auxo ID, which is run by Auxo Digital. Card pages load fonts from Google Fonts, which receives the visitor's IP address. We may share information if the law requires it, or to protect someone's safety.
5. Information sent outside South Africa
Our main database stays in Johannesburg. Hosting and photo storage happen in other countries. Under POPIA section 72 we only send information abroad where the recipient is bound by law, binding rules or an agreement that gives protection similar to POPIA, or where the transfer is needed to provide the service you asked for.
6. How long we keep it
- Your card: until you delete it or your account. Deleting or unpublishing a card takes its page and files offline at once; copies held by our content delivery network expire within 5 minutes. Deleting a card also deletes its photo, any unfinished photo uploads and its counts at once. Photo uploads you never finish are deleted automatically within a day.
- Your account: until you delete it in the app (Account, Delete my account). We aim to delete accounts with no card 12 months after the last sign-in.
- Visitor IP addresses: only a hashed form, in memory, until the end of the day.
7. Your rights
Under POPIA you may access, correct and delete your information, and object to processing based on our legitimate interest. You can change or delete everything on your card yourself, and delete your account in the app. For anything else, or if someone made a card about you without your permission, email our Information Officer at jabu@auxo.digital. We reply within 30 days. We may ask you to prove who you are first.
8. Complaints
Please talk to our Information Officer first. If you are not happy with our answer, you can complain to the Information Regulator (South Africa):
- Website: inforegulator.org.za
- Complaints: complaints.IR@justice.gov.za
9. Cookies
Ikhadi only uses cookies it needs to work, and only in the app, not on card pages:
- ikhadi_session: keeps you signed in.
- ikhadi_auxo_flow: short-lived, protects sign-in.
Card pages can be saved to your Home Screen; your phone then keeps a copy of the card so it works with no signal.
10. Security
Data is encrypted in transit and at rest, the database is closed to the public so only our server can read it, and photos are kept in private storage. If a breach puts your information at risk, we will tell you and the Information Regulator as POPIA requires.
11. Changes
We will update this page when our practices change and change the date below. This add-on is a draft pending legal review.
Draft for legal review. Last updated 22 October 2026.