PAIA manual

This manual is published under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA) and the Protection of Personal Information Act 4 of 2013 (POPIA). It explains which records Dreamachine (Pty) Ltd keeps, how it uses personal information, and how to ask for access to a record.

1. Acronyms

• PAIA: Promotion of Access to Information Act 2 of 2000
• POPIA: Protection of Personal Information Act 4 of 2013
• Regulator: the Information Regulator of South Africa
• IsThisSafe: the scam-checking service at www.isthissafe.co.za

2. Purpose of this manual

To help you understand the records we hold, the subjects they cover, how we process personal information, and how to request access to records, including the forms and fees.

3. Contact details

Body

Dreamachine (Pty) Ltd (registration number 2022/834710/07), trading as IsThisSafe

Information Officer

Name available on request from info@dreamachine.co.za

Regulator registration

2026-067696

Email

info@dreamachine.co.za

Phone

087 265 3595

Postal and physical address

Available on request from info@dreamachine.co.za

Website

www.isthissafe.co.za

We have not appointed a Deputy Information Officer.

4. The Regulator's guide to PAIA

The Regulator publishes a guide, in each official language, on how to use PAIA and POPIA to get access to records. You can get it from inforegulator.org.za or ask us for a copy by email. You can also arrange to inspect it in person by appointment.

5. Records available without a request

These are on our website and can be read without a PAIA request: our Terms, Privacy policy, plans and prices, Help, Company information and this manual.

6. Records kept under other laws

• Companies Act 71 of 2008: company registration and statutory records
• Tax Administration Act 28 of 2011 and Income Tax Act 58 of 1962: financial and billing records
• Consumer Protection Act 68 of 2008: terms and transaction records
• Electronic Communications and Transactions Act 25 of 2002: records of electronic transactions and consents
• POPIA: records of processing, consent and data-subject requests

7. Subjects and categories of records

• Company: registration documents, statutory registers, agreements with service providers.
• Finance and tax: billing records (plan, amount, date, PayFast payment reference), accounting records, tax returns.
• Customers: account email address, plan and subscription status, household membership, checks and their results, consent and age confirmations, emails sent.
• Service operation: abuse-prevention records (keyed hashes of IP addresses, device cookies and email addresses), audit records of account actions, system logs.
• Scam intelligence: details found in submitted messages, such as links and website names, and keyed hashes of phone numbers, email addresses and bank account numbers.

8. Processing of personal information

Purposes. To check messages for signs of a scam and explain the result; to run accounts, plans and family households; to take payments and keep the records tax law requires; to prevent fraud and abuse of the free checks; to answer questions, complaints and requests; and to meet our legal obligations.

Data subjects and their information.

• Visitors who check a message without an account: the message, links and screenshots they submit; keyed hashes of their IP address and a device cookie.
• Account holders and family members: email address, plan, household membership, checks, consent and age confirmations; for paying customers, subscription and billing records.
• People named in submitted messages (for example a sender's phone number or email address): kept only as keyed hashes, except in the original text, which is deleted within the period in our Privacy policy.
• Children who use a Family plan with a parent's or guardian's consent: as for account holders.
• Suppliers: business contact and contract details.

Recipients. The service providers that process information for us: Anthropic (AI analysis), Google Web Risk (links only), domain registries (domain names only), Supabase (database and storage), Vercel (hosting, bot checks and visitor counts), PayFast (card payments), Resend (email) and Sentry (error reports, stored in Germany). We may also disclose information when the law requires it, for example to the South African Revenue Service or under a court order.

Cross-border flows. Our database and servers are in Ireland (European Union). Anthropic and Resend are in the United States, and Google and Vercel operate globally. The Privacy policy explains the basis for these transfers under section 72 of POPIA.

How we look after it. Encryption of original messages while we hold them and of all connections; keyed hashes instead of phone numbers, email addresses and bank account numbers found in messages; database access limited to our server, with row-level access rules; screenshots deleted as soon as a check finishes; short, enforced retention periods; access for our team only where needed; and a breach-response process that includes telling the Regulator and affected people as section 22 of POPIA requires.

9. How to request access to a record

1. Complete Form 2 (Request for access to a record) from the PAIA Regulations, available on the Regulator's website, and email it to info@dreamachine.co.za. If you need help completing it, ask us.
2. We confirm who you are before giving out personal information, usually with a one-time code sent to the email address the record is about.
3. The fees are those prescribed in the PAIA Regulations. We'll tell you if a fee or deposit is payable before we start. A request for your own personal information carries no request fee.
4. We decide within 30 days, and may extend this once by up to 30 days if PAIA allows, telling you why. If we refuse, we give reasons.
5. If you disagree with our decision, you can complain to the Regulator or apply to court, as PAIA provides.

To correct or delete your personal information, or object to how we use it, see Your rights in our Privacy policy. Requests under POPIA use Forms 1 and 2 of the POPIA Regulations, or a simple email.

10. Availability and updates

This manual is on our website and can be inspected in person by appointment. A copy is free by email. We review it at least once a year and whenever our processing changes.