Privacy policy
Version 2, last updated 2 October 2026
IsThisSafe is run by Dreamachine (Pty) Ltd (registration number 2022/834710/07). Our address and other details are on the Company information page. We are the responsible party for your personal information under the Protection of Personal Information Act (POPIA). You can reach our Information Officer at info@dreamachine.co.za. We are registered with the Information Regulator (registration number 2026-067696).
What we collect and why
- What you ask us to check. The text, links and screenshots you submit. We use them only to check for signs of a scam.
- Details we pull out of it. Links, website names, amounts and organisation names. Phone numbers, email addresses and bank account numbers in a message are kept only as a one-way code (a keyed hash), so we can spot repeat scam contacts without keeping the number itself.
- Your account. If you create one: your email address, your plan, your checks and, for families, who is in your household.
- Payments. PayFast handles card payments. We never see or store your card details. We keep your subscription status and payment reference codes.
- Abuse prevention. A random device cookie and your IP address, stored only as keyed hashes, to count free checks and stop abuse. If you create an account, we also keep a keyed hash of your email address (with dots and "+" extras in Gmail-style addresses ignored), so the free checks are counted once per person. A keyed hash can't be turned back into your email address. We keep it even if you delete your account, so the free checks can't be claimed twice. We don't accept temporary (disposable) email addresses.
- Feedback. If you tell us whether a result helped. This is not linked to you.
We process this information to provide the service you ask for, to meet our contract with you when you subscribe, and for our legitimate interest in preventing fraud and abuse. We never sell your information, never use it for advertising, and never use your submissions to train AI models.
How long we keep it
- Screenshots: deleted as soon as the check finishes. If a screenshot contains a nude, sexual or intimate image, it is deleted the moment it's detected. Nobody at IsThisSafe ever views uploaded images; we keep only a count of how many such images were deleted.
- Your original message text, and links, numbers and other details exactly as you typed them: 24 hours.
- The result (risk level, score, reasons and a version of the text with personal details removed): until you delete the check, or your account. This keeps result links working and helps us recognise scams that come back.
- Sign-in codes: 24 hours. Abuse-prevention records (scrambled IP addresses): 48 hours.
- Free-check counters (a scrambled code from your device cookie, and a keyed hash of your email address): kept while IsThisSafe operates, so free checks can't be claimed twice. Neither can be turned back into your details.
- Account information: until you delete your account.
- Consent records (which version of these terms you accepted, your age confirmation and any guardian consent) and our record of account actions: while your account exists, and 3 years after it ends, without your name or email.
- Billing records (plan, amounts, dates and PayFast payment references): 5 years from each payment, as tax law requires, even if you delete your account. After deletion they are kept without your name or email.
You can delete a check at any time from its result page (on the device you used) or from your account, and you can delete your whole account and its data from your account page.
Who else processes it
We use these service providers. Some are outside South Africa:
- Anthropic (United States): AI analysis of the message or screenshot, and writing the explanation. Anthropic deletes what we send within 30 days, unless it flags a request under its usage policy, when it may keep it for up to 2 years. It doesn't use API data to train its models.
- Google Web Risk (Google Cloud): checks links against Google's threat lists. Only links are sent.
- Domain registries (found through IANA's public directory, for example Verisign for .com addresses): we ask when a website's domain was registered, because scam websites are often brand new. Only the domain name is sent (for example example.com), never the full link, your message or anything about you. We never contact the website itself.
- Supabase (database and file storage in Ireland, European Union).
- Vercel (website hosting; our servers run in Dublin, Ireland, with a global delivery network). Vercel also runs an invisible check that a person, not an automated program, is sending a check when you're signed out. We don't use it to identify you or follow you across websites. Vercel keeps our server logs for about a day.
- PayFast: card payments and subscriptions.
- Sentry (Functional Software, Inc.; data stored in Frankfurt, Germany): reports of errors in our website and servers, so we can fix them. Reports are cleaned before they leave: no message content, screenshots, email addresses, codes, card or payment details, cookies or web addresses with codes in them.
- Vercel Web Analytics: counts visits to our public pages and a few steps (a check started, a result viewed with its risk level only, an account created, the pricing page viewed, a checkout started or completed with the plan name, a plan cancelled), in aggregate. It uses no cookies; Vercel tells visits apart with a temporary code that it discards after 24 hours, and it doesn't identify you. It never receives your messages, links, screenshots, result details, email address or any web address with a code in it. Visits to result, account, invite, payment and sign-in pages aren't counted.
- Resend (United States): sign-in codes and billing emails. Resend keeps the emails and delivery records for 30 days.
Providers' retention periods were checked on their own websites on 2 October 2026 and may change.
When information goes outside South Africa, we rely on the recipient being bound by laws or agreements that give it protection substantially similar to POPIA (section 72), and on it being necessary to provide the service you asked for.
Automated assessments
A check is an automated assessment of a message, not of you. Fixed rules decide the risk level, and AI helps find warning signs and write the explanation. A result has no legal effect on you or anyone else, and we don't use it to make decisions about you. If you want a person to look at a result, email info@dreamachine.co.za with the result link and we'll review it (POPIA section 71).
Emails we send
We send only emails you need to use the service: sign-in codes, receipts and payment notices, plan changes, family invites and important changes to these policies. We don't send marketing emails, and we won't unless you choose to receive them first (POPIA section 69).
Cookies
We use only cookies that the service needs to work: a device cookie that counts your free check, a sign-in cookie if you have an account, and a test cookie used only by our team. We don't use advertising or tracking cookies, so there is no cookie banner. Our visitor counts (Vercel Web Analytics, above) don't use cookies.
Your rights
You can ask us what personal information we hold about you, ask us to correct or delete it, and object to how we use it. Email info@dreamachine.co.za from the address on your account, or tell us which address the request is about. Before we share or change anything, we confirm the request comes from you, usually with a one-time code sent to that address. We respond within 30 days. Requests for records can also be made under our PAIA manual, which lists the forms and any fees.
If you are unhappy with our answer, you can complain to the Information Regulator at inforegulator.org.za.
How we look after it
Original messages are encrypted while we hold them, our database cannot be read from the internet, and we never open the links you send us. We check them against threat lists instead. No system is perfect; if we ever have a breach that affects you, we will tell you and the Information Regulator as POPIA requires.
Children
Under the Protection of Personal Information Act, we may process a child's personal information only with the prior consent of a parent or legal guardian. This is how we do that:
- We don't collect dates of birth or ID numbers. Instead, when you sign in, you confirm that you're 18 or older, or that you're using IsThisSafe as part of a Family plan with your parent's or guardian's permission. We record when you confirmed this and which wording you agreed to.
- Only adults can buy a plan or own a Family plan. We record that the plan owner confirmed they're 18 or older.
- When a Family plan owner invites someone, the owner confirms that, if that person is under 18, the owner is their parent or legal guardian and consents to them using IsThisSafe. We record that consent, who gave it and when, with the invite and with the family membership.
- Family plan owners can remove any member at any time from their account.
- A parent or guardian can ask us to delete a child's account and all of its data by emailing info@dreamachine.co.za. We'll confirm the request is genuine and then delete everything: the account, its checks and its family membership.