Privacy policy

IsThisSafe is run by Dreamachine (Pty) Ltd (registration number 2022/834710/07), [street address now available on request]. We are the responsible party for your personal information under the Protection of Personal Information Act (POPIA). Our Information Officer is [name now available on request], and you can reach them at info@dreamachine.co.za. We are registered with the Information Regulator (registration number 2026-067696).

What we collect and why

• What you ask us to check. The text, links and screenshots you submit. We use them only to check for signs of a scam.
• Details we pull out of it. Links, website names, amounts and organisation names. Phone numbers, email addresses and bank account numbers in a message are kept only as a one-way code (a keyed hash), so we can spot repeat scam contacts without keeping the number itself.
• Your account. If you create one: your email address, your plan, your checks and, for families, who is in your household.
• Payments. PayFast handles card payments. We never see or store your card details. We keep your subscription status and payment reference codes.
• Abuse prevention. A random device cookie and your IP address, stored only as keyed hashes, to count free checks and stop abuse. If you create an account, we also keep a keyed hash of your email address (with dots and "+" extras in Gmail-style addresses ignored), so the free checks are counted once per person. A keyed hash can't be turned back into your email address. We keep it even if you delete your account, so the free checks can't be claimed twice. We don't accept temporary (disposable) email addresses.
• Feedback. If you tell us whether a result helped. This is not linked to you.

We process this information to provide the service you ask for, to meet our contract with you when you subscribe, and for our legitimate interest in preventing fraud and abuse. We never sell your information, never use it for advertising, and never use your submissions to train AI models.

How long we keep it

• Screenshots are deleted as soon as the check finishes. Your original message text is deleted within 24 hours.
• If a screenshot contains a nude, sexual or intimate image, we delete it immediately when it's detected, not after 24 hours. Nobody at IsThisSafe ever views uploaded images. We keep only a count of how many such images were deleted.
• Records of the age and consent confirmations described below are kept for as long as the account exists.
• The result (risk level, score, reasons and a version of the text with personal details removed) is kept so that result links keep working and we can recognise scams that come back.
• Abuse-prevention records are deleted after 48 hours.
• Account information is kept until you delete your account.
• Billing records are kept for as long as tax law requires.

You can delete a check at any time from its result page (on the device you used) or from your account, and you can delete your whole account and its data from your account page.

Who else processes it

We use these service providers. Some are outside South Africa:

• Anthropic (United States): AI analysis of the message or screenshot, and writing the explanation.
• Google Web Risk (Google Cloud): checks links against Google's threat lists. Only links are sent.
• Supabase (database and file storage in Ireland, European Union).
• Vercel (website hosting; our servers run in Dublin, Ireland, with a global delivery network). Vercel also runs an invisible check that a person, not an automated program, is sending a check when you're signed out. We don't use it to identify you or follow you across websites.
• PayFast: card payments and subscriptions.
• Resend (United States): sign-in codes and billing emails.

When information goes outside South Africa, we rely on the recipient being bound by laws or agreements that give it protection substantially similar to POPIA (section 72), and on it being necessary to provide the service you asked for. Our providers may not use your information for their own purposes.

Cookies

We use only cookies that the service needs to work: a device cookie that counts your free check, a sign-in cookie if you have an account, and a test cookie used only by our team. We don't use advertising or tracking cookies, so there is no cookie banner.

Your rights

You can ask us what personal information we hold about you, ask us to correct or delete it, and object to how we use it. Email info@dreamachine.co.za. If you are unhappy with our answer, you can complain to the Information Regulator at inforegulator.org.za.

Keeping it secure

Original messages are encrypted while we hold them, our database cannot be read from the internet, and we never open the links you send us. We check them against security lists instead. No system is perfect; if we ever have a breach that affects you, we will tell you and the Information Regulator as POPIA requires.

Children

Under the Protection of Personal Information Act, we may process a child's personal information only with the prior consent of a parent or legal guardian. This is how we do that:

• We don't collect dates of birth or ID numbers. Instead, when you sign in, you confirm that you're 18 or older, or that you're using IsThisSafe as part of a Family plan with your parent's or guardian's permission. We record when you confirmed this and which wording you agreed to.
• Only adults can buy a plan or own a Family plan. We record that the plan owner confirmed they're 18 or older.
• When a Family plan owner invites someone, the owner confirms that, if that person is under 18, the owner is their parent or legal guardian and consents to them using IsThisSafe. We record that consent, who gave it and when, with the invite and with the family membership.
• Family plan owners can remove any member at any time from their account.
• A parent or guardian can ask us to delete a child's account and all of its data by emailing info@dreamachine.co.za. We'll confirm the request is genuine and then delete everything: the account, its checks and its family membership.