What we keep, why, and what you can ask us to do with it.
The short version
YAF Academy (Young Adult Finance) is run by [registered business name and registration number]. We are responsible for your personal information under the Protection of Personal Information Act (POPIA).
Our Information Officer is [name], who you can reach at yafacademy888@gmail.com.
Your account. Your name, email address and password. Your password is stored scrambled (hashed), so nobody at YAF can read it. We also record when you accepted our terms and whether you want our emails.
Your learning. The lessons you finish, your quiz scores, certificates, XP, streak, life stage and the look you picked.
Your money tools. Whatever you choose to enter: your monthly income, budget, spends, savings goals, and the investments and policies you track, with their values.
Your Vault. What you write in your legacy folder, such as where your will is kept, who to call and your wishes. It sits behind your own Vault PIN.
Other things you send us. Requests to talk to an adviser, feedback and suggestions, workshop bookings and Shop purchases.
Notifications. If you switch on phone notifications, your browser gives us a delivery address for your device. It is not your phone number.
Technical details. Like every website, our server records your IP address, browser type and the pages you open, to keep YAF secure and to fix problems.
When you upload a bank or investment statement, YAF reads it once to find the figures, shows them to you, and then throws the file away. Only the spends or values you confirm are saved.
Bank SMSs you share into YAF are only read when you have switched that on, and again only the spends you confirm are saved.
Card payments happen on our payment provider's own secure page. Your card details never reach YAF.
To run your account and give you the courses, tools and Vault you signed up for. To send you emails or notifications, but only the ones you have switched on. To keep YAF secure and fix problems. And to meet our legal duties, such as keeping payment records.
We use your information this way because you asked us to provide the service, because you gave your consent (which you can withdraw at any time), or because we have a legitimate need to keep the service safe and working.
We never sell your information. We only share it with the service providers we need to run YAF, who may only use it for that:
We will also share information if the law requires it.
Our server is in Germany and our backups are with Google. Both are bound by the European Union's data protection law (GDPR), which gives your information protection at least as strong as POPIA.
All traffic to YAF is encrypted (https). Passwords are hashed. Your Vault is locked behind its own PIN and locks itself again after a few minutes. [Before launch: Vault contents are encrypted in our database.] Only the people who run YAF can reach our server, and our backups are encrypted before they leave it.
We keep your information for as long as you have an account. When you ask us to delete your account, we delete everything in it within 30 days. Copies in our backups are overwritten as the backups roll over, within 12 months. Server records of IP addresses and pages are kept for up to 6 months. Payment records are kept for as long as tax law requires.
You can ask us at any time to show you what we hold about you, to correct it, or to delete it. You can also object to how we use it, or withdraw a consent you gave. Email yafacademy888@gmail.com and we will reply within 30 days.
If you are unhappy with how we handled your information, please tell us first. You can also complain to the Information Regulator: inforegulator.org.za.
You need to be 16 or older to use YAF. If you are under 18, a parent or guardian must agree to you using YAF and to us keeping your information. [Compliance officer to confirm how YAF records that consent.]
YAF uses a few small cookies, only to work properly: one keeps you signed in (for up to a year, unless you log out), and one remembers the look you picked. There are no advertising or tracking cookies, and no outside analytics.
If we change how we use your information, we will update this page and tell you in the app before the change applies.
[Draft, 2026. Effective date to be added when it is signed off.]