Privacy Policy

Last updated: September 2026

This policy explains what Bricks & Sparks collects when you use our website or mobile apps, why we collect it, and what control you have. We've written it in plain language rather than legalese. It is governed by the Protection of Personal Information Act, 2013 (POPIA).

The short version. We collect what we need to match you with tradespeople and run a job safely. We never sell your information, we never share it with advertisers, and we don't track you across other apps or websites. Your card details never touch our servers.

Who we are

Bricks & Sparks is the responsible party for the personal information described here. Our Information Officer can be reached at info@bricksandsparks.co.za.

What we collect, and why

Information	Why we need it
Name and email address	To create your account and contact you about your jobs.
Mobile number (optional)	Job updates by WhatsApp, if you choose to give it.
Your suburb	To match you with tradespeople who work in your area.
Your location (only when you tap "Near me")	To sort tradespeople by distance from where you are. See below.
Job descriptions and photos	So tradespeople can quote accurately.
Street address and access notes	Held privately and released only to the contractor whose quote you accept.
Messages you send on the platform	To deliver them, and as a record if a job is disputed.
Reviews and ratings you write	Published on the contractor's profile.
Tradespeople only: ID document, trade certificates, insurance, WhatsApp number	To verify you are who you say you are and are qualified for the work. Documents are visible only to you and our review team. Your WhatsApp number is never shown to customers.
Payment records (amount, date, which job)	To run escrow and to keep the financial records the law requires. Never your card number — see Payments below.
Device notification token (app only)	To send you push notifications about quotes and payments. Notifications are delivered by Google's Firebase Cloud Messaging on Android and Apple's push service on iPhone; each receives your device token and the text of the notification, and nothing else about you.

In the app stores' words

Apple and Google ask us to declare the same things in their own categories. So that you can check we say the same thing everywhere, here is exactly what we declared, and it is the list above:

Collected and linked to your account: name, email address, phone number (if you give one), the addresses of jobs you post, photos you upload, messages you send, payment records, and — for tradespeople — ID and trade documents. Also diagnostics: the fault reports and start-up self-checks described below.
Collected but never stored: your location, precise and approximate, for the one search you asked for. It is used and discarded.
Not collected at all: payment card details, your contacts, your browsing history, and any advertising identifier.
Used for tracking: nothing. There are no advertising or analytics SDKs in the app, and we do not follow you across other apps or websites.

One exception, and it applies to the website only. When we are advertising, our website loads Google's advertising tag so that we can tell which adverts lead to a job actually being posted. It sets a cookie from google.com and tells Google that a job was posted — not who posted it, not what the job was, and nothing you typed. It is never loaded inside the iPhone or Android app, which is why the declaration above still says no tracking: the app really does none. You can stop it on the website by blocking third-party cookies in your browser; everything on the site works the same either way.

Your location

When you tap "Near me", your device asks your permission and gives us your coordinates for that one search. We use them to work out which tradespeople are closest, and we round them to roughly a hundred metres. We do not store your location, we do not build a history of where you've been, and we do not track you in the background. Decline the permission and everything else still works — you just pick your suburb from a list instead.

Payments

We never see or store your card details. When you fund a job, you pay on a page hosted by our licensed escrow provider, who holds the money until you approve the work. We receive only a confirmation that a payment succeeded and the amount. The escrow provider processes your payment information as a separate responsible party under their own terms.

Business listings taken from public sources

Some tradespeople appear on Bricks & Sparks as unverified listings that we compiled from public business directories and companies' own websites, before those businesses joined. For these we hold the business name, trade, area, and business contact details, together with a record of where we found them.

We do not publish those contact details. If a listing is yours you can claim it free of charge, correct anything that's wrong, or ask us to remove it entirely — email info@bricksandsparks.co.za and we will act promptly. Sole proprietors' business details can constitute personal information under POPIA, and we treat removal requests accordingly.

Who we share information with

The other party to your job. A contractor you invite sees your suburb, your job description and photos. Your street address and access notes are released only when you accept their quote.
Our escrow provider, to set up and release payment for a job.
Service providers who host our servers and deliver our messages, under contract and only as needed to run the service.
Law enforcement or regulators, where the law requires it.

We do not sell your personal information. We do not share it with advertisers. We do not use it to profile you for advertising.

Fault reports from the app

When something breaks we need to know what actually happened on the phone, because a fault that only appears on a real handset is otherwise invisible to us. Two things collect that:

When you tap "Report a bug" we record the page you were on, the version of the site you were running, and your browser or app version, alongside whatever you type. You choose when this happens.
When the app starts it sends us a short self-check: which phone platform it is, which app features are working, whether you have allowed notifications and location, which version of our code it is running, and the network address the request came from. This one is automatic.

Neither carries the contents of your jobs, your messages or your documents. We use them only to find and fix faults, and we keep only the most recent few hundred self-checks — older ones are discarded automatically.

Cookies

We use a single cookie to keep you logged in, and a security token to protect forms from misuse.

On the website, when we are running adverts, Google's advertising tag also sets a cookie so Google can tell that an advert led to a job being posted. It is used for that measurement and nothing else: we do not build audiences, we do not run remarketing, and we have not installed Google Analytics. Block third-party cookies and the site behaves exactly as it does now.

In the iPhone and Android apps there is no advertising cookie and no tag at all — only the login cookie and the security token.

How long we keep things

Your account: until you delete it.
Financial records (invoices, payments, payouts): retained after deletion where South African tax and company law require it — generally five years.
Job and dispute records: kept for as long as needed to resolve any claim arising from the work.
Verification documents: kept while the tradesperson is active, then deleted.
Fault reports: bug reports until the fault is resolved; automatic app self-checks only until a few hundred newer ones replace them.

Deleting your account

You can delete your account yourself at any time from your account settings, in both the website and the apps. This page explains exactly how, including what to do if you can no longer sign in. When you do, we remove your name, email address, phone number, address and messages, and disable your login immediately.

We keep an anonymised financial record of completed jobs, because the law requires it — but it is no longer linked to you by name or contact details. We can't delete an account while money is still held in escrow or a job is in progress; finish or cancel those first and the option becomes available.

Your rights under POPIA

You may ask us to show you what we hold about you, correct anything that's wrong, delete it, or object to how we use it. Email info@bricksandsparks.co.za and we will respond within a reasonable period. If you're unhappy with our answer, you may complain to the Information Regulator of South Africa (inforegulator.org.za).

Security

Traffic to our site is encrypted. Passwords are stored using a slow one-way hash and can never be read back, by us or anyone else. Verification documents are accessible only to their owner and our review team. No system is perfectly secure, but we take this seriously and will tell you promptly if a breach affects your information, as POPIA requires.

Children

Bricks & Sparks is for people aged 18 and over. We don't knowingly collect information from children.

Changes

If we change this policy we'll update the date at the top, and tell you in the app if the change is significant.

Questions about this page? Email info@bricksandsparks.co.za.